@dynamic-labs-sdk/client 1.13.0 → 1.15.0

package/dist/{InvalidParamError-C7c-OLz1.cjs → InvalidParamError-BPY2yug_.cjs}

@@ -1,9 +1,9 @@
-const require_isMfaRequiredForAction = require('./isMfaRequiredForAction-CgWBU6kM.cjs');
+const require_isMfaRequiredForAction = require('./isMfaRequiredForAction-DsOwHl4C.cjs');
 let _dynamic_labs_sdk_api_core = require("@dynamic-labs/sdk-api-core");
 
 //#region package.json
 var name = "@dynamic-labs-sdk/client";
-var version = "1.13.0";
+var version = "1.15.0";
 var dependencies = {
 	"@dynamic-labs-sdk/assert-package-version": "workspace:*",
 	"@dynamic-labs-wallet/browser-wallet-client": "1.0.39",
@@ -152,757 +152,304 @@ const randomString = ({ chars = DEFAULT_CHARS, length }) => {
 };
 
 //#endregion
-//#region src/modules/auth/extractSessionId/extractSessionId.ts
+//#region src/modules/auth/getElevatedAccessToken/getElevatedAccessToken.ts
 /**
-* Extracts the session ID (`sid` claim) from a JWT token string.
+* Gets an elevated access token by scope.
 *
-* Decodes the base64url-encoded payload segment of the token and reads the
-* `sid` field. This is used to correlate instrumentation events with the
-* authenticated session, without ever forwarding the full token.
+* This function retrieves an elevated access token that contains the specified scope.
+* Expired tokens are automatically filtered out.
 *
-* Returns `null` when no token is present, when the token is malformed, or
-* when the payload does not contain a `sid` claim.
+* By default, if the token has `singleUse: true`, it will be automatically
+* consumed (removed from state) after retrieval. Pass `consume: false` to
+* check for token existence without consuming it.
+*
+* @param params - The parameters object.
+* @param params.scope - The scope to match (e.g., 'wallet:export').
+* @param params.consume - Whether to consume single-use tokens (default: true).
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns The elevated access token if found and not expired, or undefined if not found or expired.
+*
+* @example
+* ```typescript
+* // Retrieve and consume (default)
+* const token = getElevatedAccessToken({ scope: 'wallet:export' });
+*
+* // Check existence without consuming
+* const token = getElevatedAccessToken({ scope: 'credential:unlink', consume: false });
+* ```
 * @notInstrumented
 */
-const extractSessionId = (token) => {
-	try {
-		const payload = token.split(".")[1];
-		return JSON.parse(atob(payload)).sid ?? null;
-	} catch {
-		return null;
+const getElevatedAccessToken = ({ consume = true, scope }, client = getDefaultClient()) => {
+	const core = getCore(client);
+	const now = /* @__PURE__ */ new Date();
+	const elevatedAccessTokens = core.state.get().elevatedAccessTokens || [];
+	const validTokens = elevatedAccessTokens.filter((token$1) => !token$1.expiresAt || token$1.expiresAt > now);
+	if (validTokens.length !== elevatedAccessTokens.length) core.state.set({ elevatedAccessTokens: validTokens });
+	const token = validTokens.find((token$1) => token$1.scopes.includes(scope));
+	if (!token) return;
+	if (consume && token.singleUse) {
+		const updatedTokens = validTokens.filter((t) => t !== token);
+		core.state.set({ elevatedAccessTokens: updatedTokens });
 	}
+	return token.token;
 };
 
 //#endregion
-//#region src/utils/getOperatingSystem/getOperatingSystem.ts
-/**
-* Detects the operating system from `navigator.userAgent` for web environments.
-*
-* The React Native bundler (Metro) resolves `getOperatingSystem.native.ts`
-* instead when building for React Native, which uses `Platform.OS` directly.
-*
-* Falls back to `'unknown'` when `navigator` is unavailable (SSR, service
-* workers) or when the user-agent string doesn't match a known OS pattern.
-* @notInstrumented
-*/
-const getOperatingSystem = () => {
-	try {
-		const ua = navigator.userAgent;
-		if (/iPhone|iPad|iPod/.test(ua)) return "ios";
-		if (/Android/.test(ua)) return "android";
-		if (/Windows/.test(ua)) return "windows";
-		if (/Macintosh|Mac OS X/.test(ua)) return "macos";
-		if (/Linux/.test(ua)) return "linux";
-		return "unknown";
-	} catch {
-		return "unknown";
+//#region src/errors/ValueMustBeDefinedError.ts
+var ValueMustBeDefinedError = class extends BaseError {
+	constructor(message) {
+		super({
+			cause: null,
+			code: "value_must_be_defined_error",
+			docsUrl: null,
+			name: "ValueMustBeDefined",
+			shortMessage: message
+		});
 	}
 };
 
 //#endregion
-//#region src/utils/getPlatform/getPlatform.ts
+//#region src/utils/assertDefined/assertDefined.ts
 /**
-* Returns the platform the SDK is running on.
+* Asserts that a value is not null or undefined, throwing an error if it is.
+* This function acts as a type guard, narrowing the type to exclude null and undefined.
 *
-* This is the web implementation — the React Native bundler resolves
-* `getPlatform.native.ts` instead when building for React Native, which
-* returns `'react-native'`.
-* @notInstrumented
+* @template T - The type of the value being checked
+* @param value - The value to check for null or undefined
+* @param message - The error message to throw if the value is null or undefined
+* @throws Throws an error with the provided message if value is null or undefined
+* @example
+* ```typescript
+* const maybeString: string | null = getValue();
+* assertDefined(maybeString, 'String value is required');
+* // maybeString is now typed as string (null is excluded)
+* ```
 */
-const getPlatform = () => "web";
+function assertDefined(value, message) {
+	if (value === null || value === void 0) throw new ValueMustBeDefinedError(message);
+}
 
 //#endregion
-//#region src/utils/getUserAgent/getUserAgent.ts
+//#region src/modules/projectSettings/isCookieEnabled/isCookieEnabled.ts
 /**
-* Returns the browser's `navigator.userAgent` string for inclusion in
-* instrumentation events.
-*
-* Falls back to an empty string in environments where `navigator` is not
-* available (e.g., Node.js SSR, service workers) so that callers never need
-* to guard against undefined.
+* Returns true if the client is using Dynamic cookies or a BYO JWT cookie.
 * @notInstrumented
 */
-const getUserAgent = () => {
-	try {
-		return navigator.userAgent;
-	} catch {
-		return "";
-	}
+const isCookieEnabled = (client) => {
+	assertDefined(client.projectSettings, "Project settings are not defined");
+	const securitySettings = client.projectSettings.security;
+	if (!securitySettings) return false;
+	const dynamicCookiesEnabled = (securitySettings.auth?.storage || []).includes(_dynamic_labs_sdk_api_core.AuthStorageEnum.Cookie);
+	const byoJwtCookieEnabled = Boolean(securitySettings.externalAuth?.cookieName);
+	return dynamicCookiesEnabled || byoJwtCookieEnabled;
 };
 
 //#endregion
-//#region src/services/instrumentation/constants.ts
-/**
-* Default key-based PII scrubber list, lowercased and matched against the
-* lowercased object key.
-*
-* Two complementary mechanisms cover credential leakage:
-*
-* 1. Explicit keys listed here — matched exactly (case-insensitive). Use this
-*    for keys that don't end in a generic credential suffix (e.g. `mnemonic`,
-*    `seed`, `verificationCode`, `keyShare`).
-* 2. Suffix matching in {@link scrubParameters} for the credential suffixes
-*    enumerated by {@link PII_KEY_SUFFIXES} — catches any field whose name
-*    ends in `token` or `jwt` (e.g. `mfaToken`, `minifiedJwt`, `accessToken`,
-*    `idToken`, `captchaToken`, …) without needing to enumerate them here.
-*/
-const DEFAULT_PII_FIELDS = [
-	"password",
-	"token",
-	"secret",
-	"privateKey",
-	"privateJwk",
-	"mnemonic",
-	"seed",
-	"keyShare",
-	"keyShares",
-	"email",
-	"phone",
-	"ssn",
-	"address",
-	"authorization",
-	"verificationCode",
-	"recoveryCodes",
-	"codeVerifier",
-	"pkce",
-	"bearer",
-	"apiKey"
-];
-/**
-* Lowercased suffixes used by {@link scrubParameters} to match credential-like
-* keys without enumerating every variant (e.g. `mfaToken`, `accessToken`,
-* `refreshToken`, `legacyToken`, `minifiedJwt`). Only suffixes that are
-* unambiguously credentials belong here — `key` (matches `publicKey`) and
-* `code` (matches `countryCode`) are too broad and must not be added.
-*/
-const PII_KEY_SUFFIXES = ["token", "jwt"];
-const REDACTED_VALUE = "[REDACTED]";
-const MAX_STRING_LENGTH = 500;
-const TRUNCATED_SUFFIX = "...[truncated]";
-/**
-* Label prefix for binary data placeholders. The full placeholder includes the
-* byte length, e.g. `[Binary:16 bytes]`, so consumers can gauge data size
-* without the actual bytes appearing in logs.
-*/
-const BINARY_LABEL = "Binary";
-/**
-* Placeholder emitted when a circular reference is detected in the value tree.
-* Using a named constant makes it easy to search for or filter in downstream
-* log tooling.
-*/
-const CIRCULAR_VALUE = "[Circular]";
+//#region src/modules/sessionKeys/getSessionKeys/getSessionKeys.ts
+/** @notInstrumented */
+const getSessionKeys = (client) => {
+	const publicKey = getCore(client).state.get().sessionKeys;
+	if (!publicKey) return;
+	return { publicKey };
+};
 
 //#endregion
-//#region src/services/instrumentation/scrubParameters/scrubParameters.ts
-/**
-* Returns true when `key` should be redacted based on the configured PII
-* field list. A key matches when its lowercased form either equals one of
-* `piiFieldsLower` exactly, or ends in one of the curated credential
-* suffixes in {@link PII_KEY_SUFFIXES} (currently `token` and `jwt`). The
-* suffix check is what catches `mfaToken`, `minifiedJwt`, `accessToken`,
-* etc. without needing every variant enumerated explicitly.
-*/
-const keyMatchesPiiField = ({ keyLower, piiFieldsLower }) => {
-	if (piiFieldsLower.includes(keyLower)) return true;
-	return PII_KEY_SUFFIXES.some((suffix) => keyLower.endsWith(suffix));
+//#region src/errors/APIError/APIError.ts
+var APIError = class APIError extends BaseError {
+	status;
+	constructor(message, code, status) {
+		super({
+			cause: null,
+			code,
+			docsUrl: null,
+			name: "APIError",
+			shortMessage: message
+		});
+		this.status = status;
+	}
+	static async fromResponse(response) {
+		try {
+			const errorBody = await response.clone().json();
+			if (errorBody && "error" in errorBody && typeof errorBody.error === "string") {
+				const errorCode = "code" in errorBody && typeof errorBody.code === "string" ? errorBody.code : "unknown_error";
+				return new APIError(errorBody.error, errorCode, response.status);
+			}
+			return null;
+		} catch {
+			return null;
+		}
+	}
 };
-const scrubString = ({ key, piiFieldsLower, redactAll, value }) => {
-	if (keyMatchesPiiField({
-		keyLower: key.toLowerCase(),
-		piiFieldsLower
-	})) return REDACTED_VALUE;
-	if (redactAll) return REDACTED_VALUE;
-	if (value.length > MAX_STRING_LENGTH) return value.slice(0, MAX_STRING_LENGTH) + TRUNCATED_SUFFIX;
-	return value;
+
+//#endregion
+//#region src/errors/InvalidExternalAuthError.ts
+var InvalidExternalAuthError = class extends BaseError {
+	constructor({ cause }) {
+		super({
+			cause,
+			code: "invalid_external_auth_error",
+			docsUrl: "https://www.dynamic.xyz/docs/external-auth/third-party-auth-overview",
+			name: "InvalidExternalAuthError",
+			shortMessage: "Error authenticating with external JWT"
+		});
+	}
 };
-const scrubArray = ({ context, value }) => {
-	if (context.visited.has(value)) return [CIRCULAR_VALUE];
-	context.visited.add(value);
-	const result = value.map((item, index) => scrubValue({
-		context,
-		key: String(index),
-		value: item
-	}));
-	context.visited.delete(value);
-	return result;
-};
-const scrubObject = ({ context, value }) => {
-	if (context.visited.has(value)) return { [CIRCULAR_VALUE]: true };
-	context.visited.add(value);
-	const result = Object.create(null);
-	for (const key of Object.keys(value)) result[key] = scrubValue({
-		context,
-		key,
-		value: value[key]
-	});
-	context.visited.delete(value);
-	return result;
+
+//#endregion
+//#region src/errors/LinkCredentialError.ts
+var LinkCredentialError = class extends BaseError {
+	constructor({ cause }) {
+		super({
+			cause,
+			code: "link_credential_error",
+			docsUrl: null,
+			name: "LinkCredentialError",
+			shortMessage: "The credential you are trying to link is associated with another account and cannot be reassigned."
+		});
+	}
 };
-const scrubValue = ({ context, key, value }) => {
-	if (value === null || value === void 0) return value;
-	if (value instanceof Uint8Array) return `[${BINARY_LABEL}:${value.byteLength} bytes]`;
-	if (keyMatchesPiiField({
-		keyLower: key.toLowerCase(),
-		piiFieldsLower: context.piiFieldsLower
-	})) return REDACTED_VALUE;
-	if (typeof value === "string") return scrubString({
-		key,
-		piiFieldsLower: context.piiFieldsLower,
-		redactAll: context.redactAll,
-		value
-	});
-	if (Array.isArray(value)) return scrubArray({
-		context,
-		value
-	});
-	if (value instanceof Set) {
-		if (context.visited.has(value)) return [CIRCULAR_VALUE];
-		context.visited.add(value);
-		const setResult = scrubArray({
-			context,
-			value: [...value]
+
+//#endregion
+//#region src/errors/MfaInvalidOtpError.ts
+var MfaInvalidOtpError = class extends BaseError {
+	constructor({ cause }) {
+		super({
+			cause,
+			code: "mfa_invalid_otp_error",
+			docsUrl: null,
+			name: "MfaInvalidOtpError",
+			shortMessage: "Invalid OTP"
 		});
-		context.visited.delete(value);
-		return setResult;
 	}
-	if (value instanceof Map) {
-		if (context.visited.has(value)) return { [CIRCULAR_VALUE]: true };
-		context.visited.add(value);
-		const asObject = Object.create(null);
-		for (const [k, v] of value.entries()) asObject[String(k)] = v;
-		const mapResult = scrubObject({
-			context,
-			value: asObject
+};
+
+//#endregion
+//#region src/errors/MfaRateLimitedError.ts
+var MfaRateLimitedError = class extends BaseError {
+	constructor({ cause }) {
+		super({
+			cause,
+			code: "mfa_rate_limited_error",
+			docsUrl: null,
+			name: "MfaRateLimitedError",
+			shortMessage: "Rate limited"
 		});
-		context.visited.delete(value);
-		return mapResult;
 	}
-	if (value instanceof WeakMap) return "[WeakMap]";
-	if (value instanceof WeakSet) return "[WeakSet]";
-	if (value instanceof Date) return value.toISOString();
-	if (value instanceof Error) return `[Error: ${value.message}]`;
-	if (typeof value === "object") return scrubObject({
-		context,
-		value
-	});
-	return value;
 };
-/** @notInstrumented */
-const scrubParameters = ({ piiFields, redactAll, value }) => {
-	return scrubObject({
-		context: {
-			piiFieldsLower: piiFields.map((field) => field.toLowerCase()),
-			redactAll,
-			visited: /* @__PURE__ */ new WeakSet()
-		},
-		value
-	});
+
+//#endregion
+//#region src/errors/SandboxMaximumThresholdReachedError.ts
+var SandboxMaximumThresholdReachedError = class extends BaseError {
+	constructor({ cause }) {
+		super({
+			cause,
+			code: "sandbox_maximum_threshold_reached_error",
+			docsUrl: "https://www.dynamic.xyz/docs/developer-dashboard/sandbox-vs-live#sandbox-vs-live",
+			name: "SandboxMaximumThresholdReachedError",
+			shortMessage: "Your sandbox environment has reached the maximum MAU. Please use a live environment for production traffic."
+		});
+	}
 };
 
 //#endregion
-//#region src/services/instrumentation/instrumentFunction/extractParams/extractParams.ts
+//#region src/modules/apiClient/utils/clientErrorMapper/clientErrorMapper.ts
 /**
-* Normalises the raw positional arguments of an instrumented function call
-* into a flat `Record<string, unknown>` suitable for structured logging.
-*
-* ## Why this is needed
+* Default error mapper for the client that handles common API error codes.
 *
-* Instrumented functions are wrapped with `(...args: unknown[])`, so their
-* parameters arrive as an array. Logging a raw array loses the semantic names
-* of each argument. This function recovers a named representation:
+* This mapper transforms specific API error codes into more specific error types:
+* - `mfa_invalid_code` → `MfaInvalidOtpError`
+* - `mfa_rate_limited` → `MfaRateLimitedError`
 *
-* - **No arguments** → `{}`
-* - **Single plain-object argument** → that object is returned as-is, because
-*   SDK functions follow the single-object-parameter convention, so the object
-*   already carries named keys (`{ amount, to }`, etc.).
-* - **Everything else** (multiple args, a single primitive, a single array) →
-*   each value is indexed as `arg0`, `arg1`, …
+* @param error - The error to be mapped
+* @returns A transformed error if the error code matches a known pattern, or null if no transformation is needed
 *
-* ## Why arrays are NOT treated as plain objects
+* @example
+* ```typescript
+* // This will be automatically applied to all API errors
+* const apiClient = createApiClient({}, client);
 *
-* `typeof [] === 'object'` and `[] !== null`, so without the `Array.isArray`
-* guard a single-array argument would be returned as-is. That would produce
-* an object with numeric string keys (`{ '0': ..., '1': ... }`), which is
-* misleading and inconsistent with how multi-arg calls are handled. Instead,
-* arrays fall through to the indexed `arg0` path.
+* // The clientErrorMapper will automatically convert mfa_invalid_code errors
+* // to MfaInvalidOtpError instances
+* ```
 * @notInstrumented
 */
-const extractParams = (args) => {
-	if (args.length === 0) return {};
-	if (args.length === 1 && typeof args[0] === "object" && args[0] !== null && !Array.isArray(args[0])) return args[0];
-	const result = {};
-	for (let i = 0; i < args.length; i++) result[`arg${i}`] = args[i];
-	return result;
+const clientErrorMapper = (error) => {
+	if (error instanceof APIError) {
+		if (error.code === "mfa_invalid_code") return new MfaInvalidOtpError({ cause: error });
+		if (error.code === "mfa_rate_limited") return new MfaRateLimitedError({ cause: error });
+		if (error.code === "invalid_external_auth") return new InvalidExternalAuthError({ cause: error });
+		if (error.code === "sandbox_maximum_threshold_reached") return new SandboxMaximumThresholdReachedError({ cause: error });
+		if (error.code === "merge_accounts_invalid" || error.code === "reassign_wallet_error") return new LinkCredentialError({ cause: error });
+	}
+	return null;
 };
 
 //#endregion
-//#region src/services/instrumentation/instrumentFunction/scrubResolvedValue/scrubResolvedValue.ts
+//#region src/modules/apiClient/utils/convertToApiErrorMiddleware/convertToApiErrorMiddleware.ts
 /**
-* Scrubs a resolved return value of any type before logging it.
-* Routes through `scrubParameters` by wrapping the value so that strings,
-* arrays, Dates, Errors, and all other types are handled identically to
-* nested object fields.
+* Creates middleware that converts HTTP error responses to APIError instances
+* and optionally applies custom error mappers to transform them into specific error types.
+*
+* @param options.errorMappers - Array of error mappers to apply to API errors
+* @returns A middleware function that handles error conversion and mapping
 * @notInstrumented
 */
-const scrubResolvedValue = ({ piiFields, redactAll, value }) => scrubParameters({
-	piiFields,
-	redactAll,
-	value: { result: value }
-}).result;
+const createConvertToApiErrorMiddleware = ({ errorMappers = [] }) => ({ post: async (context) => {
+	if (context.response.status >= 400) {
+		const apiError = await APIError.fromResponse(context.response);
+		if (apiError) {
+			let errorToThrow = apiError;
+			for (const mapper of errorMappers) {
+				const newError = mapper(apiError);
+				if (newError) {
+					errorToThrow = newError;
+					break;
+				}
+			}
+			throw errorToThrow;
+		}
+	}
+	return context.response;
+} });
 
 //#endregion
-//#region src/services/instrumentation/instrumentFunction/instrumentFunction.ts
-const serializeError = (error) => {
-	if (error instanceof Error) return {
-		message: error.message,
-		name: error.name,
-		stack: error.stack
-	};
+//#region src/utils/getNonce/getNonce.ts
+/**
+* Returns a nonce for wallet ownership verification.
+*
+* Pops the first nonce from the prefetched pool. When the pool is running low
+* (≤1 remaining after pop) a background refetch is triggered. If the pool is
+* empty, nonces are fetched on-demand before returning.
+* @notInstrumented
+*/
+const getNonce = async (client) => {
+	const core = getCore(client);
+	const pool = core.state.get().prefetchedNonces;
+	if (pool.length > 0) {
+		const [nonce, ...remaining] = pool;
+		core.state.set({ prefetchedNonces: remaining });
+		if (remaining.length <= 1) fetchAndStoreNonces(client);
+		return nonce;
+	}
+	await fetchAndStoreNonces(client);
+	return getNonce(client);
+};
+
+//#endregion
+//#region src/modules/deviceRegistration/getDeviceSigner/getDeviceSigner.ts
+/** @notInstrumented */
+const getDeviceSigner = async (client) => {
+	const { deviceSigner, keychain } = getCore(client);
+	/**
+	* If the device signer is available, it should handle the device signing.
+	* This is used for mobile devices with secure enclave.
+	*/
+	if (deviceSigner) return deviceSigner;
+	const keyName = "device";
+	if (!await keychain.getPublicKey(keyName)) await keychain.generateKey(keyName);
 	return {
-		message: String(error),
-		name: "UnknownError"
-	};
-};
-/**
-* Wraps a function so that each invocation emits a structured
-* `FunctionInstrumentationEvent` at three lifecycle points:
-*
-* - **started** — immediately before the function body executes, with the
-*   PII-scrubbed call parameters.
-* - **resolved** — after the function (or its returned Promise) settles
-*   successfully, with the PII-scrubbed return value.
-* - **rejected** — if the function throws synchronously or its returned
-*   Promise rejects.
-*
-* The original return value (or thrown error) is always forwarded to the
-* caller unchanged — instrumentation is purely observational.
-*
-* ## Usage
-*
-* ```ts
-* const transfer = instrumentFunction({
-*   fn: rawTransfer,
-*   functionName: 'transfer',
-*   getCore: () => core,
-* });
-*
-* // When called, three events are emitted automatically:
-* await transfer({ amount: 1, to: '0xabc' });
-* ```
-*
-* ## How functions are wrapped
-*
-* `instrumentFunction` is not called manually in application code. Instead,
-* the esbuild instrumentation plugin (`tools/instrumentation-plugin`) injects
-* it at build time: any exported function annotated with `@instrumented` in its
-* JSDoc is automatically wrapped by the plugin during the build step.
-* The plugin strips the original `export`, renames the function, and re-exports
-* it under the original name via `instrumentFunction(...)` — so the public API
-* is unchanged and no call sites need to be updated.
-*
-* ## Opting out
-*
-* Instrumentation is skipped entirely when:
-* - `getCore()` returns `undefined` (SDK not initialised), or
-* - `core.instrumentation.config.enabled` is `false`.
-*
-* In both cases the original function is called directly with no overhead.
-*
-* ## PII scrubbing
-*
-* All string values whose key appears in `piiFields` are replaced with
-* `"[redacted]"` before events are emitted. Pass `redactAll: true` to redact
-* every field, regardless of key name.
-* @notInstrumented
-*/
-const instrumentFunction = ({ fn, functionName, getCore: getCore$1, redactAll }) => {
-	const wrapped = (...args) => {
-		const core = getCore$1();
-		if (!core) return fn(...args);
-		if (!core.instrumentation.config.enabled) return fn(...args);
-		const instrumentation = core.instrumentation;
-		const state = core.state.get();
-		const baseEvent = {
-			environmentId: core.environmentId,
-			functionName,
-			operatingSystem: getOperatingSystem(),
-			parameters: scrubParameters({
-				piiFields: instrumentation.config.piiFields,
-				redactAll,
-				value: extractParams(args)
-			}),
-			platform: getPlatform(),
-			registeredExtensionKeys: Array.from(core.extensions),
-			sdkSessionId: core.sdkSessionId,
-			sdkVersion: core.version,
-			status: "info",
-			tokenSessionId: state.token ? extractSessionId(state.token) : null,
-			userAgent: getUserAgent(),
-			userId: state.user?.id ?? null
-		};
-		instrumentation.logFunction({
-			...baseEvent,
-			phase: "started",
-			timestamp: (/* @__PURE__ */ new Date()).toISOString()
-		});
-		try {
-			const result = fn(...args);
-			if (result instanceof Promise) return result.then((value) => {
-				instrumentation.logFunction({
-					...baseEvent,
-					phase: "resolved",
-					resolvedValue: scrubResolvedValue({
-						piiFields: instrumentation.config.piiFields,
-						redactAll,
-						value
-					}),
-					timestamp: (/* @__PURE__ */ new Date()).toISOString()
-				});
-				return value;
-			}).catch((error) => {
-				instrumentation.logFunction({
-					...baseEvent,
-					phase: "rejected",
-					rejectedError: serializeError(error),
-					timestamp: (/* @__PURE__ */ new Date()).toISOString()
-				});
-				throw error;
-			});
-			instrumentation.logFunction({
-				...baseEvent,
-				phase: "resolved",
-				resolvedValue: scrubResolvedValue({
-					piiFields: instrumentation.config.piiFields,
-					redactAll,
-					value: result
-				}),
-				timestamp: (/* @__PURE__ */ new Date()).toISOString()
-			});
-			return result;
-		} catch (error) {
-			instrumentation.logFunction({
-				...baseEvent,
-				phase: "rejected",
-				rejectedError: serializeError(error),
-				timestamp: (/* @__PURE__ */ new Date()).toISOString()
-			});
-			throw error;
-		}
-	};
-	return wrapped;
-};
-
-//#endregion
-//#region src/modules/auth/getElevatedAccessToken/getElevatedAccessToken.ts
-/**
-* Gets an elevated access token by scope.
-*
-* This function retrieves an elevated access token that contains the specified scope.
-* Expired tokens are automatically filtered out.
-*
-* By default, if the token has `singleUse: true`, it will be automatically
-* consumed (removed from state) after retrieval. Pass `consume: false` to
-* check for token existence without consuming it.
-*
-* @param params - The parameters object.
-* @param params.scope - The scope to match (e.g., 'wallet:export').
-* @param params.consume - Whether to consume single-use tokens (default: true).
-* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
-* @returns The elevated access token if found and not expired, or undefined if not found or expired.
-*
-* @example
-* ```typescript
-* // Retrieve and consume (default)
-* const token = getElevatedAccessToken({ scope: 'wallet:export' });
-*
-* // Check existence without consuming
-* const token = getElevatedAccessToken({ scope: 'credential:unlink', consume: false });
-* ```
-* @notInstrumented
-*/
-const getElevatedAccessToken = ({ consume = true, scope }, client = getDefaultClient()) => {
-	const core = getCore(client);
-	const now = /* @__PURE__ */ new Date();
-	const elevatedAccessTokens = core.state.get().elevatedAccessTokens || [];
-	const validTokens = elevatedAccessTokens.filter((token$1) => !token$1.expiresAt || token$1.expiresAt > now);
-	if (validTokens.length !== elevatedAccessTokens.length) core.state.set({ elevatedAccessTokens: validTokens });
-	const token = validTokens.find((token$1) => token$1.scopes.includes(scope));
-	if (!token) return;
-	if (consume && token.singleUse) {
-		const updatedTokens = validTokens.filter((t) => t !== token);
-		core.state.set({ elevatedAccessTokens: updatedTokens });
-	}
-	return token.token;
-};
-const __getElevatedAccessToken_impl = getElevatedAccessToken;
-const __getElevatedAccessToken_wrapped = instrumentFunction({
-	fn: __getElevatedAccessToken_impl,
-	functionName: "getElevatedAccessToken",
-	getCore: () => {
-		try {
-			return getCore(getDefaultClient());
-		} catch {
-			return;
-		}
-	}
-});
-
-//#endregion
-//#region src/errors/ValueMustBeDefinedError.ts
-var ValueMustBeDefinedError = class extends BaseError {
-	constructor(message) {
-		super({
-			cause: null,
-			code: "value_must_be_defined_error",
-			docsUrl: null,
-			name: "ValueMustBeDefined",
-			shortMessage: message
-		});
-	}
-};
-
-//#endregion
-//#region src/utils/assertDefined/assertDefined.ts
-/**
-* Asserts that a value is not null or undefined, throwing an error if it is.
-* This function acts as a type guard, narrowing the type to exclude null and undefined.
-*
-* @template T - The type of the value being checked
-* @param value - The value to check for null or undefined
-* @param message - The error message to throw if the value is null or undefined
-* @throws Throws an error with the provided message if value is null or undefined
-* @example
-* ```typescript
-* const maybeString: string | null = getValue();
-* assertDefined(maybeString, 'String value is required');
-* // maybeString is now typed as string (null is excluded)
-* ```
-*/
-function assertDefined(value, message) {
-	if (value === null || value === void 0) throw new ValueMustBeDefinedError(message);
-}
-
-//#endregion
-//#region src/modules/projectSettings/isCookieEnabled/isCookieEnabled.ts
-/**
-* Returns true if the client is using Dynamic cookies or a BYO JWT cookie.
-* @notInstrumented
-*/
-const isCookieEnabled = (client) => {
-	assertDefined(client.projectSettings, "Project settings are not defined");
-	const securitySettings = client.projectSettings.security;
-	if (!securitySettings) return false;
-	const dynamicCookiesEnabled = (securitySettings.auth?.storage || []).includes(_dynamic_labs_sdk_api_core.AuthStorageEnum.Cookie);
-	const byoJwtCookieEnabled = Boolean(securitySettings.externalAuth?.cookieName);
-	return dynamicCookiesEnabled || byoJwtCookieEnabled;
-};
-
-//#endregion
-//#region src/modules/sessionKeys/getSessionKeys/getSessionKeys.ts
-/** @notInstrumented */
-const getSessionKeys = (client) => {
-	const publicKey = getCore(client).state.get().sessionKeys;
-	if (!publicKey) return;
-	return { publicKey };
-};
-
-//#endregion
-//#region src/errors/APIError/APIError.ts
-var APIError = class APIError extends BaseError {
-	status;
-	constructor(message, code, status) {
-		super({
-			cause: null,
-			code,
-			docsUrl: null,
-			name: "APIError",
-			shortMessage: message
-		});
-		this.status = status;
-	}
-	static async fromResponse(response) {
-		try {
-			const errorBody = await response.clone().json();
-			if (errorBody && "error" in errorBody && typeof errorBody.error === "string") {
-				const errorCode = "code" in errorBody && typeof errorBody.code === "string" ? errorBody.code : "unknown_error";
-				return new APIError(errorBody.error, errorCode, response.status);
-			}
-			return null;
-		} catch {
-			return null;
-		}
-	}
-};
-
-//#endregion
-//#region src/errors/InvalidExternalAuthError.ts
-var InvalidExternalAuthError = class extends BaseError {
-	constructor({ cause }) {
-		super({
-			cause,
-			code: "invalid_external_auth_error",
-			docsUrl: "https://www.dynamic.xyz/docs/external-auth/third-party-auth-overview",
-			name: "InvalidExternalAuthError",
-			shortMessage: "Error authenticating with external JWT"
-		});
-	}
-};
-
-//#endregion
-//#region src/errors/LinkCredentialError.ts
-var LinkCredentialError = class extends BaseError {
-	constructor({ cause }) {
-		super({
-			cause,
-			code: "link_credential_error",
-			docsUrl: null,
-			name: "LinkCredentialError",
-			shortMessage: "The credential you are trying to link is associated with another account and cannot be reassigned."
-		});
-	}
-};
-
-//#endregion
-//#region src/errors/MfaInvalidOtpError.ts
-var MfaInvalidOtpError = class extends BaseError {
-	constructor({ cause }) {
-		super({
-			cause,
-			code: "mfa_invalid_otp_error",
-			docsUrl: null,
-			name: "MfaInvalidOtpError",
-			shortMessage: "Invalid OTP"
-		});
-	}
-};
-
-//#endregion
-//#region src/errors/MfaRateLimitedError.ts
-var MfaRateLimitedError = class extends BaseError {
-	constructor({ cause }) {
-		super({
-			cause,
-			code: "mfa_rate_limited_error",
-			docsUrl: null,
-			name: "MfaRateLimitedError",
-			shortMessage: "Rate limited"
-		});
-	}
-};
-
-//#endregion
-//#region src/errors/SandboxMaximumThresholdReachedError.ts
-var SandboxMaximumThresholdReachedError = class extends BaseError {
-	constructor({ cause }) {
-		super({
-			cause,
-			code: "sandbox_maximum_threshold_reached_error",
-			docsUrl: "https://www.dynamic.xyz/docs/developer-dashboard/sandbox-vs-live#sandbox-vs-live",
-			name: "SandboxMaximumThresholdReachedError",
-			shortMessage: "Your sandbox environment has reached the maximum MAU. Please use a live environment for production traffic."
-		});
-	}
-};
-
-//#endregion
-//#region src/modules/apiClient/utils/clientErrorMapper/clientErrorMapper.ts
-/**
-* Default error mapper for the client that handles common API error codes.
-*
-* This mapper transforms specific API error codes into more specific error types:
-* - `mfa_invalid_code` → `MfaInvalidOtpError`
-* - `mfa_rate_limited` → `MfaRateLimitedError`
-*
-* @param error - The error to be mapped
-* @returns A transformed error if the error code matches a known pattern, or null if no transformation is needed
-*
-* @example
-* ```typescript
-* // This will be automatically applied to all API errors
-* const apiClient = createApiClient({}, client);
-*
-* // The clientErrorMapper will automatically convert mfa_invalid_code errors
-* // to MfaInvalidOtpError instances
-* ```
-* @notInstrumented
-*/
-const clientErrorMapper = (error) => {
-	if (error instanceof APIError) {
-		if (error.code === "mfa_invalid_code") return new MfaInvalidOtpError({ cause: error });
-		if (error.code === "mfa_rate_limited") return new MfaRateLimitedError({ cause: error });
-		if (error.code === "invalid_external_auth") return new InvalidExternalAuthError({ cause: error });
-		if (error.code === "sandbox_maximum_threshold_reached") return new SandboxMaximumThresholdReachedError({ cause: error });
-		if (error.code === "merge_accounts_invalid" || error.code === "reassign_wallet_error") return new LinkCredentialError({ cause: error });
-	}
-	return null;
-};
-
-//#endregion
-//#region src/modules/apiClient/utils/convertToApiErrorMiddleware/convertToApiErrorMiddleware.ts
-/**
-* Creates middleware that converts HTTP error responses to APIError instances
-* and optionally applies custom error mappers to transform them into specific error types.
-*
-* @param options.errorMappers - Array of error mappers to apply to API errors
-* @returns A middleware function that handles error conversion and mapping
-* @notInstrumented
-*/
-const createConvertToApiErrorMiddleware = ({ errorMappers = [] }) => ({ post: async (context) => {
-	if (context.response.status >= 400) {
-		const apiError = await APIError.fromResponse(context.response);
-		if (apiError) {
-			let errorToThrow = apiError;
-			for (const mapper of errorMappers) {
-				const newError = mapper(apiError);
-				if (newError) {
-					errorToThrow = newError;
-					break;
-				}
-			}
-			throw errorToThrow;
-		}
-	}
-	return context.response;
-} });
-
-//#endregion
-//#region src/utils/getNonce/getNonce.ts
-/**
-* Returns a nonce for wallet ownership verification.
-*
-* Pops the first nonce from the prefetched pool. When the pool is running low
-* (≤1 remaining after pop) a background refetch is triggered. If the pool is
-* empty, nonces are fetched on-demand before returning.
-* @notInstrumented
-*/
-const getNonce = async (client) => {
-	const core = getCore(client);
-	const pool = core.state.get().prefetchedNonces;
-	if (pool.length > 0) {
-		const [nonce, ...remaining] = pool;
-		core.state.set({ prefetchedNonces: remaining });
-		if (remaining.length <= 1) fetchAndStoreNonces(client);
-		return nonce;
-	}
-	await fetchAndStoreNonces(client);
-	return getNonce(client);
-};
-
-//#endregion
-//#region src/modules/deviceRegistration/getDeviceSigner/getDeviceSigner.ts
-/** @notInstrumented */
-const getDeviceSigner = async (client) => {
-	const { deviceSigner, keychain } = getCore(client);
-	/**
-	* If the device signer is available, it should handle the device signing.
-	* This is used for mobile devices with secure enclave.
-	*/
-	if (deviceSigner) return deviceSigner;
-	const keyName = "device";
-	if (!await keychain.getPublicKey(keyName)) await keychain.generateKey(keyName);
-	return {
-		getPublicKey: () => keychain.getPublicKey(keyName),
-		sign: (payload) => keychain.sign(keyName, payload)
+		getPublicKey: () => keychain.getPublicKey(keyName),
+		sign: (payload) => keychain.sign(keyName, payload)
 	};
 };
 
@@ -1010,7 +557,7 @@ const createApiClient = (options = {}, client) => {
 	if (client.projectSettings && isCookieEnabled(client)) settings.credentials = "include";
 	if (options.includeMfaToken && coreState.mfaToken) settings.headers[MFA_TOKEN_HEADER] = coreState.mfaToken;
 	if (options.elevatedAccessTokenScope) {
-		const elevatedToken = __getElevatedAccessToken_wrapped({ scope: options.elevatedAccessTokenScope }, client);
+		const elevatedToken = getElevatedAccessToken({ scope: options.elevatedAccessTokenScope }, client);
 		if (elevatedToken) settings.headers[ELEVATED_ACCESS_TOKEN_HEADER] = elevatedToken;
 	}
 	const sessionPublicKey = getSessionKeys(client)?.publicKey;
@@ -1439,187 +986,630 @@ const getWalletAccountsFromState = ({ unverifiedWalletAccounts, user }, client)
 };
 
 //#endregion
-//#region src/modules/wallets/getWalletAccounts/getWalletAccounts.ts
+//#region src/modules/wallets/getWalletAccounts/getWalletAccounts.ts
+/**
+* Retrieves all wallet accounts associated with the current session.
+*
+* This function returns both verified and unverified wallet accounts,
+* combining data from user credentials and local unverified accounts.
+* You can differentiate between verified and unverified wallet accounts by
+* checking the `verifiedCredentialId` property.
+*
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns An array of wallet accounts associated with the session.
+* @notInstrumented
+* @hook Exposed as a hook so consumers get the reactive list of wallet accounts.
+*/
+const getWalletAccounts = (client = getDefaultClient()) => {
+	const { unverifiedWalletAccounts, user } = getCore(client).state.get();
+	return getWalletAccountsFromState({
+		unverifiedWalletAccounts,
+		user
+	}, client);
+};
+
+//#endregion
+//#region src/errors/NoWalletProviderFoundError.ts
+var NoWalletProviderFoundError = class extends BaseError {
+	constructor({ walletProviderKey }) {
+		super({
+			cause: null,
+			code: "no_wallet_provider_found_error",
+			docsUrl: null,
+			name: "NoWalletProviderFoundError",
+			shortMessage: `No wallet provider found with key: ${walletProviderKey}`
+		});
+	}
+};
+
+//#endregion
+//#region src/services/runtimeServices/createRuntimeServiceAccessKey/createRuntimeServiceAccessKey.ts
+/**
+* Creates a service accessor function that manages service instantiation and caching.
+* The returned function will either retrieve an existing service from the registry or
+* create a new one using the provided builder function.
+*
+* @template - The type of service to be created/accessed
+* @param key - Unique identifier for the service in the registry
+* @param builder - Function that creates the service instance when called with a DynamicClient
+* @notInstrumented
+*/
+const createRuntimeServiceAccessKey = (key, builder) => (client) => {
+	const { runtimeServices } = getCore(client);
+	const currentService = runtimeServices.getByKey(key);
+	if (currentService) return currentService;
+	const service = builder(client);
+	runtimeServices.register(key, service);
+	return service;
+};
+
+//#endregion
+//#region src/modules/wallets/walletProviderRegistry/createWalletProviderRegistry/createWalletProviderRegistry.ts
+/**
+* Creates a new wallet provider registry that manages wallet providers with priority-based registration.
+*
+* @returns The wallet provider registry instance
+*
+* @example
+* ```typescript
+* const registry = createWalletProviderRegistry();
+*
+* registry.register({
+*   priority: WalletProviderPriority.WALLET_SDK,
+*   walletProvider: myWalletProvider
+* });
+*
+* const provider = registry.getByKey('my-wallet-key');
+* const providers = registry.listProviders();
+* ```
+* @notInstrumented
+*/
+const createWalletProviderRegistry = (client) => {
+	const registry = /* @__PURE__ */ new Map();
+	return {
+		getByKey: (key) => registry.get(key)?.walletProvider,
+		listProviderEntries: () => Array.from(registry.values()),
+		listProviders: () => Array.from(registry.values()).map((v) => v.walletProvider),
+		register: (args) => {
+			const existingEntry = registry.get(args.walletProvider.key);
+			if (existingEntry) {
+				if (existingEntry.priority < args.priority) {
+					registry.set(args.walletProvider.key, args);
+					emitEvent({
+						args: { walletProviderKey: args.walletProvider.key },
+						event: "walletProviderChanged"
+					}, client);
+				}
+			} else {
+				registry.set(args.walletProvider.key, args);
+				emitEvent({
+					args: { walletProvider: args.walletProvider },
+					event: "walletProviderRegistered"
+				}, client);
+				emitEvent({
+					args: { walletProviderKey: args.walletProvider.key },
+					event: "walletProviderChanged"
+				}, client);
+			}
+		},
+		unregister: (key) => {
+			registry.delete(key);
+			emitEvent({
+				args: { walletProviderKey: key },
+				event: "walletProviderUnregistered"
+			}, client);
+		}
+	};
+};
+
+//#endregion
+//#region src/modules/wallets/walletProviderRegistry/getWalletProviderRegistry/getWalletProviderRegistry.ts
+/**
+* This function provides access to a shared instance of the wallet provider registry.
+*
+* It ensures that the same registry instance is used throughout the client to maintaining
+* consistency of registered wallet providers across different parts of the codebase.
+*
+* @returns The wallet provider registry instance
+*
+* @example
+* ```typescript
+* // Get the registry instance
+* const registry = getWalletProviderRegistry();
+*
+* // Register a wallet provider
+* registry.register({
+*   priority: WalletProviderPriority.WALLET_SDK,
+*   walletProvider: myWalletProvider
+* });
+*
+* // Retrieve a specific provider
+* const provider = registry.getByKey('metamaskevm');
+* ```
+*/
+const getWalletProviderRegistry = createRuntimeServiceAccessKey("walletProviderRegistry", (client) => createWalletProviderRegistry(client));
+
+//#endregion
+//#region src/modules/wallets/walletProviderRegistry/walletProviderRegistry.types.ts
+let WalletProviderPriority = /* @__PURE__ */ function(WalletProviderPriority$1) {
+	/**
+	* Highest priority should be used by wallet providers that implement
+	* the most reliable wallet integration.
+	* example: The SDK provided by the wallet provider.
+	*/
+	WalletProviderPriority$1[WalletProviderPriority$1["WALLET_SDK"] = 100] = "WALLET_SDK";
+	/**
+	* Medium priority should be used by wallet providers that implement
+	* a wallet integration via some reliable standard.
+	* example: A wallet provider that uses EIP6963 announcement.
+	*/
+	WalletProviderPriority$1[WalletProviderPriority$1["WALLET_SELF_ANNOUNCEMENT_STANDARD"] = 50] = "WALLET_SELF_ANNOUNCEMENT_STANDARD";
+	/**
+	* Low priority should be used by wallet providers that implement
+	* a wallet integration on a less reliable standard.
+	* example: A wallet provider that uses window.ethereum, where the
+	* window key can be overridden by other extensions.
+	*/
+	WalletProviderPriority$1[WalletProviderPriority$1["WINDOW_INJECT"] = 20] = "WINDOW_INJECT";
+	return WalletProviderPriority$1;
+}({});
+
+//#endregion
+//#region src/modules/wallets/utils/getWalletProviderFromWalletAccount/getWalletProviderFromWalletAccount.ts
+/** @notInstrumented */
+const getWalletProviderFromWalletAccount = ({ walletAccount }, client) => {
+	const walletProvider = getWalletProviderRegistry(client).getByKey(walletAccount.walletProviderKey);
+	if (!walletProvider) throw new NoWalletProviderFoundError({ walletProviderKey: walletAccount.walletProviderKey });
+	return walletProvider;
+};
+
+//#endregion
+//#region src/modules/auth/consts.ts
+const DYNAMIC_AUTH_COOKIE_NAME = "DYNAMIC_JWT_TOKEN";
+
+//#endregion
+//#region src/modules/auth/extractSessionId/extractSessionId.ts
+/**
+* Extracts the session ID (`sid` claim) from a JWT token string.
+*
+* Decodes the base64url-encoded payload segment of the token and reads the
+* `sid` field. This is used to correlate instrumentation events with the
+* authenticated session, without ever forwarding the full token.
+*
+* Returns `null` when no token is present, when the token is malformed, or
+* when the payload does not contain a `sid` claim.
+* @notInstrumented
+*/
+const extractSessionId = (token) => {
+	try {
+		const payload = token.split(".")[1];
+		return JSON.parse(atob(payload)).sid ?? null;
+	} catch {
+		return null;
+	}
+};
+
+//#endregion
+//#region src/utils/getOperatingSystem/getOperatingSystem.ts
+/**
+* Detects the operating system from `navigator.userAgent` for web environments.
+*
+* The React Native bundler (Metro) resolves `getOperatingSystem.native.ts`
+* instead when building for React Native, which uses `Platform.OS` directly.
+*
+* Falls back to `'unknown'` when `navigator` is unavailable (SSR, service
+* workers) or when the user-agent string doesn't match a known OS pattern.
+* @notInstrumented
+*/
+const getOperatingSystem = () => {
+	try {
+		const ua = navigator.userAgent;
+		if (/iPhone|iPad|iPod/.test(ua)) return "ios";
+		if (/Android/.test(ua)) return "android";
+		if (/Windows/.test(ua)) return "windows";
+		if (/Macintosh|Mac OS X/.test(ua)) return "macos";
+		if (/Linux/.test(ua)) return "linux";
+		return "unknown";
+	} catch {
+		return "unknown";
+	}
+};
+
+//#endregion
+//#region src/utils/getPlatform/getPlatform.ts
 /**
-* Retrieves all wallet accounts associated with the current session.
+* Returns the platform the SDK is running on.
 *
-* This function returns both verified and unverified wallet accounts,
-* combining data from user credentials and local unverified accounts.
-* You can differentiate between verified and unverified wallet accounts by
-* checking the `verifiedCredentialId` property.
+* This is the web implementation — the React Native bundler resolves
+* `getPlatform.native.ts` instead when building for React Native, which
+* returns `'react-native'`.
+* @notInstrumented
+*/
+const getPlatform = () => "web";
+
+//#endregion
+//#region src/utils/getUserAgent/getUserAgent.ts
+/**
+* Returns the browser's `navigator.userAgent` string for inclusion in
+* instrumentation events.
 *
-* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
-* @returns An array of wallet accounts associated with the session.
+* Falls back to an empty string in environments where `navigator` is not
+* available (e.g., Node.js SSR, service workers) so that callers never need
+* to guard against undefined.
 * @notInstrumented
-* @hook Exposed as a hook so consumers get the reactive list of wallet accounts.
 */
-const getWalletAccounts = (client = getDefaultClient()) => {
-	const { unverifiedWalletAccounts, user } = getCore(client).state.get();
-	return getWalletAccountsFromState({
-		unverifiedWalletAccounts,
-		user
-	}, client);
+const getUserAgent = () => {
+	try {
+		return navigator.userAgent;
+	} catch {
+		return "";
+	}
 };
 
 //#endregion
-//#region src/errors/NoWalletProviderFoundError.ts
-var NoWalletProviderFoundError = class extends BaseError {
-	constructor({ walletProviderKey }) {
-		super({
-			cause: null,
-			code: "no_wallet_provider_found_error",
-			docsUrl: null,
-			name: "NoWalletProviderFoundError",
-			shortMessage: `No wallet provider found with key: ${walletProviderKey}`
+//#region src/services/instrumentation/constants.ts
+/**
+* Default key-based PII scrubber list, lowercased and matched against the
+* lowercased object key.
+*
+* Two complementary mechanisms cover credential leakage:
+*
+* 1. Explicit keys listed here — matched exactly (case-insensitive). Use this
+*    for keys that don't end in a generic credential suffix (e.g. `mnemonic`,
+*    `seed`, `verificationCode`, `keyShare`).
+* 2. Suffix matching in {@link scrubParameters} for the credential suffixes
+*    enumerated by {@link PII_KEY_SUFFIXES} — catches any field whose name
+*    ends in `token` or `jwt` (e.g. `mfaToken`, `minifiedJwt`, `accessToken`,
+*    `idToken`, `captchaToken`, …) without needing to enumerate them here.
+*/
+const DEFAULT_PII_FIELDS = [
+	"password",
+	"token",
+	"secret",
+	"privateKey",
+	"privateJwk",
+	"mnemonic",
+	"seed",
+	"keyShare",
+	"keyShares",
+	"email",
+	"phone",
+	"ssn",
+	"address",
+	"authorization",
+	"verificationCode",
+	"recoveryCodes",
+	"codeVerifier",
+	"pkce",
+	"bearer",
+	"apiKey",
+	"alias",
+	"publicIdentifier"
+];
+/**
+* Lowercased suffixes used by {@link scrubParameters} to match credential-like
+* keys without enumerating every variant (e.g. `mfaToken`, `accessToken`,
+* `refreshToken`, `legacyToken`, `minifiedJwt`). Only suffixes that are
+* unambiguously credentials belong here — `key` (matches `publicKey`) and
+* `code` (matches `countryCode`) are too broad and must not be added.
+*/
+const PII_KEY_SUFFIXES = ["token", "jwt"];
+const REDACTED_VALUE = "[REDACTED]";
+const MAX_STRING_LENGTH = 500;
+const TRUNCATED_SUFFIX = "...[truncated]";
+/**
+* Label prefix for binary data placeholders. The full placeholder includes the
+* byte length, e.g. `[Binary:16 bytes]`, so consumers can gauge data size
+* without the actual bytes appearing in logs.
+*/
+const BINARY_LABEL = "Binary";
+/**
+* Placeholder emitted when a circular reference is detected in the value tree.
+* Using a named constant makes it easy to search for or filter in downstream
+* log tooling.
+*/
+const CIRCULAR_VALUE = "[Circular]";
+
+//#endregion
+//#region src/services/instrumentation/scrubParameters/scrubParameters.ts
+/**
+* Returns true when `key` should be redacted based on the configured PII
+* field list. A key matches when its lowercased form either equals one of
+* `piiFieldsLower` exactly, or ends in one of the curated credential
+* suffixes in {@link PII_KEY_SUFFIXES} (currently `token` and `jwt`). The
+* suffix check is what catches `mfaToken`, `minifiedJwt`, `accessToken`,
+* etc. without needing every variant enumerated explicitly.
+*/
+const keyMatchesPiiField = ({ keyLower, piiFieldsLower }) => {
+	if (piiFieldsLower.includes(keyLower)) return true;
+	return PII_KEY_SUFFIXES.some((suffix) => keyLower.endsWith(suffix));
+};
+const scrubString = ({ key, piiFieldsLower, redactAll, value }) => {
+	if (keyMatchesPiiField({
+		keyLower: key.toLowerCase(),
+		piiFieldsLower
+	})) return REDACTED_VALUE;
+	if (redactAll) return REDACTED_VALUE;
+	if (value.length > MAX_STRING_LENGTH) return value.slice(0, MAX_STRING_LENGTH) + TRUNCATED_SUFFIX;
+	return value;
+};
+const scrubArray = ({ context, value }) => {
+	if (context.visited.has(value)) return [CIRCULAR_VALUE];
+	context.visited.add(value);
+	const result = value.map((item, index) => scrubValue({
+		context,
+		key: String(index),
+		value: item
+	}));
+	context.visited.delete(value);
+	return result;
+};
+const scrubObject = ({ context, value }) => {
+	if (context.visited.has(value)) return { [CIRCULAR_VALUE]: true };
+	context.visited.add(value);
+	const result = Object.create(null);
+	for (const key of Object.keys(value)) result[key] = scrubValue({
+		context,
+		key,
+		value: value[key]
+	});
+	context.visited.delete(value);
+	return result;
+};
+const scrubValue = ({ context, key, value }) => {
+	if (value === null || value === void 0) return value;
+	if (value instanceof Uint8Array) return `[${BINARY_LABEL}:${value.byteLength} bytes]`;
+	if (keyMatchesPiiField({
+		keyLower: key.toLowerCase(),
+		piiFieldsLower: context.piiFieldsLower
+	})) return REDACTED_VALUE;
+	if (typeof value === "string") return scrubString({
+		key,
+		piiFieldsLower: context.piiFieldsLower,
+		redactAll: context.redactAll,
+		value
+	});
+	if (Array.isArray(value)) return scrubArray({
+		context,
+		value
+	});
+	if (value instanceof Set) {
+		if (context.visited.has(value)) return [CIRCULAR_VALUE];
+		context.visited.add(value);
+		const setResult = scrubArray({
+			context,
+			value: [...value]
+		});
+		context.visited.delete(value);
+		return setResult;
+	}
+	if (value instanceof Map) {
+		if (context.visited.has(value)) return { [CIRCULAR_VALUE]: true };
+		context.visited.add(value);
+		const asObject = Object.create(null);
+		for (const [k, v] of value.entries()) asObject[String(k)] = v;
+		const mapResult = scrubObject({
+			context,
+			value: asObject
 		});
+		context.visited.delete(value);
+		return mapResult;
 	}
+	if (value instanceof WeakMap) return "[WeakMap]";
+	if (value instanceof WeakSet) return "[WeakSet]";
+	if (value instanceof Date) return value.toISOString();
+	if (value instanceof Error) return `[Error: ${value.message}]`;
+	if (typeof value === "object") return scrubObject({
+		context,
+		value
+	});
+	return value;
+};
+/** @notInstrumented */
+const scrubParameters = ({ piiFields, redactAll, value }) => {
+	return scrubObject({
+		context: {
+			piiFieldsLower: piiFields.map((field) => field.toLowerCase()),
+			redactAll,
+			visited: /* @__PURE__ */ new WeakSet()
+		},
+		value
+	});
 };
 
 //#endregion
-//#region src/services/runtimeServices/createRuntimeServiceAccessKey/createRuntimeServiceAccessKey.ts
+//#region src/services/instrumentation/instrumentFunction/extractParams/extractParams.ts
 /**
-* Creates a service accessor function that manages service instantiation and caching.
-* The returned function will either retrieve an existing service from the registry or
-* create a new one using the provided builder function.
+* Normalises the raw positional arguments of an instrumented function call
+* into a flat `Record<string, unknown>` suitable for structured logging.
 *
-* @template - The type of service to be created/accessed
-* @param key - Unique identifier for the service in the registry
-* @param builder - Function that creates the service instance when called with a DynamicClient
+* ## Why this is needed
+*
+* Instrumented functions are wrapped with `(...args: unknown[])`, so their
+* parameters arrive as an array. Logging a raw array loses the semantic names
+* of each argument. This function recovers a named representation:
+*
+* - **No arguments** → `{}`
+* - **Single plain-object argument** → that object is returned as-is, because
+*   SDK functions follow the single-object-parameter convention, so the object
+*   already carries named keys (`{ amount, to }`, etc.).
+* - **Everything else** (multiple args, a single primitive, a single array) →
+*   each value is indexed as `arg0`, `arg1`, …
+*
+* ## Why arrays are NOT treated as plain objects
+*
+* `typeof [] === 'object'` and `[] !== null`, so without the `Array.isArray`
+* guard a single-array argument would be returned as-is. That would produce
+* an object with numeric string keys (`{ '0': ..., '1': ... }`), which is
+* misleading and inconsistent with how multi-arg calls are handled. Instead,
+* arrays fall through to the indexed `arg0` path.
 * @notInstrumented
 */
-const createRuntimeServiceAccessKey = (key, builder) => (client) => {
-	const { runtimeServices } = getCore(client);
-	const currentService = runtimeServices.getByKey(key);
-	if (currentService) return currentService;
-	const service = builder(client);
-	runtimeServices.register(key, service);
-	return service;
+const extractParams = (args) => {
+	if (args.length === 0) return {};
+	if (args.length === 1 && typeof args[0] === "object" && args[0] !== null && !Array.isArray(args[0])) return args[0];
+	const result = {};
+	for (let i = 0; i < args.length; i++) result[`arg${i}`] = args[i];
+	return result;
 };
 
 //#endregion
-//#region src/modules/wallets/walletProviderRegistry/createWalletProviderRegistry/createWalletProviderRegistry.ts
+//#region src/services/instrumentation/instrumentFunction/scrubResolvedValue/scrubResolvedValue.ts
 /**
-* Creates a new wallet provider registry that manages wallet providers with priority-based registration.
-*
-* @returns The wallet provider registry instance
-*
-* @example
-* ```typescript
-* const registry = createWalletProviderRegistry();
-*
-* registry.register({
-*   priority: WalletProviderPriority.WALLET_SDK,
-*   walletProvider: myWalletProvider
-* });
-*
-* const provider = registry.getByKey('my-wallet-key');
-* const providers = registry.listProviders();
-* ```
+* Scrubs a resolved return value of any type before logging it.
+* Routes through `scrubParameters` by wrapping the value so that strings,
+* arrays, Dates, Errors, and all other types are handled identically to
+* nested object fields.
 * @notInstrumented
 */
-const createWalletProviderRegistry = (client) => {
-	const registry = /* @__PURE__ */ new Map();
+const scrubResolvedValue = ({ piiFields, redactAll, value }) => scrubParameters({
+	piiFields,
+	redactAll,
+	value: { result: value }
+}).result;
+
+//#endregion
+//#region src/services/instrumentation/instrumentFunction/instrumentFunction.ts
+const serializeError = (error) => {
+	if (error instanceof Error) return {
+		message: error.message,
+		name: error.name,
+		stack: error.stack
+	};
 	return {
-		getByKey: (key) => registry.get(key)?.walletProvider,
-		listProviderEntries: () => Array.from(registry.values()),
-		listProviders: () => Array.from(registry.values()).map((v) => v.walletProvider),
-		register: (args) => {
-			const existingEntry = registry.get(args.walletProvider.key);
-			if (existingEntry) {
-				if (existingEntry.priority < args.priority) {
-					registry.set(args.walletProvider.key, args);
-					emitEvent({
-						args: { walletProviderKey: args.walletProvider.key },
-						event: "walletProviderChanged"
-					}, client);
-				}
-			} else {
-				registry.set(args.walletProvider.key, args);
-				emitEvent({
-					args: { walletProvider: args.walletProvider },
-					event: "walletProviderRegistered"
-				}, client);
-				emitEvent({
-					args: { walletProviderKey: args.walletProvider.key },
-					event: "walletProviderChanged"
-				}, client);
-			}
-		},
-		unregister: (key) => {
-			registry.delete(key);
-			emitEvent({
-				args: { walletProviderKey: key },
-				event: "walletProviderUnregistered"
-			}, client);
-		}
+		message: String(error),
+		name: "UnknownError"
 	};
 };
-
-//#endregion
-//#region src/modules/wallets/walletProviderRegistry/getWalletProviderRegistry/getWalletProviderRegistry.ts
 /**
-* This function provides access to a shared instance of the wallet provider registry.
+* Wraps a function so that each invocation emits a structured
+* `FunctionInstrumentationEvent` at three lifecycle points:
 *
-* It ensures that the same registry instance is used throughout the client to maintaining
-* consistency of registered wallet providers across different parts of the codebase.
+* - **started** — immediately before the function body executes, with the
+*   PII-scrubbed call parameters.
+* - **resolved** — after the function (or its returned Promise) settles
+*   successfully, with the PII-scrubbed return value.
+* - **rejected** — if the function throws synchronously or its returned
+*   Promise rejects.
 *
-* @returns The wallet provider registry instance
+* The original return value (or thrown error) is always forwarded to the
+* caller unchanged — instrumentation is purely observational.
 *
-* @example
-* ```typescript
-* // Get the registry instance
-* const registry = getWalletProviderRegistry();
+* ## Usage
 *
-* // Register a wallet provider
-* registry.register({
-*   priority: WalletProviderPriority.WALLET_SDK,
-*   walletProvider: myWalletProvider
+* ```ts
+* const transfer = instrumentFunction({
+*   fn: rawTransfer,
+*   functionName: 'transfer',
+*   getCore: () => core,
 * });
 *
-* // Retrieve a specific provider
-* const provider = registry.getByKey('metamaskevm');
+* // When called, three events are emitted automatically:
+* await transfer({ amount: 1, to: '0xabc' });
 * ```
+*
+* ## How functions are wrapped
+*
+* `instrumentFunction` is not called manually in application code. Instead,
+* the esbuild instrumentation plugin (`tools/instrumentation-plugin`) injects
+* it at build time: any exported function annotated with `@instrumented` in its
+* JSDoc is automatically wrapped by the plugin during the build step.
+* The plugin strips the original `export`, renames the function, and re-exports
+* it under the original name via `instrumentFunction(...)` — so the public API
+* is unchanged and no call sites need to be updated.
+*
+* ## Opting out
+*
+* Instrumentation is skipped entirely when:
+* - `getCore()` returns `undefined` (SDK not initialised), or
+* - `core.instrumentation.config.enabled` is `false`.
+*
+* In both cases the original function is called directly with no overhead.
+*
+* ## PII scrubbing
+*
+* All string values whose key appears in `piiFields` are replaced with
+* `"[redacted]"` before events are emitted. Pass `redactAll: true` to redact
+* every field, regardless of key name.
+* @notInstrumented
 */
-const getWalletProviderRegistry = createRuntimeServiceAccessKey("walletProviderRegistry", (client) => createWalletProviderRegistry(client));
-
-//#endregion
-//#region src/modules/wallets/walletProviderRegistry/walletProviderRegistry.types.ts
-let WalletProviderPriority = /* @__PURE__ */ function(WalletProviderPriority$1) {
-	/**
-	* Highest priority should be used by wallet providers that implement
-	* the most reliable wallet integration.
-	* example: The SDK provided by the wallet provider.
-	*/
-	WalletProviderPriority$1[WalletProviderPriority$1["WALLET_SDK"] = 100] = "WALLET_SDK";
-	/**
-	* Medium priority should be used by wallet providers that implement
-	* a wallet integration via some reliable standard.
-	* example: A wallet provider that uses EIP6963 announcement.
-	*/
-	WalletProviderPriority$1[WalletProviderPriority$1["WALLET_SELF_ANNOUNCEMENT_STANDARD"] = 50] = "WALLET_SELF_ANNOUNCEMENT_STANDARD";
-	/**
-	* Low priority should be used by wallet providers that implement
-	* a wallet integration on a less reliable standard.
-	* example: A wallet provider that uses window.ethereum, where the
-	* window key can be overridden by other extensions.
-	*/
-	WalletProviderPriority$1[WalletProviderPriority$1["WINDOW_INJECT"] = 20] = "WINDOW_INJECT";
-	return WalletProviderPriority$1;
-}({});
-
-//#endregion
-//#region src/modules/wallets/utils/getWalletProviderFromWalletAccount/getWalletProviderFromWalletAccount.ts
-/** @notInstrumented */
-const getWalletProviderFromWalletAccount = ({ walletAccount }, client) => {
-	const walletProvider = getWalletProviderRegistry(client).getByKey(walletAccount.walletProviderKey);
-	if (!walletProvider) throw new NoWalletProviderFoundError({ walletProviderKey: walletAccount.walletProviderKey });
-	return walletProvider;
+const instrumentFunction = ({ fn, functionName, getCore: getCore$1, redactAll }) => {
+	const wrapped = (...args) => {
+		const core = getCore$1();
+		if (!core) return fn(...args);
+		if (!core.instrumentation.config.enabled) return fn(...args);
+		const instrumentation = core.instrumentation;
+		const state = core.state.get();
+		const baseEvent = {
+			environmentId: core.environmentId,
+			functionName,
+			operatingSystem: getOperatingSystem(),
+			parameters: scrubParameters({
+				piiFields: instrumentation.config.piiFields,
+				redactAll,
+				value: extractParams(args)
+			}),
+			platform: getPlatform(),
+			registeredExtensionKeys: Array.from(core.extensions),
+			sdkSessionId: core.sdkSessionId,
+			sdkVersion: core.version,
+			status: "info",
+			tokenSessionId: state.token ? extractSessionId(state.token) : null,
+			userAgent: getUserAgent(),
+			userId: state.user?.id ?? null
+		};
+		instrumentation.logFunction({
+			...baseEvent,
+			phase: "started",
+			timestamp: (/* @__PURE__ */ new Date()).toISOString()
+		});
+		try {
+			const result = fn(...args);
+			if (result instanceof Promise) return result.then((value) => {
+				instrumentation.logFunction({
+					...baseEvent,
+					phase: "resolved",
+					resolvedValue: scrubResolvedValue({
+						piiFields: instrumentation.config.piiFields,
+						redactAll,
+						value
+					}),
+					timestamp: (/* @__PURE__ */ new Date()).toISOString()
+				});
+				return value;
+			}).catch((error) => {
+				instrumentation.logFunction({
+					...baseEvent,
+					phase: "rejected",
+					rejectedError: serializeError(error),
+					timestamp: (/* @__PURE__ */ new Date()).toISOString()
+				});
+				throw error;
+			});
+			instrumentation.logFunction({
+				...baseEvent,
+				phase: "resolved",
+				resolvedValue: scrubResolvedValue({
+					piiFields: instrumentation.config.piiFields,
+					redactAll,
+					value: result
+				}),
+				timestamp: (/* @__PURE__ */ new Date()).toISOString()
+			});
+			return result;
+		} catch (error) {
+			instrumentation.logFunction({
+				...baseEvent,
+				phase: "rejected",
+				rejectedError: serializeError(error),
+				timestamp: (/* @__PURE__ */ new Date()).toISOString()
+			});
+			throw error;
+		}
+	};
+	return wrapped;
 };
 
-//#endregion
-//#region src/modules/auth/consts.ts
-const DYNAMIC_AUTH_COOKIE_NAME = "DYNAMIC_JWT_TOKEN";
-
 //#endregion
 //#region src/constants.ts
 const SDK_API_CORE_VERSION = dependencies["@dynamic-labs/sdk-api-core"];
@@ -1825,12 +1815,6 @@ Object.defineProperty(exports, 'WalletProviderPriority', {
     return WalletProviderPriority;
   }
 });
-Object.defineProperty(exports, '__getElevatedAccessToken_wrapped', {
-  enumerable: true,
-  get: function () {
-    return __getElevatedAccessToken_wrapped;
-  }
-});
 Object.defineProperty(exports, 'assertDefined', {
   enumerable: true,
   get: function () {
@@ -1909,6 +1893,12 @@ Object.defineProperty(exports, 'getDeviceSigner', {
     return getDeviceSigner;
   }
 });
+Object.defineProperty(exports, 'getElevatedAccessToken', {
+  enumerable: true,
+  get: function () {
+    return getElevatedAccessToken;
+  }
+});
 Object.defineProperty(exports, 'getHeadersForNonceSignedByDeviceSigners', {
   enumerable: true,
   get: function () {
@@ -2065,4 +2055,4 @@ Object.defineProperty(exports, 'version', {
     return version;
   }
 });
-//# sourceMappingURL=InvalidParamError-C7c-OLz1.cjs.map
+//# sourceMappingURL=InvalidParamError-BPY2yug_.cjs.map