@dynamic-labs-sdk/client 1.17.0 → 1.18.0

package/dist/index.cjs

@@ -1,9 +1,9 @@
-const require_isMfaRequiredForAction = require('./isMfaRequiredForAction-CaNdGc-m.cjs');
-const require_updateAuthFromVerifyResponse = require('./updateAuthFromVerifyResponse-CUnvs5Af.cjs');
-const require_getNetworkProviderFromNetworkId = require('./getNetworkProviderFromNetworkId-DzzocxRc.cjs');
-const require_isDynamicWaasEnabled = require('./isDynamicWaasEnabled-BEn7FcD9.cjs');
-const require_isUserOnboardingComplete = require('./isUserOnboardingComplete-w1IkCC_p.cjs');
-const require_getWalletProviderByKey = require('./getWalletProviderByKey-BLWcueTR.cjs');
+const require_isMfaRequiredForAction = require('./isMfaRequiredForAction-Dghiguch.cjs');
+const require_updateAuthFromVerifyResponse = require('./updateAuthFromVerifyResponse-Deg9em9o.cjs');
+const require_getNetworkProviderFromNetworkId = require('./getNetworkProviderFromNetworkId-CMIgKqEH.cjs');
+const require_isDynamicWaasEnabled = require('./isDynamicWaasEnabled-BQuXZne_.cjs');
+const require_isUserOnboardingComplete = require('./isUserOnboardingComplete-j4b_q9Pf.cjs');
+const require_getWalletProviderByKey = require('./getWalletProviderByKey-D3e0XMjs.cjs');
 let _dynamic_labs_sdk_assert_package_version = require("@dynamic-labs-sdk/assert-package-version");
 let _dynamic_labs_sdk_api_core = require("@dynamic-labs/sdk-api-core");
 let zod_mini = require("zod/mini");
@@ -751,10 +751,67 @@ const createDynamicTransport = (params) => {
 const createNavigationHandler = () => {
 	if (require_getNetworkProviderFromNetworkId.isServerSideRendering()) return () => Promise.reject(new UnavailableInServerSideError("createNavigationHandler"));
 	return async (url) => {
+		require_getNetworkProviderFromNetworkId.assertSafeNavigationUrl(url);
 		window.location.href = url;
 	};
 };
 
+//#endregion
+//#region src/errors/UnsafeDeeplinkUrlError.ts
+/**
+* Thrown when a deeplink is opened with a URL whose scheme can execute script
+* in the current origin (`javascript:`, `data:`, `vbscript:`). Unlike
+* navigation, deeplinks legitimately use custom app schemes (e.g. `phantom:`,
+* `metamask:`), so this guards via a denylist of dangerous schemes rather than
+* an `http(s)` allowlist, preventing DOM XSS through the `window.location.assign`
+* sink while leaving valid wallet deeplinks untouched.
+*/
+var UnsafeDeeplinkUrlError = class extends require_updateAuthFromVerifyResponse.BaseError {
+	constructor({ scheme }) {
+		super({
+			cause: null,
+			code: "unsafe_deeplink_url_error",
+			docsUrl: null,
+			name: "UnsafeDeeplinkUrlError",
+			shortMessage: `Refusing to open a deeplink with an unsafe scheme "${scheme}". Script-executing schemes (javascript:, data:, vbscript:) are not allowed. This may indicate a compromised or misconfigured deeplink URL.`
+		});
+	}
+};
+
+//#endregion
+//#region src/utils/assertSafeDeeplinkUrl/assertSafeDeeplinkUrl.ts
+/**
+* Schemes that can execute script in the current origin and must never reach a
+* deeplink navigation sink. Deeplinks legitimately use arbitrary custom app
+* schemes (e.g. `phantom:`, `metamask:`), so a denylist of dangerous schemes is
+* used here instead of the `http(s)` allowlist applied to standard navigation.
+*/
+const DANGEROUS_DEEPLINK_SCHEMES = new Set([
+	"javascript:",
+	"data:",
+	"vbscript:",
+	"blob:"
+]);
+/**
+* Asserts that the given deeplink URL is safe to open, i.e. its scheme is not
+* one that can execute script (`javascript:`, `data:`, `vbscript:`, `blob:`). Used as a
+* defense-in-depth guard on the `window.location.assign` deeplink sink to
+* prevent DOM XSS, while still permitting custom wallet app schemes.
+*
+* @param url - The deeplink URL string to validate.
+* @throws {UnsafeDeeplinkUrlError} If the URL cannot be parsed or its scheme can execute script.
+* @notInstrumented
+*/
+const assertSafeDeeplinkUrl = (url) => {
+	let parsed;
+	try {
+		parsed = new URL(url);
+	} catch {
+		throw new UnsafeDeeplinkUrlError({ scheme: "unknown" });
+	}
+	if (DANGEROUS_DEEPLINK_SCHEMES.has(parsed.protocol)) throw new UnsafeDeeplinkUrlError({ scheme: parsed.protocol });
+};
+
 //#endregion
 //#region src/services/openDeeplink/createWebDeeplinkOpener/createWebDeeplinkOpener.ts
 /**
@@ -774,6 +831,7 @@ const createNavigationHandler = () => {
 const createWebDeeplinkOpener = () => {
 	if (require_getNetworkProviderFromNetworkId.isServerSideRendering()) return () => Promise.reject(new UnavailableInServerSideError("createWebDeeplinkOpener"));
 	return async (url) => {
+		assertSafeDeeplinkUrl(url);
 		window.location.assign(url);
 	};
 };
@@ -1130,6 +1188,21 @@ var DeeplinkConnectAndVerifyUnsupportedError = class extends require_updateAuthF
 	}
 };
 
+//#endregion
+//#region src/errors/DeviceRegistrationIdentityMismatchError.ts
+var DeviceRegistrationIdentityMismatchError = class extends require_updateAuthFromVerifyResponse.BaseError {
+	constructor() {
+		super({
+			cause: null,
+			code: "device_registration_identity_mismatch_error",
+			docsUrl: null,
+			metaMessages: ["The device registration token resolved to a different user than the one currently authenticated.", "This can indicate a login-CSRF / session-fixation attempt, so the returned session was rejected and the current session was left untouched."],
+			name: "DeviceRegistrationIdentityMismatchError",
+			shortMessage: "Device registration completion was rejected because it would have replaced the current session with a different identity."
+		});
+	}
+};
+
 //#endregion
 //#region src/errors/FeeEstimationFailedError.ts
 var FeeEstimationFailedError = class extends require_updateAuthFromVerifyResponse.BaseError {
@@ -1577,7 +1650,6 @@ const __checkStepUpAuth_wrapped = require_updateAuthFromVerifyResponse.instrumen
 * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
 * @returns A promise that resolves to the assertion response containing the elevated access token.
 * @instrumented
-* @redact-params
 */
 const requestExternalAuthElevatedToken = async ({ externalJwt }, client = require_updateAuthFromVerifyResponse.getDefaultClient()) => {
 	const core = require_updateAuthFromVerifyResponse.getCore(client);
@@ -1605,8 +1677,7 @@ const __requestExternalAuthElevatedToken_wrapped = require_updateAuthFromVerifyR
 		} catch {
 			return;
 		}
-	},
-	redactAll: true
+	}
 });
 
 //#endregion
@@ -1621,7 +1692,6 @@ const __requestExternalAuthElevatedToken_wrapped = require_updateAuthFromVerifyR
 * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
 * @returns A promise that resolves to the authentication response from the server.
 * @instrumented
-* @redact-params
 */
 const signInWithExternalJwt = async ({ externalJwt, sessionPublicKey } = {}, client = require_updateAuthFromVerifyResponse.getDefaultClient()) => {
 	const core = require_updateAuthFromVerifyResponse.getCore(client);
@@ -1645,8 +1715,7 @@ const __signInWithExternalJwt_wrapped = require_updateAuthFromVerifyResponse.ins
 		} catch {
 			return;
 		}
-	},
-	redactAll: true
+	}
 });
 
 //#endregion
@@ -1758,7 +1827,6 @@ const serverRegisterPasskey = async ({ registration, createMfaToken }, client) =
 * @returns A promise that resolves to the registration response.
 * @throws NoWebAuthNSupportError If WebAuthn is not supported by the browser.
 * @instrumented
-* @redact-params
 */
 const registerPasskey = async ({ createMfaToken } = {}, client = require_updateAuthFromVerifyResponse.getDefaultClient()) => {
 	const core = require_updateAuthFromVerifyResponse.getCore(client);
@@ -1781,8 +1849,7 @@ const __registerPasskey_wrapped = require_updateAuthFromVerifyResponse.instrumen
 		} catch {
 			return;
 		}
-	},
-	redactAll: true
+	}
 });
 
 //#endregion
@@ -1827,7 +1894,6 @@ const serverSigninPasskey = async ({ authentication, createMfaToken }, client) =
 * @returns A promise that resolves to the authentication response.
 * @throws NoWebAuthNSupportError If WebAuthn is not supported by the browser.
 * @instrumented
-* @redact-params
 */
 const signInWithPasskey = async ({ relatedOriginRpId } = {}, client = require_updateAuthFromVerifyResponse.getDefaultClient()) => {
 	const core = require_updateAuthFromVerifyResponse.getCore(client);
@@ -1847,8 +1913,7 @@ const __signInWithPasskey_wrapped = require_updateAuthFromVerifyResponse.instrum
 		} catch {
 			return;
 		}
-	},
-	redactAll: true
+	}
 });
 
 //#endregion
@@ -1952,22 +2017,29 @@ const addOAuthUrlParams = ({ baseUrl, isGoogleDriveBackupEnabled, provider }) =>
 
 //#endregion
 //#region src/modules/auth/social/oauth/signInWithSocialRedirect/buildOAuthUrl/getOAuthBaseUrl/getOAuthBaseUrl.ts
-/** Helper function to build the OAuth base URL for a given provider.  * @notInstrumented
+/**
+* Resolves the raw base URL string for a provider before parsing/validation.
 */
-const getOAuthBaseUrl = (provider) => {
+const resolveBaseUrl = (provider) => {
 	require_updateAuthFromVerifyResponse.assertDefined(provider.provider, "Provider type not found");
 	const providerType = provider.provider;
 	if (providerType === _dynamic_labs_sdk_api_core.ProviderEnum.Telegram) {
 		require_updateAuthFromVerifyResponse.assertDefined(provider.authorizationUrl, "Telegram authorization URL not found");
-		return new URL(provider.authorizationUrl);
+		return provider.authorizationUrl;
 	}
 	require_updateAuthFromVerifyResponse.assertDefined(provider.baseAuthUrl, "Base auth URL not found");
 	if (providerType === _dynamic_labs_sdk_api_core.ProviderEnum.Shopify) {
 		require_updateAuthFromVerifyResponse.assertDefined(provider.shopifyStore, "Shopify store value not found in provider");
-		const loginBaseUrl = provider.baseAuthUrl.replace("{{shopifyStore}}", provider.shopifyStore);
-		return new URL(loginBaseUrl);
+		return provider.baseAuthUrl.replace("{{shopifyStore}}", provider.shopifyStore);
 	}
-	return new URL(provider.baseAuthUrl);
+	return provider.baseAuthUrl;
+};
+/** Helper function to build the OAuth base URL for a given provider.  * @notInstrumented
+*/
+const getOAuthBaseUrl = (provider) => {
+	const urlString = resolveBaseUrl(provider);
+	require_getNetworkProviderFromNetworkId.assertSafeNavigationUrl(urlString);
+	return new URL(urlString);
 };
 
 //#endregion
@@ -2302,7 +2374,6 @@ const getPrimaryWalletAccount = (client = require_updateAuthFromVerifyResponse.g
 * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
 * @returns A promise that resolves to the verify response.
 * @instrumented
-* @redact-params
 */
 const unlinkSocialAccount = async ({ verifiedCredentialId }, client = require_updateAuthFromVerifyResponse.getDefaultClient()) => {
 	const core = require_updateAuthFromVerifyResponse.getCore(client);
@@ -2330,8 +2401,7 @@ const __unlinkSocialAccount_wrapped = require_updateAuthFromVerifyResponse.instr
 		} catch {
 			return;
 		}
-	},
-	redactAll: true
+	}
 });
 
 //#endregion
@@ -2423,6 +2493,32 @@ const getMultichainTokenBalances = async ({ balanceRequest }, client = require_u
 */
 const getMultichainBalances = (params, client = require_updateAuthFromVerifyResponse.getDefaultClient()) => getMultichainTokenBalances(params, client);
 
+//#endregion
+//#region src/modules/captcha/getCaptchaSettings/getCaptchaSettings.ts
+/**
+* Returns the active captcha provider and site key, or undefined if captcha is not enabled.
+* Use this to determine which captcha widget to render and which site key to pass it.
+*
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @notInstrumented
+*/
+const getCaptchaSettings = (client = require_updateAuthFromVerifyResponse.getDefaultClient()) => {
+	const projectSettings = client.projectSettings;
+	if (!projectSettings) return void 0;
+	const { security } = projectSettings;
+	if (security.captcha) {
+		if (security.captcha.enabled) return {
+			provider: security.captcha.provider ?? _dynamic_labs_sdk_api_core.CaptchaProviderEnum.Hcaptcha,
+			siteKey: security.captcha.siteKey
+		};
+		return;
+	}
+	if (security.hCaptcha?.enabled) return {
+		provider: _dynamic_labs_sdk_api_core.CaptchaProviderEnum.Hcaptcha,
+		siteKey: security.hCaptcha.siteKey
+	};
+};
+
 //#endregion
 //#region src/modules/checkout/utils/createCheckoutSessionTokenStorageKey/createCheckoutSessionTokenStorageKey.ts
 /** @notInstrumented */
@@ -2989,7 +3085,9 @@ const DEVICE_REGISTRATION_TOKEN_HEADER = "x-dynamic-device-registration-token";
 const completeDeviceRegistration = async ({ deviceToken }, client = require_updateAuthFromVerifyResponse.getDefaultClient()) => {
 	require_updateAuthFromVerifyResponse.assertDefined(deviceToken, "deviceToken is required");
 	const core = require_updateAuthFromVerifyResponse.getCore(client);
+	const currentUser = core.state.get().user;
 	const response = await require_updateAuthFromVerifyResponse.createApiClient({ headers: { [DEVICE_REGISTRATION_TOKEN_HEADER]: deviceToken } }, client).deviceRegistration({ environmentId: core.environmentId });
+	if (currentUser && response.user?.id !== currentUser.id) throw new DeviceRegistrationIdentityMismatchError();
 	require_updateAuthFromVerifyResponse.updateAuthFromVerifyResponse({ response }, client);
 	require_updateAuthFromVerifyResponse.emitEvent({ event: "deviceRegistrationCompleted" }, client);
 	return response;
@@ -3170,6 +3268,22 @@ const withFlowSessionTokenCleanupOn401 = async ({ call, flowId }, client) => {
 	}
 };
 
+//#endregion
+//#region src/modules/flow/attachFlowSource/attachFlowSource.instrumentation.ts
+/**
+* Explicit instrumentation payload for attachFlowSource. Reads the nested
+* `flow` and logs non-sensitive volume and routing dimensions only — never the
+* wallet address, and never the response's session token.
+*/
+const attachFlowSourceInstrumentation = { resolved: ({ flow }) => ({
+	amount: flow.amount ?? null,
+	currency: flow.currency ?? null,
+	fromChainId: flow.fromChainId ?? null,
+	fromChainName: flow.fromChainName ?? null,
+	mode: flow.mode ?? null,
+	sourceType: flow.sourceType ?? null
+}) };
+
 //#endregion
 //#region src/modules/flow/attachFlowSource/attachFlowSource.ts
 /**
@@ -3199,11 +3313,13 @@ const attachFlowSource = async (params, client = require_updateAuthFromVerifyRes
 		flowAttachSourceRequest.fromChainId = params.fromChainId;
 		flowAttachSourceRequest.fromChainName = params.fromChainName;
 	}
+	const existingToken = await core.storage.getItem(createFlowSessionTokenStorageKey(flowId));
 	const result = await withFlowSessionTokenCleanupOn401({
 		call: () => apiClient.attachFlowSource({
 			environmentId: core.environmentId,
 			flowAttachSourceRequest,
-			flowId
+			flowId,
+			xDynamicFlowSessionToken: existingToken ?? void 0
 		}),
 		flowId
 	}, client);
@@ -3220,7 +3336,8 @@ const __attachFlowSource_wrapped = require_updateAuthFromVerifyResponse.instrume
 		} catch {
 			return;
 		}
-	}
+	},
+	selectors: attachFlowSourceInstrumentation
 });
 
 //#endregion
@@ -3238,6 +3355,22 @@ const createFlowApiClient = async ({ flowId }, client) => {
 	};
 };
 
+//#endregion
+//#region src/modules/flow/broadcastFlow/broadcastFlow.instrumentation.ts
+/**
+* Explicit instrumentation payload for broadcastFlow. Logs non-sensitive
+* volume and routing dimensions only — never the wallet address or any
+* session token — so we can understand volume moved through the flow product.
+*/
+const broadcastFlowInstrumentation = { resolved: (flow) => ({
+	amount: flow.amount ?? null,
+	currency: flow.currency ?? null,
+	fromChainId: flow.fromChainId ?? null,
+	fromChainName: flow.fromChainName ?? null,
+	mode: flow.mode ?? null,
+	sourceType: flow.sourceType ?? null
+}) };
+
 //#endregion
 //#region src/modules/flow/broadcastFlow/broadcastFlow.ts
 /**
@@ -3274,9 +3407,25 @@ const __broadcastFlow_wrapped = require_updateAuthFromVerifyResponse.instrumentF
 		} catch {
 			return;
 		}
-	}
+	},
+	selectors: broadcastFlowInstrumentation
 });
 
+//#endregion
+//#region src/modules/flow/cancelFlow/cancelFlow.instrumentation.ts
+/**
+* Explicit instrumentation payload for cancelFlow. Logs non-sensitive volume
+* and routing dimensions only — never the wallet address or any session token.
+*/
+const cancelFlowInstrumentation = { resolved: (flow) => ({
+	amount: flow.amount ?? null,
+	currency: flow.currency ?? null,
+	fromChainId: flow.fromChainId ?? null,
+	fromChainName: flow.fromChainName ?? null,
+	mode: flow.mode ?? null,
+	sourceType: flow.sourceType ?? null
+}) };
+
 //#endregion
 //#region src/modules/flow/cancelFlow/cancelFlow.ts
 /**
@@ -3310,7 +3459,8 @@ const __cancelFlow_wrapped = require_updateAuthFromVerifyResponse.instrumentFunc
 		} catch {
 			return;
 		}
-	}
+	},
+	selectors: cancelFlowInstrumentation
 });
 
 //#endregion
@@ -3358,6 +3508,22 @@ const getFlowQuote = async ({ flowId, fromChainId, fromTokenAddress, slippage },
 	}, client);
 };
 
+//#endregion
+//#region src/modules/flow/prepareFlowSigning/prepareFlowSigning.instrumentation.ts
+/**
+* Explicit instrumentation payload for prepareFlowSigning. Logs non-sensitive
+* volume and routing dimensions only — never the wallet address or any
+* session token.
+*/
+const prepareFlowSigningInstrumentation = { resolved: (flow) => ({
+	amount: flow.amount ?? null,
+	currency: flow.currency ?? null,
+	fromChainId: flow.fromChainId ?? null,
+	fromChainName: flow.fromChainName ?? null,
+	mode: flow.mode ?? null,
+	sourceType: flow.sourceType ?? null
+}) };
+
 //#endregion
 //#region src/modules/flow/prepareFlowSigning/prepareFlowSigning.ts
 /**
@@ -3395,9 +3561,26 @@ const __prepareFlowSigning_wrapped = require_updateAuthFromVerifyResponse.instru
 		} catch {
 			return;
 		}
-	}
+	},
+	selectors: prepareFlowSigningInstrumentation
 });
 
+//#endregion
+//#region src/modules/flow/submitFlowTransaction/submitFlowTransaction.instrumentation.ts
+/**
+* Explicit instrumentation payload for submitFlowTransaction. Logs
+* non-sensitive volume and routing dimensions only — never the wallet address
+* or any session token — so executed flow volume is measurable.
+*/
+const submitFlowTransactionInstrumentation = { resolved: (flow) => ({
+	amount: flow.amount ?? null,
+	currency: flow.currency ?? null,
+	fromChainId: flow.fromChainId ?? null,
+	fromChainName: flow.fromChainName ?? null,
+	mode: flow.mode ?? null,
+	sourceType: flow.sourceType ?? null
+}) };
+
 //#endregion
 //#region src/modules/flow/submitFlowTransaction/submitFlowTransaction.ts
 /**
@@ -3441,7 +3624,8 @@ const __submitFlowTransaction_wrapped = require_updateAuthFromVerifyResponse.ins
 		} catch {
 			return;
 		}
-	}
+	},
+	selectors: submitFlowTransactionInstrumentation
 });
 
 //#endregion
@@ -3673,18 +3857,6 @@ const createKrakenExchangeTransfer = async (transferParams, client = require_upd
 		exchangeKey: _dynamic_labs_sdk_api_core.ExchangeKeyEnum.Kraken
 	});
 };
-const __createKrakenExchangeTransfer_impl = createKrakenExchangeTransfer;
-const __createKrakenExchangeTransfer_wrapped = require_updateAuthFromVerifyResponse.instrumentFunction({
-	fn: __createKrakenExchangeTransfer_impl,
-	functionName: "createKrakenExchangeTransfer",
-	getCore: () => {
-		try {
-			return require_updateAuthFromVerifyResponse.getCore(require_updateAuthFromVerifyResponse.getDefaultClient());
-		} catch {
-			return;
-		}
-	}
-});
 
 //#endregion
 //#region src/modules/funding/kraken/getKrakenAccounts/getKrakenAccounts.ts
@@ -3796,10 +3968,6 @@ var MoonPayProviderNotAvailableError = class extends require_updateAuthFromVerif
 * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
 * @returns The signed MoonPay URL.
 * @instrumented
-* @redact-params - the return is a bare signed onramp URL whose query string
-* carries the provider signature plus the user's wallet address; a bare-string
-* return is logged under the synthetic `result` key, which no key-based rule
-* covers, so redact the whole event.
 */
 const getMoonPayUrl = async (params, client = require_updateAuthFromVerifyResponse.getDefaultClient()) => {
 	const core = require_updateAuthFromVerifyResponse.getCore(client);
@@ -3833,8 +4001,7 @@ const __getMoonPayUrl_wrapped = require_updateAuthFromVerifyResponse.instrumentF
 		} catch {
 			return;
 		}
-	},
-	redactAll: true
+	}
 });
 
 //#endregion
@@ -4418,7 +4585,6 @@ const getWalletConnectCatalogWalletByWalletProviderKey = async ({ walletProvider
 * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
 * @returns A promise that resolves to OTP verification details if verification is required, or undefined.
 * @instrumented
-* @redact-params
 */
 const updateUser = async ({ userFields }, client = require_updateAuthFromVerifyResponse.getDefaultClient()) => {
 	const core = require_updateAuthFromVerifyResponse.getCore(client);
@@ -4448,8 +4614,7 @@ const __updateUser_wrapped = require_updateAuthFromVerifyResponse.instrumentFunc
 		} catch {
 			return;
 		}
-	},
-	redactAll: true
+	}
 });
 
 //#endregion
@@ -4663,7 +4828,6 @@ const authenticateTotpMfaDevice = async ({ deviceId, code, createMfaTokenOptions
 * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
 * @returns A promise that resolves to the newly generated recovery codes.
 * @instrumented
-* @redact-params
 */
 const createNewMfaRecoveryCodes = async (client = require_updateAuthFromVerifyResponse.getDefaultClient()) => {
 	const core = require_updateAuthFromVerifyResponse.getCore(client);
@@ -4679,8 +4843,7 @@ const __createNewMfaRecoveryCodes_wrapped = require_updateAuthFromVerifyResponse
 		} catch {
 			return;
 		}
-	},
-	redactAll: true
+	}
 });
 
 //#endregion
@@ -4774,9 +4937,6 @@ const getMfaRecoveryCodes = async (client = require_updateAuthFromVerifyResponse
 * @returns A promise that resolves to the TOTP registration response containing setup information,
 * like the secret key and the OTP Auth URI.
 * @instrumented
-* @redact-params - the response embeds the TOTP shared secret in both `secret`
-* and the `uri` (`otpauth://...?secret=...`); redact the whole event so the
-* seed never reaches logs via the un-keyed `uri` field.
 */
 const registerTotpMfaDevice = async (client = require_updateAuthFromVerifyResponse.getDefaultClient()) => {
 	const core = require_updateAuthFromVerifyResponse.getCore(client);
@@ -4792,8 +4952,7 @@ const __registerTotpMfaDevice_wrapped = require_updateAuthFromVerifyResponse.ins
 		} catch {
 			return;
 		}
-	},
-	redactAll: true
+	}
 });
 
 //#endregion
@@ -4842,7 +5001,6 @@ const __setDefaultMfaDevice_wrapped = require_updateAuthFromVerifyResponse.instr
 * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
 * @returns A promise that resolves to an OTPVerification object containing the email and verification UUID.
 * @instrumented
-* @redact-params
 */
 const sendEmailOTP = async ({ email }, client = require_updateAuthFromVerifyResponse.getDefaultClient()) => {
 	const core = require_updateAuthFromVerifyResponse.getCore(client);
@@ -4870,8 +5028,7 @@ const __sendEmailOTP_wrapped = require_updateAuthFromVerifyResponse.instrumentFu
 		} catch {
 			return;
 		}
-	},
-	redactAll: true
+	}
 });
 
 //#endregion
@@ -5805,7 +5962,6 @@ const supportedCountries = {
 * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
 * @returns A promise that resolves to an OTPVerification object containing the phone details and verification UUID.
 * @instrumented
-* @redact-params
 */
 const sendSmsOTP = async ({ isoCountryCode, phoneNumber }, client = require_updateAuthFromVerifyResponse.getDefaultClient()) => {
 	const core = require_updateAuthFromVerifyResponse.getCore(client);
@@ -5838,8 +5994,7 @@ const __sendSmsOTP_wrapped = require_updateAuthFromVerifyResponse.instrumentFunc
 		} catch {
 			return;
 		}
-	},
-	redactAll: true
+	}
 });
 
 //#endregion
@@ -5896,7 +6051,6 @@ const verifyOTPForUserUpdate = async ({ otpVerification, verificationToken, requ
 * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
 * @returns A promise that resolves to the verify response object upon successful verification.
 * @instrumented
-* @redact-params
 */
 const verifyOTP = async ({ otpVerification, verificationToken, requestedScopes }, client = require_updateAuthFromVerifyResponse.getDefaultClient()) => {
 	require_isUserOnboardingComplete.preconnectWaasIframe(client);
@@ -5923,8 +6077,7 @@ const __verifyOTP_wrapped = require_updateAuthFromVerifyResponse.instrumentFunct
 		} catch {
 			return;
 		}
-	},
-	redactAll: true
+	}
 });
 
 //#endregion
@@ -7754,6 +7907,7 @@ const getWalletAccountAddressByType = ({ type, walletAccount }) => {
 * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
 * @returns The data for the wallet provider.
 * @notInstrumented
+* @hook Exposed as a hook so consumers get reactive wallet provider data, updated when the wallet provider registry changes.
 */
 const getWalletProviderDataByKey = ({ walletProviderKey }, client = require_updateAuthFromVerifyResponse.getDefaultClient()) => {
 	const { chain, groupKey, key, metadata, walletProviderType } = require_getWalletProviderByKey.getWalletProviderByKey({ walletProviderKey }, client);
@@ -8413,9 +8567,16 @@ const parseUserAgent = ({ userAgent }) => {
 
 //#endregion
 exports.BaseError = require_updateAuthFromVerifyResponse.BaseError;
+Object.defineProperty(exports, 'CaptchaProviderEnum', {
+  enumerable: true,
+  get: function () {
+    return _dynamic_labs_sdk_api_core.CaptchaProviderEnum;
+  }
+});
 exports.CheckoutSessionTokenMissingError = CheckoutSessionTokenMissingError;
 exports.ClientAlreadyInitializedError = ClientAlreadyInitializedError;
 exports.DeeplinkConnectAndVerifyUnsupportedError = DeeplinkConnectAndVerifyUnsupportedError;
+exports.DeviceRegistrationIdentityMismatchError = DeviceRegistrationIdentityMismatchError;
 exports.FeeEstimationFailedError = FeeEstimationFailedError;
 exports.FlowSessionTokenMissingError = FlowSessionTokenMissingError;
 exports.GOOGLE_DRIVE_BACKUP_REQUIRED_SCOPES = GOOGLE_DRIVE_BACKUP_REQUIRED_SCOPES;
@@ -8424,6 +8585,12 @@ exports.InvalidExternalAuthError = require_updateAuthFromVerifyResponse.InvalidE
 exports.InvalidParamError = require_updateAuthFromVerifyResponse.InvalidParamError;
 exports.InvalidRedirectStorageStateError = InvalidRedirectStorageStateError;
 exports.InvalidSocialCallbackOriginError = InvalidSocialCallbackOriginError;
+Object.defineProperty(exports, 'JwtVerifiedCredentialFormatEnum', {
+  enumerable: true,
+  get: function () {
+    return _dynamic_labs_sdk_api_core.JwtVerifiedCredentialFormatEnum;
+  }
+});
 exports.LinkCredentialError = require_updateAuthFromVerifyResponse.LinkCredentialError;
 Object.defineProperty(exports, 'MFAAction', {
   enumerable: true,
@@ -8445,8 +8612,20 @@ exports.NoPasskeyCredentialsFoundError = NoPasskeyCredentialsFoundError;
 exports.NoSmartWalletAccountSignerFoundError = NoSmartWalletAccountSignerFoundError;
 exports.NoWebAuthNSupportError = NoWebAuthNSupportError;
 exports.NotWaasWalletAccountError = require_isDynamicWaasEnabled.NotWaasWalletAccountError;
+Object.defineProperty(exports, 'ProviderEnum', {
+  enumerable: true,
+  get: function () {
+    return _dynamic_labs_sdk_api_core.ProviderEnum;
+  }
+});
 exports.SandboxMaximumThresholdReachedError = require_updateAuthFromVerifyResponse.SandboxMaximumThresholdReachedError;
 exports.SimulationFailedError = SimulationFailedError;
+Object.defineProperty(exports, 'TokenScope', {
+  enumerable: true,
+  get: function () {
+    return _dynamic_labs_sdk_api_core.TokenScope;
+  }
+});
 exports.TokenSwapError = TokenSwapError;
 exports.UnauthorizedError = require_updateAuthFromVerifyResponse.UnauthorizedError;
 exports.UnavailableInServerSideError = UnavailableInServerSideError;
@@ -8459,6 +8638,7 @@ exports.WalletAccountAlreadyVerifiedError = WalletAccountAlreadyVerifiedError;
 exports.WalletAccountNotSelectedError = WalletAccountNotSelectedError;
 exports.WalletAlreadyLinkedToAnotherUserError = require_getNetworkProviderFromNetworkId.WalletAlreadyLinkedToAnotherUserError;
 exports.WalletProviderMethodUnavailableError = WalletProviderMethodUnavailableError;
+exports.WalletScreeningBlockedError = require_getNetworkProviderFromNetworkId.WalletScreeningBlockedError;
 exports.acknowledgeRecoveryCodes = __acknowledgeRecoveryCodes_wrapped;
 exports.addCoinbaseOnrampOrderEventListener = addCoinbaseOnrampOrderEventListener;
 exports.addNetwork = __addNetwork_wrapped;
@@ -8488,7 +8668,7 @@ exports.createCheckoutTransaction = __createCheckoutTransaction_wrapped;
 exports.createCoinbaseOnrampOrder = __createCoinbaseOnrampOrder_wrapped;
 exports.createCryptoDotComPayment = __createCryptoDotComPayment_wrapped;
 exports.createDynamicClient = __createDynamicClient_wrapped;
-exports.createKrakenExchangeTransfer = __createKrakenExchangeTransfer_wrapped;
+exports.createKrakenExchangeTransfer = createKrakenExchangeTransfer;
 exports.createNewMfaRecoveryCodes = __createNewMfaRecoveryCodes_wrapped;
 exports.deleteMfaDevice = __deleteMfaDevice_wrapped;
 exports.deletePasskey = __deletePasskey_wrapped;
@@ -8506,6 +8686,7 @@ exports.getAvailableWalletProvidersData = getAvailableWalletProvidersData;
 exports.getBalance = getBalance;
 exports.getBalanceForAddress = getBalanceForAddress;
 exports.getBalances = getBalances;
+exports.getCaptchaSettings = getCaptchaSettings;
 exports.getCheckoutTransaction = getCheckoutTransaction;
 exports.getCheckoutTransactionQuote = getCheckoutTransactionQuote;
 exports.getCoinbaseBuyUrl = getCoinbaseBuyUrl;