@dynamic-labs-sdk/client 1.17.1 → 1.19.0

package/dist/index.esm.js

@@ -1,11 +1,11 @@
-import { $ as MfaRateLimitedError, A as NoWalletProviderFoundError, B as emitEvent, C as getOperatingSystem, D as WalletProviderPriority, E as getWalletProviderFromWalletAccount, F as CHAINS_INFO_MAP, G as fetchAndStoreNonces, H as onEvent, I as formatWalletAccountId, K as createApiClient, L as normalizeAddress, O as getWalletProviderRegistry, P as getChainFromVerifiedCredentialChain, Q as SandboxMaximumThresholdReachedError, R as splitWalletProviderKey, S as getPlatform, U as onceEvent, V as offEvent, Z as getNonce, _ as SDK_API_CORE_VERSION, _t as getCore, a as initializeWaasClientsForEagerRecovery, at as isCookieEnabled, b as DEFAULT_PII_FIELDS, ct as getElevatedAccessToken, et as MfaInvalidOtpError, f as getWalletProviders, ft as NONCE_POOL_SIZE, g as DYNAMIC_ICONIC_SPRITE_URL, gt as BaseError, i as InvalidParamError, j as getWalletAccounts, lt as randomString, m as checkAndRaiseWalletAccountsChangedEvent, mt as setDefaultClient, n as upsertElevatedAccessToken, nt as InvalidExternalAuthError, ot as assertDefined, p as isUserMissingMfaAuth, pt as getDefaultClient, q as UnauthorizedError, r as parseElevatedAccessToken, rt as APIError, st as ValueMustBeDefinedError, t as updateAuthFromVerifyResponse, tt as LinkCredentialError, v as instrumentFunction, vt as name, w as extractSessionId, x as getUserAgent, y as scrubParameters, yt as version } from "./updateAuthFromVerifyResponse-azIi_3FB.esm.js";
-import { A as GENERATE_SESSION_KEYS_TRACKER_KEY, B as isEqualShallow, C as createKeychainService, D as CannotTrackError, F as getBuffer, I as createStorage, M as REFRESH_USER_STATE_FROM_COOKIE_TRACKER_KEY, N as REFRESH_USER_STATE_FROM_VALID_TOKEN_TRACKER_KEY, O as createDeferredPromise, P as isServerSideRendering, R as createLocalStorageAdapter, S as createRealtimeService, T as createCrossTabBroadcast, _ as consumeCaptchaToken, a as verifyMessageSignatureOwnership, b as NoNetworkProvidersError, c as formatSignInMessage, d as updateWalletProviderKeysForVerifiedCredentials, f as setUnverifiedWalletAccounts, g as MethodNotImplementedError, h as __setCaptchaToken_wrapped, i as getNetworksData, j as INITIALIZE_STORAGE_SYNC_TRACKER_KEY, k as FETCH_PROJECT_SETTINGS_TRACKER_KEY, l as getAppMetadata, m as hasExtension, o as removeUnverifiedWalletAccount, p as createVisit, s as createSignInMessageStatement, t as getNetworkProviderFromNetworkId, u as reconcileWalletAccountsAgainstClient, v as isCaptchaRequired, w as createLogger, x as getKeychainIndexedDBName, y as WalletAlreadyLinkedToAnotherUserError, z as subscribeWithSelector } from "./getNetworkProviderFromNetworkId-pknqqhk1.esm.js";
-import { a as generateSessionKeys, c as isSignedIn, i as __logoutWithReason_wrapped, l as retryOnFail, n as getMfaMethods, o as fetchProjectSettings, r as __consumeMfaToken_wrapped, s as createStorageKeySchema, t as isMfaRequiredForAction } from "./isMfaRequiredForAction-CqEcCTIe.esm.js";
-import { n as NotWaasWalletAccountError, r as __refreshAuth_wrapped } from "./isDynamicWaasEnabled-BYaqAOml.esm.js";
-import { a as WaasOnboardingIncompleteError, i as preconnectWaasIframe, n as isPendingRecoveryCodesAcknowledgment, r as isDeviceRegistrationRequired, t as isUserOnboardingComplete } from "./isUserOnboardingComplete-CBrAH0ZF.esm.js";
-import { n as getVerifiedCredentialForWalletAccount, t as getWalletProviderByKey } from "./getWalletProviderByKey-lQVfIGFi.esm.js";
+import { $ as MfaRateLimitedError, A as getWalletAccounts, B as offEvent, C as extractSessionId, D as getWalletProviderRegistry, E as WalletProviderPriority, F as formatWalletAccountId, G as fetchAndStoreNonces, H as onceEvent, I as normalizeAddress, K as createApiClient, L as splitWalletProviderKey, N as getChainFromVerifiedCredentialChain, P as CHAINS_INFO_MAP, Q as SandboxMaximumThresholdReachedError, S as getOperatingSystem, T as getWalletProviderFromWalletAccount, V as onEvent, Z as getNonce, _ as SDK_API_CORE_VERSION, _t as BaseError, a as initializeWaasClientsForEagerRecovery, at as isCookieEnabled, b as DEFAULT_PII_FIELDS, bt as version, ct as getElevatedAccessToken, et as MfaInvalidOtpError, f as getWalletProviders, g as DYNAMIC_ICONIC_SPRITE_URL, ht as setDefaultClient, i as InvalidParamError, k as NoWalletProviderFoundError, lt as randomString, m as checkAndRaiseWalletAccountsChangedEvent, mt as getDefaultClient, n as upsertElevatedAccessToken, nt as InvalidExternalAuthError, ot as assertDefined, p as isUserMissingMfaAuth, pt as NONCE_POOL_SIZE, q as UnauthorizedError, r as parseElevatedAccessToken, rt as APIError, st as ValueMustBeDefinedError, t as updateAuthFromVerifyResponse, tt as LinkCredentialError, ut as getPlatform, v as instrumentFunction, vt as getCore, x as getUserAgent, y as scrubParameters, yt as name, z as emitEvent } from "./updateAuthFromVerifyResponse-_oYRLK_w.esm.js";
+import { B as createStorage, C as getKeychainIndexedDBName, E as assertSafeNavigationUrl, F as INITIALIZE_STORAGE_SYNC_TRACKER_KEY, H as createLocalStorageAdapter, I as REFRESH_USER_STATE_FROM_COOKIE_TRACKER_KEY, L as REFRESH_USER_STATE_FROM_VALID_TOKEN_TRACKER_KEY, M as createDeferredPromise, N as FETCH_PROJECT_SETTINGS_TRACKER_KEY, O as createLogger, P as GENERATE_SESSION_KEYS_TRACKER_KEY, R as isServerSideRendering, S as MergeAccountsConfirmationError, T as createKeychainService, U as subscribeWithSelector, W as isEqualShallow, _ as consumeCaptchaToken, a as verifyMessageSignatureOwnership, b as WalletAlreadyLinkedToAnotherUserError, c as formatSignInMessage, d as updateWalletProviderKeysForVerifiedCredentials, f as setUnverifiedWalletAccounts, g as MethodNotImplementedError, h as __setCaptchaToken_wrapped, i as getNetworksData, j as CannotTrackError, k as createCrossTabBroadcast, l as getAppMetadata, m as hasExtension, o as removeUnverifiedWalletAccount, p as createVisit, s as createSignInMessageStatement, t as getNetworkProviderFromNetworkId, u as reconcileWalletAccountsAgainstClient, v as isCaptchaRequired, w as createRealtimeService, x as NoNetworkProvidersError, y as WalletScreeningBlockedError, z as getBuffer } from "./getNetworkProviderFromNetworkId-D3uwhdMN.esm.js";
+import { a as generateSessionKeys, c as isSignedIn, i as __logoutWithReason_wrapped, l as retryOnFail, n as getMfaMethods, o as fetchProjectSettings, r as __consumeMfaToken_wrapped, s as createStorageKeySchema, t as isMfaRequiredForAction } from "./isMfaRequiredForAction-DTp4CZBt.esm.js";
+import { n as NotWaasWalletAccountError, r as __refreshAuth_wrapped } from "./isDynamicWaasEnabled-DDrg89y1.esm.js";
+import { a as WaasOnboardingIncompleteError, i as preconnectWaasIframe, n as isPendingRecoveryCodesAcknowledgment, r as isDeviceRegistrationRequired, t as isUserOnboardingComplete } from "./isUserOnboardingComplete-Dy2Ygp0u.esm.js";
+import { n as getVerifiedCredentialForWalletAccount, t as getWalletProviderByKey } from "./getWalletProviderByKey-Cr8m-Nax.esm.js";
 import { assertPackageVersion } from "@dynamic-labs-sdk/assert-package-version";
-import { AuthModeEnum, ExchangeKeyEnum, JwtVerifiedCredentialFormatEnum, JwtVerifiedCredentialFormatEnum as JwtVerifiedCredentialFormatEnum$1, MFAAction, MfaBackupCodeAcknowledgement, ProviderEnum, ProviderEnum as ProviderEnum$1, TokenScope, TokenScope as TokenScope$1, WaasBackupOptionsEnum, WalletProviderEnum } from "@dynamic-labs/sdk-api-core";
+import { AuthModeEnum, CaptchaProviderEnum as CaptchaProviderEnum$1, ExchangeKeyEnum, JwtVerifiedCredentialFormatEnum, JwtVerifiedCredentialFormatEnum as JwtVerifiedCredentialFormatEnum$1, MFAAction, MfaBackupCodeAcknowledgement, ProviderEnum, ProviderEnum as ProviderEnum$1, TokenScope, TokenScope as TokenScope$1, WaasBackupOptionsEnum, WalletProviderEnum } from "@dynamic-labs/sdk-api-core";
 import * as z from "zod/mini";
 import EventEmitter, { EventEmitter as EventEmitter$1 } from "eventemitter3";
 import { browserSupportsWebAuthn, startAuthentication, startRegistration } from "@simplewebauthn/browser";
@@ -353,13 +353,26 @@ const initializeStorageSync = async (client) => {
 //#endregion
 //#region src/modules/user/refreshUser/refreshUser.ts
 /**
-* Refreshes the current user's data from the server.
+* Refreshes the current user's profile from the server.
 *
-* This function fetches the latest authenticated user information from the backend
-* and updates the local user state.
+* This fetches the latest authenticated user from the backend and updates only
+* the local user state, returning the `SdkUser`. It does not touch the auth
+* token — use it when you just need up-to-date user data.
+*
+* Prefer `refreshAuth` when you need to rotate the auth token as well: it runs
+* a full verify, updates both token and user state, and returns the raw
+* `VerifyResponse` (including the new token).
+*
+* @example
+* ```ts
+* const user = await refreshUser();
+* console.log('Updated user:', user.email);
+* ```
 *
 * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
 * @returns A promise that resolves to the authenticated user.
+* @see refreshAuth
+* @see deleteUser
 * @instrumented
 * @noHook Low-level refresh primitive that is not exposed as a React hook.
 */
@@ -410,9 +423,25 @@ var ClientAlreadyInitializedError = class extends BaseError {
 *
 * You only need to call this function if you are not using `autoInitialize: true` in createDynamicClient.
 *
+* @example
+* ```ts
+* const client = createDynamicClient({
+*   environmentId: 'env-id',
+*   autoInitialize: false,
+* });
+*
+* try {
+*   await initializeClient(client);
+* } catch (error) {
+*   console.error('Failed to initialize:', error);
+* }
+* ```
+*
 * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
 * @returns A promise that resolves when initialization is complete.
 * @throws ClientAlreadyInitializedError If the client is already initialized.
+* @see createDynamicClient
+* @see waitForClientInitialized
 * @instrumented
 * @noHook Client lifecycle management is not exposed as a React hook.
 */
@@ -749,10 +778,67 @@ const createDynamicTransport = (params) => {
 const createNavigationHandler = () => {
 	if (isServerSideRendering()) return () => Promise.reject(new UnavailableInServerSideError("createNavigationHandler"));
 	return async (url) => {
+		assertSafeNavigationUrl(url);
 		window.location.href = url;
 	};
 };
 
+//#endregion
+//#region src/errors/UnsafeDeeplinkUrlError.ts
+/**
+* Thrown when a deeplink is opened with a URL whose scheme can execute script
+* in the current origin (`javascript:`, `data:`, `vbscript:`). Unlike
+* navigation, deeplinks legitimately use custom app schemes (e.g. `phantom:`,
+* `metamask:`), so this guards via a denylist of dangerous schemes rather than
+* an `http(s)` allowlist, preventing DOM XSS through the `window.location.assign`
+* sink while leaving valid wallet deeplinks untouched.
+*/
+var UnsafeDeeplinkUrlError = class extends BaseError {
+	constructor({ scheme }) {
+		super({
+			cause: null,
+			code: "unsafe_deeplink_url_error",
+			docsUrl: null,
+			name: "UnsafeDeeplinkUrlError",
+			shortMessage: `Refusing to open a deeplink with an unsafe scheme "${scheme}". Script-executing schemes (javascript:, data:, vbscript:) are not allowed. This may indicate a compromised or misconfigured deeplink URL.`
+		});
+	}
+};
+
+//#endregion
+//#region src/utils/assertSafeDeeplinkUrl/assertSafeDeeplinkUrl.ts
+/**
+* Schemes that can execute script in the current origin and must never reach a
+* deeplink navigation sink. Deeplinks legitimately use arbitrary custom app
+* schemes (e.g. `phantom:`, `metamask:`), so a denylist of dangerous schemes is
+* used here instead of the `http(s)` allowlist applied to standard navigation.
+*/
+const DANGEROUS_DEEPLINK_SCHEMES = new Set([
+	"javascript:",
+	"data:",
+	"vbscript:",
+	"blob:"
+]);
+/**
+* Asserts that the given deeplink URL is safe to open, i.e. its scheme is not
+* one that can execute script (`javascript:`, `data:`, `vbscript:`, `blob:`). Used as a
+* defense-in-depth guard on the `window.location.assign` deeplink sink to
+* prevent DOM XSS, while still permitting custom wallet app schemes.
+*
+* @param url - The deeplink URL string to validate.
+* @throws {UnsafeDeeplinkUrlError} If the URL cannot be parsed or its scheme can execute script.
+* @notInstrumented
+*/
+const assertSafeDeeplinkUrl = (url) => {
+	let parsed;
+	try {
+		parsed = new URL(url);
+	} catch {
+		throw new UnsafeDeeplinkUrlError({ scheme: "unknown" });
+	}
+	if (DANGEROUS_DEEPLINK_SCHEMES.has(parsed.protocol)) throw new UnsafeDeeplinkUrlError({ scheme: parsed.protocol });
+};
+
 //#endregion
 //#region src/services/openDeeplink/createWebDeeplinkOpener/createWebDeeplinkOpener.ts
 /**
@@ -772,6 +858,7 @@ const createNavigationHandler = () => {
 const createWebDeeplinkOpener = () => {
 	if (isServerSideRendering()) return () => Promise.reject(new UnavailableInServerSideError("createWebDeeplinkOpener"));
 	return async (url) => {
+		assertSafeDeeplinkUrl(url);
 		window.location.assign(url);
 	};
 };
@@ -1038,8 +1125,18 @@ const createCore = (config) => {
 * Manually calling `initializeClient` also allows you to catch any potential
 * errors that may occur during initialization.
 *
+* @example
+* ```ts
+* const client = createDynamicClient({
+*   environmentId: 'your-environment-id',
+*   appUrl: 'https://myapp.com',
+* });
+* ```
+*
 * @param config - The configuration for the Dynamic client, like the environment ID, app url, etc.
 * @returns The Dynamic client instance.
+* @see initializeClient
+* @see getDefaultClient
 * @instrumented
 */
 const createDynamicClient = (config) => {
@@ -1128,6 +1225,42 @@ var DeeplinkConnectAndVerifyUnsupportedError = class extends BaseError {
 	}
 };
 
+//#endregion
+//#region src/errors/DeviceRegistrationIdentityMismatchError.ts
+/**
+* Thrown when completing device registration would replace the current session
+* with a different user's identity.
+*
+* The device registration token resolved to a user other than the one currently
+* authenticated, which can indicate a login-CSRF / session-fixation attempt, so
+* the returned session is rejected and the current session is left untouched.
+*
+* @example
+* ```ts
+* try {
+*   await completeDeviceRegistration({ token });
+* } catch (error) {
+*   if (error instanceof DeviceRegistrationIdentityMismatchError) {
+*     // The current session was preserved; ask the user to retry on this device.
+*   }
+* }
+* ```
+* @see completeDeviceRegistration
+* @see InvalidDeviceRegistrationRedirectError
+*/
+var DeviceRegistrationIdentityMismatchError = class extends BaseError {
+	constructor() {
+		super({
+			cause: null,
+			code: "device_registration_identity_mismatch_error",
+			docsUrl: null,
+			metaMessages: ["The device registration token resolved to a different user than the one currently authenticated.", "This can indicate a login-CSRF / session-fixation attempt, so the returned session was rejected and the current session was left untouched."],
+			name: "DeviceRegistrationIdentityMismatchError",
+			shortMessage: "Device registration completion was rejected because it would have replaced the current session with a different identity."
+		});
+	}
+};
+
 //#endregion
 //#region src/errors/FeeEstimationFailedError.ts
 var FeeEstimationFailedError = class extends BaseError {
@@ -1575,7 +1708,6 @@ const __checkStepUpAuth_wrapped = instrumentFunction({
 * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
 * @returns A promise that resolves to the assertion response containing the elevated access token.
 * @instrumented
-* @redact-params
 */
 const requestExternalAuthElevatedToken = async ({ externalJwt }, client = getDefaultClient()) => {
 	const core = getCore(client);
@@ -1603,8 +1735,7 @@ const __requestExternalAuthElevatedToken_wrapped = instrumentFunction({
 		} catch {
 			return;
 		}
-	},
-	redactAll: true
+	}
 });
 
 //#endregion
@@ -1615,11 +1746,20 @@ const __requestExternalAuthElevatedToken_wrapped = instrumentFunction({
 * This function allows authentication using JWT tokens from external providers,
 * enabling integration with custom authentication systems.
 *
+* @example
+* ```ts
+* const response = await signInWithExternalJwt({
+*   externalJwt: 'eyJhbGciOiJSUzI1NiIs...',
+* });
+* ```
+*
 * @param [params.externalJwt] - Optional external JWT token to authenticate with. Not required when using cookie based auth.
+* @param [params.sessionPublicKey] - Optional session public key for session-based auth.
 * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
 * @returns A promise that resolves to the authentication response from the server.
+* @see logout
+* @see refreshAuth
 * @instrumented
-* @redact-params
 */
 const signInWithExternalJwt = async ({ externalJwt, sessionPublicKey } = {}, client = getDefaultClient()) => {
 	const core = getCore(client);
@@ -1643,8 +1783,7 @@ const __signInWithExternalJwt_wrapped = instrumentFunction({
 		} catch {
 			return;
 		}
-	},
-	redactAll: true
+	}
 });
 
 //#endregion
@@ -1652,8 +1791,21 @@ const __signInWithExternalJwt_wrapped = instrumentFunction({
 /**
 * Logs out the current user and clears all authentication data.
 *
+* @example
+* ```ts
+* await logout();
+* ```
+*
+* @example
+* ```ts
+* // With explicit client for multi-client setups
+* await logout(myClient);
+* ```
+*
 * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
 * @returns A promise that resolves when the logout process is complete.
+* @see isAnyWalletAccountConnected
+* @see refreshAuth
 * @notInstrumented
 */
 const logout = async (client = getDefaultClient()) => {
@@ -1666,6 +1818,58 @@ const logout = async (client = getDefaultClient()) => {
 	return __logoutWithReason_wrapped({ reason: "user-intent" }, client);
 };
 
+//#endregion
+//#region src/modules/auth/mergeUserAccounts/mergeUserAccounts.ts
+/**
+* Completes an account merge after a credential was found to already belong to
+* another user (surfaced as `MergeAccountsConfirmationError` during
+* verification / linking).
+*
+* When the merge has no field-level conflicts, call it with no resolutions to
+* merge directly. When the two accounts hold different values for the same
+* profile field, pass the user's chosen `conflictResolutions` (one per
+* conflict) so the backend knows which value to keep. On success the two users
+* are folded into one, the merged session is persisted, and the merged user is
+* returned.
+*
+* @example
+* ```ts
+* try {
+*   await verifyWalletAccount({ walletAccount });
+* } catch (error) {
+*   if (error instanceof MergeAccountsConfirmationError) {
+*     // resolveConflicts is your own function (not provided by the SDK): given
+*     // the conflicting fields, decide which value to keep for each one —
+*     // usually by prompting the user — and return them as MergeUserConflictResolution[].
+*     await mergeUserAccounts(
+*       error.mergeConflicts
+*         ? { conflictResolutions: resolveConflicts(error.mergeConflicts) }
+*         : undefined,
+*     );
+*   }
+* }
+* ```
+* @param params.conflictResolutions - Optional per-field conflict resolutions.
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns A promise that resolves to the merged user.
+* @see MergeAccountsConfirmationError
+* @see MergeUserConflictResolution
+* @notInstrumented
+*/
+const mergeUserAccounts = async ({ conflictResolutions } = {}, client = getDefaultClient()) => {
+	const core = getCore(client);
+	const apiClient = createApiClient({}, client);
+	const hasConflictResolutions = conflictResolutions !== void 0 && conflictResolutions.length > 0;
+	let response;
+	if (hasConflictResolutions) response = await apiClient.verifyMergeUsers({
+		environmentId: core.environmentId,
+		mergeUserConflictResolutions: { mergeUserResolutions: conflictResolutions }
+	});
+	else response = await apiClient.mergeUsers({ environmentId: core.environmentId });
+	updateAuthFromVerifyResponse({ response }, client);
+	return response.user;
+};
+
 //#endregion
 //#region src/modules/auth/passkeys/deletePasskey/deletePasskey.ts
 /**
@@ -1751,12 +1955,18 @@ const serverRegisterPasskey = async ({ registration, createMfaToken }, client) =
 * passwordless authentication. The user will be prompted to create a passkey
 * using their device's biometric authentication or security key.
 *
+* @example
+* ```ts
+* await registerPasskey();
+* ```
+*
 * @param [params.createMfaToken] - Optional configuration for MFA token creation.
 * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
 * @returns A promise that resolves to the registration response.
 * @throws NoWebAuthNSupportError If WebAuthn is not supported by the browser.
+* @see signInWithPasskey
+* @see getPasskeys
 * @instrumented
-* @redact-params
 */
 const registerPasskey = async ({ createMfaToken } = {}, client = getDefaultClient()) => {
 	const core = getCore(client);
@@ -1779,8 +1989,7 @@ const __registerPasskey_wrapped = instrumentFunction({
 		} catch {
 			return;
 		}
-	},
-	redactAll: true
+	}
 });
 
 //#endregion
@@ -1821,11 +2030,19 @@ const serverSigninPasskey = async ({ authentication, createMfaToken }, client) =
 * credential, providing passwordless authentication using biometrics or
 * security keys.
 *
+* @example
+* ```ts
+* const response = await signInWithPasskey();
+* console.log('Signed in:', response.user.email);
+* ```
+*
+* @param [params.relatedOriginRpId] - Optional relying party ID for cross-origin authentication.
 * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
 * @returns A promise that resolves to the authentication response.
 * @throws NoWebAuthNSupportError If WebAuthn is not supported by the browser.
+* @see registerPasskey
+* @see getPasskeys
 * @instrumented
-* @redact-params
 */
 const signInWithPasskey = async ({ relatedOriginRpId } = {}, client = getDefaultClient()) => {
 	const core = getCore(client);
@@ -1845,8 +2062,7 @@ const __signInWithPasskey_wrapped = instrumentFunction({
 		} catch {
 			return;
 		}
-	},
-	redactAll: true
+	}
 });
 
 //#endregion
@@ -1950,22 +2166,29 @@ const addOAuthUrlParams = ({ baseUrl, isGoogleDriveBackupEnabled, provider }) =>
 
 //#endregion
 //#region src/modules/auth/social/oauth/signInWithSocialRedirect/buildOAuthUrl/getOAuthBaseUrl/getOAuthBaseUrl.ts
-/** Helper function to build the OAuth base URL for a given provider.  * @notInstrumented
+/**
+* Resolves the raw base URL string for a provider before parsing/validation.
 */
-const getOAuthBaseUrl = (provider) => {
+const resolveBaseUrl = (provider) => {
 	assertDefined(provider.provider, "Provider type not found");
 	const providerType = provider.provider;
 	if (providerType === ProviderEnum$1.Telegram) {
 		assertDefined(provider.authorizationUrl, "Telegram authorization URL not found");
-		return new URL(provider.authorizationUrl);
+		return provider.authorizationUrl;
 	}
 	assertDefined(provider.baseAuthUrl, "Base auth URL not found");
 	if (providerType === ProviderEnum$1.Shopify) {
 		assertDefined(provider.shopifyStore, "Shopify store value not found in provider");
-		const loginBaseUrl = provider.baseAuthUrl.replace("{{shopifyStore}}", provider.shopifyStore);
-		return new URL(loginBaseUrl);
+		return provider.baseAuthUrl.replace("{{shopifyStore}}", provider.shopifyStore);
 	}
-	return new URL(provider.baseAuthUrl);
+	return provider.baseAuthUrl;
+};
+/** Helper function to build the OAuth base URL for a given provider.  * @notInstrumented
+*/
+const getOAuthBaseUrl = (provider) => {
+	const urlString = resolveBaseUrl(provider);
+	assertSafeNavigationUrl(urlString);
+	return new URL(urlString);
 };
 
 //#endregion
@@ -2014,9 +2237,19 @@ const buildOAuthUrl = async (core, provider) => {
 * back because of this flow, then call `completeSocialRedirect` to finish
 * the social authentication.
 *
+* @example
+* ```ts
+* await signInWithSocialRedirect({
+*   provider: 'google',
+*   redirectUrl: window.location.href,
+* });
+* ```
+*
 * @param params.provider - The social provider to authenticate with (e.g., 'google', 'github').
 * @param params.redirectUrl - The URL to redirect back to after authentication.
 * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @see completeSocialRedirect
+* @see detectSocialRedirectUrl
 * @instrumented
 */
 const signInWithSocialRedirect = async ({ provider, redirectUrl }, client = getDefaultClient()) => {
@@ -2059,6 +2292,14 @@ const __signInWithSocialRedirect_wrapped = instrumentFunction({
 * @deprecated Renamed to {@link signInWithSocialRedirect}. This alias will be
 * removed in a future major version.
 *
+* @example
+* ```ts
+* // Prefer signInWithSocialRedirect instead
+* await signInWithSocialRedirect({ provider: 'google', redirectUrl: window.location.href });
+* ```
+*
+* @see signInWithSocialRedirect
+* @see completeSocialRedirect
 * @instrumented
 * @noHook Deprecated alias that is not exposed as a React hook.
 */
@@ -2076,6 +2317,45 @@ const __authenticateWithSocial_wrapped = instrumentFunction({
 	}
 });
 
+//#endregion
+//#region src/modules/auth/social/oauth/clearSocialRedirectParams/clearSocialRedirectParams.ts
+/**
+* Removes the social OAuth redirect parameters that `signInWithSocialRedirect`
+* appends to the return URL from the browser's current URL, leaving every other
+* query parameter, the path, and the hash untouched.
+*
+* Call this once you have finished `completeSocialRedirect` so a page refresh
+* doesn't re-trigger the redirect flow. Unlike clearing the whole query
+* string, this preserves any of your own parameters on the callback URL.
+*
+* This reads and rewrites `window.location`, so it can only run in the
+* browser. Calling it during server-side rendering (no `window`) throws
+* `UnavailableInServerSideError`.
+*
+* @returns Nothing. The current URL is rewritten in place via
+* `window.history.replaceState`.
+*
+* @throws {UnavailableInServerSideError} When called without a `window`
+* (e.g. during server-side rendering).
+*
+* @example
+* ```ts
+* await completeSocialRedirect({ url: new URL(window.location.href) });
+* clearSocialRedirectParams();
+* ```
+*
+* @see {@link completeSocialRedirect} to finish the redirect sign-in before
+* clearing the parameters.
+* @see {@link detectSocialRedirectUrl} to check whether the current URL is a
+* social OAuth callback.
+*
+* @notInstrumented
+*/
+const clearSocialRedirectParams = () => {
+	if (isServerSideRendering()) throw new UnavailableInServerSideError("clearSocialRedirectParams");
+	window.history.replaceState({}, "", removeDynamicOauthParamsFromUrl(window.location.href));
+};
+
 //#endregion
 //#region src/modules/auth/social/oauth/processSocialCallback/processSocialCallback.ts
 /**
@@ -2157,12 +2437,23 @@ const __processSocialCallback_wrapped = instrumentFunction({
 * authenticating (or linking) the user with the social provider. This is the
 * final step after `signInWithSocialRedirect` + `detectSocialRedirectUrl`.
 *
+* @example
+* ```ts
+* const redirectUrl = detectSocialRedirectUrl();
+* if (redirectUrl) {
+*   const user = await completeSocialRedirect({ url: redirectUrl });
+* }
+* ```
+*
 * @param params.url - The callback URL containing OAuth response parameters.
 * @param [params.requestedScopes] - Optional scopes to request an elevated access token when verifying (linking) a social account.
 * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
 * @returns A promise that resolves to the authenticated user or null.
 * @throws MissingSocialUrlParamError If required OAuth parameters are missing.
 * @throws InvalidRedirectStorageStateError If the stored state doesn't match.
+* @see signInWithSocialRedirect
+* @see detectSocialRedirectUrl
+* @see clearSocialRedirectParams
 * @instrumented
 */
 const completeSocialRedirect = ({ url, requestedScopes }, client = getDefaultClient()) => __processSocialCallback_wrapped({
@@ -2218,7 +2509,6 @@ const __completeSocialAuthentication_wrapped = instrumentFunction({
 * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
 * @returns A promise that resolves to true if the URL is an OAuth redirect, false otherwise.
 * @notInstrumented
-* @noHook Low-level redirect-detection primitive that is not exposed as a React hook.
 */
 const detectSocialRedirectUrl = async ({ url }, client = getDefaultClient()) => {
 	const core = getCore(client);
@@ -2250,7 +2540,19 @@ const detectOAuthRedirect = (params, client = getDefaultClient()) => detectSocia
 * {@link signInWithSocialRedirect} + {@link completeSocialRedirect} instead —
 * the browser already owns the tab so there is no popup to open.
 *
+* @example
+* ```ts
+* // React Native only
+* const user = await signInWithSocialPopUp({ provider: 'google' });
+* ```
+*
+* @param params.provider - The social provider to authenticate with.
+* @param [params.requestedScopes] - Optional scopes to request from the provider.
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns A promise that resolves to the authenticated user or null.
 * @throws MethodNotImplementedError Always on web.
+* @see signInWithSocialRedirect
+* @see completeSocialRedirect
 * @instrumented
 */
 const signInWithSocialPopUp = async ({ provider, requestedScopes }, client = getDefaultClient()) => {
@@ -2270,19 +2572,39 @@ const __signInWithSocialPopUp_wrapped = instrumentFunction({
 });
 
 //#endregion
-//#region src/modules/wallets/primaryWalletAccount/getPrimaryWalletAccount/getPrimaryWalletAccount.ts
+//#region src/modules/wallets/selectedWalletAccount/getSelectedWalletAccount/getSelectedWalletAccount.ts
 /**
-* Get the primary wallet account.
-* The primary wallet account is the one that was last selected by the user.
-* This information is stored in both unverified and verified wallet accounts.
-* This function consolidates this information to determine which wallet was most recently selected.
+* Get the wallet account currently selected for the user.
+*
+* The SDK itself does not use or care about which wallet is "selected" — it has
+* no bearing on authentication, signing, or any other SDK behaviour. This is
+* purely a convenience for *reading* which wallet the user most recently
+* selected (derived from the backend `lastSelectedAt` timestamp, across both
+* unverified and verified wallet accounts). Applications that need a notion of
+* an active/current wallet should own that selection state themselves.
+*
+* The one exception is the wagmi integration (`@dynamic-labs-sdk/wagmi`), which
+* mirrors the selected EVM wallet into wagmi's connector state.
+*
+* @example
+* ```ts
+* const selected = getSelectedWalletAccount();
+* if (selected) {
+*   console.log('Selected wallet:', selected.address);
+* }
+* ```
+*
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns The selected wallet account, or null if no wallet has been selected.
+* @see setSelectedWalletAccount
+* @see getWalletAccounts
 * @notInstrumented
 */
-const getPrimaryWalletAccount = (client = getDefaultClient()) => {
+const getSelectedWalletAccount = (client = getDefaultClient()) => {
 	const sortedLastSelectedWalletAccounts = getWalletAccounts(client).filter((walletAccount) => Boolean(walletAccount.lastSelectedAt)).sort((a, b) => b.lastSelectedAt.getTime() - a.lastSelectedAt.getTime());
 	if (sortedLastSelectedWalletAccounts.length === 0) return null;
-	const [primaryWalletAccount] = sortedLastSelectedWalletAccounts;
-	return primaryWalletAccount;
+	const [selectedWallet] = sortedLastSelectedWalletAccounts;
+	return selectedWallet;
 };
 
 //#endregion
@@ -2300,14 +2622,13 @@ const getPrimaryWalletAccount = (client = getDefaultClient()) => {
 * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
 * @returns A promise that resolves to the verify response.
 * @instrumented
-* @redact-params
 */
 const unlinkSocialAccount = async ({ verifiedCredentialId }, client = getDefaultClient()) => {
 	const core = getCore(client);
 	const apiClient = createApiClient({ elevatedAccessTokenScope: TokenScope$1.Credentialunlink }, client);
-	const primaryWalletAccount = getPrimaryWalletAccount(client);
-	const walletId = primaryWalletAccount?.verifiedCredentialId?.replace("-zerodev", "") ?? void 0;
-	const isEmbeddedWallet = !!primaryWalletAccount && getVerifiedCredentialForWalletAccount({ walletAccount: primaryWalletAccount }, client)?.walletProvider === WalletProviderEnum.EmbeddedWallet;
+	const selectedWallet = getSelectedWalletAccount(client);
+	const walletId = selectedWallet?.verifiedCredentialId?.replace("-zerodev", "") ?? void 0;
+	const isEmbeddedWallet = !!selectedWallet && getVerifiedCredentialForWalletAccount({ walletAccount: selectedWallet }, client)?.walletProvider === WalletProviderEnum.EmbeddedWallet;
 	const response = await apiClient.verifyUnlink({
 		environmentId: core.environmentId,
 		verifyUnlinkRequest: {
@@ -2328,8 +2649,7 @@ const __unlinkSocialAccount_wrapped = instrumentFunction({
 		} catch {
 			return;
 		}
-	},
-	redactAll: true
+	}
 });
 
 //#endregion
@@ -2421,6 +2741,59 @@ const getMultichainTokenBalances = async ({ balanceRequest }, client = getDefaul
 */
 const getMultichainBalances = (params, client = getDefaultClient()) => getMultichainTokenBalances(params, client);
 
+//#endregion
+//#region src/modules/captcha/getCaptchaSettings/getCaptchaSettings.ts
+/**
+* The captcha providers Dynamic can be configured to use for an environment.
+* Use it to branch on which captcha widget to render for the active provider.
+*
+* Redeclared locally (rather than re-exported directly from the generated
+* `sdk-api-core`) so the public client entry point owns its own documented,
+* stable surface for this token.
+*
+* @example
+* ```ts
+* const settings = getCaptchaSettings();
+* if (settings?.provider === CaptchaProviderEnum.Hcaptcha) {
+*   renderHcaptcha(settings.siteKey);
+* }
+* ```
+* @see getCaptchaSettings
+* @see CaptchaSettingsResult
+*/
+const CaptchaProviderEnum = CaptchaProviderEnum$1;
+/**
+* Returns the active captcha provider and site key, or undefined if captcha is not enabled.
+* Use this to determine which captcha widget to render and which site key to pass it.
+*
+* @example
+* ```ts
+* const settings = getCaptchaSettings();
+* if (settings) renderCaptcha(settings.provider, settings.siteKey);
+* ```
+* @see CaptchaSettingsResult
+* @see CaptchaProviderEnum
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns The active captcha provider and site key, or undefined when captcha is not enabled.
+* @notInstrumented
+*/
+const getCaptchaSettings = (client = getDefaultClient()) => {
+	const projectSettings = client.projectSettings;
+	if (!projectSettings) return void 0;
+	const { security } = projectSettings;
+	if (security.captcha) {
+		if (security.captcha.enabled) return {
+			provider: security.captcha.provider ?? CaptchaProviderEnum.Hcaptcha,
+			siteKey: security.captcha.siteKey
+		};
+		return;
+	}
+	if (security.hCaptcha?.enabled) return {
+		provider: CaptchaProviderEnum.Hcaptcha,
+		siteKey: security.hCaptcha.siteKey
+	};
+};
+
 //#endregion
 //#region src/modules/checkout/utils/createCheckoutSessionTokenStorageKey/createCheckoutSessionTokenStorageKey.ts
 /** @notInstrumented */
@@ -2980,14 +3353,65 @@ const requiresConversion = async ({ transaction }, client = getDefaultClient())
 	return !checkout.settlementConfig.settlements.some((settlement) => settlement.chainName === transaction.fromChainName && settlement.chainId === transaction.fromChainId && settlement.tokenAddress === transaction.fromToken);
 };
 
+//#endregion
+//#region src/modules/deviceRegistration/clearDeviceRegistrationRedirectParams/clearDeviceRegistrationRedirectParams.ts
+/**
+* Removes the device registration redirect parameters that the device
+* registration email link appends to the return URL from the browser's current
+* URL, leaving every other query parameter, the path, and the hash untouched.
+*
+* Call this once you have finished `completeDeviceRegistration` so a page
+* refresh doesn't re-trigger the registration flow. Unlike clearing the whole
+* query string, this preserves any of your own parameters on the callback URL.
+*
+* This reads and rewrites `window.location`, so it can only run in the
+* browser. Calling it during server-side rendering (no `window`) throws
+* `UnavailableInServerSideError`.
+*
+* @returns Nothing. The current URL is rewritten in place via
+* `window.history.replaceState`.
+*
+* @throws {UnavailableInServerSideError} When called without a `window`
+* (e.g. during server-side rendering).
+*
+* @example
+* ```ts
+* const deviceToken = getDeviceRegistrationTokenFromUrl({ url: window.location.href });
+* await completeDeviceRegistration({ deviceToken });
+* clearDeviceRegistrationRedirectParams();
+* ```
+*
+* @see {@link completeDeviceRegistration} to finish the registration before
+* clearing the parameters.
+* @see {@link detectDeviceRegistrationRedirect} to check whether the current
+* URL is a device registration callback.
+*
+* @notInstrumented
+*/
+const clearDeviceRegistrationRedirectParams = () => {
+	if (isServerSideRendering()) throw new UnavailableInServerSideError("clearDeviceRegistrationRedirectParams");
+	const url = new URL(window.location.href);
+	url.searchParams.delete("deviceRegistrationToken");
+	window.history.replaceState({}, "", url.toString());
+};
+
 //#endregion
 //#region src/modules/deviceRegistration/completeDeviceRegistration/completeDeviceRegistration.ts
 const DEVICE_REGISTRATION_TOKEN_HEADER = "x-dynamic-device-registration-token";
-/** @instrumented */
+/**
+* Completes device registration using the token from a device registration
+* redirect, authenticating the current device against the user's account.
+*
+* @see detectDeviceRegistrationRedirect
+* @see clearDeviceRegistrationRedirectParams
+* @instrumented
+*/
 const completeDeviceRegistration = async ({ deviceToken }, client = getDefaultClient()) => {
 	assertDefined(deviceToken, "deviceToken is required");
 	const core = getCore(client);
+	const currentUser = core.state.get().user;
 	const response = await createApiClient({ headers: { [DEVICE_REGISTRATION_TOKEN_HEADER]: deviceToken } }, client).deviceRegistration({ environmentId: core.environmentId });
+	if (currentUser && response.user?.id !== currentUser.id) throw new DeviceRegistrationIdentityMismatchError();
 	updateAuthFromVerifyResponse({ response }, client);
 	emitEvent({ event: "deviceRegistrationCompleted" }, client);
 	return response;
@@ -3168,6 +3592,22 @@ const withFlowSessionTokenCleanupOn401 = async ({ call, flowId }, client) => {
 	}
 };
 
+//#endregion
+//#region src/modules/flow/attachFlowSource/attachFlowSource.instrumentation.ts
+/**
+* Explicit instrumentation payload for attachFlowSource. Reads the nested
+* `flow` and logs non-sensitive volume and routing dimensions only — never the
+* wallet address, and never the response's session token.
+*/
+const attachFlowSourceInstrumentation = { resolved: ({ flow }) => ({
+	amount: flow.amount ?? null,
+	currency: flow.currency ?? null,
+	fromChainId: flow.fromChainId ?? null,
+	fromChainName: flow.fromChainName ?? null,
+	mode: flow.mode ?? null,
+	sourceType: flow.sourceType ?? null
+}) };
+
 //#endregion
 //#region src/modules/flow/attachFlowSource/attachFlowSource.ts
 /**
@@ -3220,7 +3660,8 @@ const __attachFlowSource_wrapped = instrumentFunction({
 		} catch {
 			return;
 		}
-	}
+	},
+	selectors: attachFlowSourceInstrumentation
 });
 
 //#endregion
@@ -3238,6 +3679,22 @@ const createFlowApiClient = async ({ flowId }, client) => {
 	};
 };
 
+//#endregion
+//#region src/modules/flow/broadcastFlow/broadcastFlow.instrumentation.ts
+/**
+* Explicit instrumentation payload for broadcastFlow. Logs non-sensitive
+* volume and routing dimensions only — never the wallet address or any
+* session token — so we can understand volume moved through the flow product.
+*/
+const broadcastFlowInstrumentation = { resolved: (flow) => ({
+	amount: flow.amount ?? null,
+	currency: flow.currency ?? null,
+	fromChainId: flow.fromChainId ?? null,
+	fromChainName: flow.fromChainName ?? null,
+	mode: flow.mode ?? null,
+	sourceType: flow.sourceType ?? null
+}) };
+
 //#endregion
 //#region src/modules/flow/broadcastFlow/broadcastFlow.ts
 /**
@@ -3274,17 +3731,40 @@ const __broadcastFlow_wrapped = instrumentFunction({
 		} catch {
 			return;
 		}
-	}
+	},
+	selectors: broadcastFlowInstrumentation
 });
 
+//#endregion
+//#region src/modules/flow/cancelFlow/cancelFlow.instrumentation.ts
+/**
+* Explicit instrumentation payload for cancelFlow. Logs non-sensitive volume
+* and routing dimensions only — never the wallet address or any session token.
+*/
+const cancelFlowInstrumentation = { resolved: (flow) => ({
+	amount: flow.amount ?? null,
+	currency: flow.currency ?? null,
+	fromChainId: flow.fromChainId ?? null,
+	fromChainName: flow.fromChainName ?? null,
+	mode: flow.mode ?? null,
+	sourceType: flow.sourceType ?? null
+}) };
+
 //#endregion
 //#region src/modules/flow/cancelFlow/cancelFlow.ts
 /**
-* Cancels a flow before it has been broadcasted
+* Cancels a flow before it has been broadcasted.
+*
+* @example
+* ```ts
+* const cancelledFlow = await cancelFlow({ flowId: 'flow-abc123' });
+* ```
 *
-* @param params CancelFlowParams - The flow to cancel.
+* @param params.flowId - The unique identifier of the flow to cancel.
 * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
-* @returns The cancelled flow
+* @returns A promise that resolves to the cancelled flow.
+* @see getFlow
+* @see getFlowQuote
 * @instrumented
 */
 const cancelFlow = async ({ flowId }, client = getDefaultClient()) => {
@@ -3310,17 +3790,26 @@ const __cancelFlow_wrapped = instrumentFunction({
 		} catch {
 			return;
 		}
-	}
+	},
+	selectors: cancelFlowInstrumentation
 });
 
 //#endregion
 //#region src/modules/flow/getFlow/getFlow.ts
 /**
-* Fetches a flow by its ID
+* Fetches a flow by its ID.
 *
-* @param params GetFlowParams - The parameters for fetching the flow.
+* @example
+* ```ts
+* const flow = await getFlow({ flowId: 'flow-abc123' });
+* console.log('Flow status:', flow.status);
+* ```
+*
+* @param params.flowId - The unique identifier of the flow to fetch.
 * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
-* @returns The flow
+* @returns A promise that resolves to the flow object.
+* @see cancelFlow
+* @see getFlowQuote
 * @notInstrumented
 */
 const getFlow = async ({ flowId }, client = getDefaultClient()) => {
@@ -3334,11 +3823,24 @@ const getFlow = async ({ flowId }, client = getDefaultClient()) => {
 //#endregion
 //#region src/modules/flow/getFlowQuote/getFlowQuote.ts
 /**
-* Fetches a quote for a flow
+* Fetches a quote for a flow.
+*
+* @example
+* ```ts
+* const flow = await getFlowQuote({
+*   flowId: 'flow-abc123',
+*   slippage: 0.5,
+* });
+* ```
 *
-* @param params GetFlowQuoteParams - The quote parameters.
+* @param params.flowId - The unique identifier of the flow.
+* @param [params.fromChainId] - Optional chain ID overriding the one set at attachFlowSource time.
+* @param [params.fromTokenAddress] - Optional token address (defaults to native token).
+* @param [params.slippage] - Acceptable slippage percentage.
 * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
-* @returns The updated flow with quote data
+* @returns A promise that resolves to the updated flow with quote data.
+* @see getFlow
+* @see cancelFlow
 * @notInstrumented
 */
 const getFlowQuote = async ({ flowId, fromChainId, fromTokenAddress, slippage }, client = getDefaultClient()) => {
@@ -3358,6 +3860,22 @@ const getFlowQuote = async ({ flowId, fromChainId, fromTokenAddress, slippage },
 	}, client);
 };
 
+//#endregion
+//#region src/modules/flow/prepareFlowSigning/prepareFlowSigning.instrumentation.ts
+/**
+* Explicit instrumentation payload for prepareFlowSigning. Logs non-sensitive
+* volume and routing dimensions only — never the wallet address or any
+* session token.
+*/
+const prepareFlowSigningInstrumentation = { resolved: (flow) => ({
+	amount: flow.amount ?? null,
+	currency: flow.currency ?? null,
+	fromChainId: flow.fromChainId ?? null,
+	fromChainName: flow.fromChainName ?? null,
+	mode: flow.mode ?? null,
+	sourceType: flow.sourceType ?? null
+}) };
+
 //#endregion
 //#region src/modules/flow/prepareFlowSigning/prepareFlowSigning.ts
 /**
@@ -3395,9 +3913,26 @@ const __prepareFlowSigning_wrapped = instrumentFunction({
 		} catch {
 			return;
 		}
-	}
+	},
+	selectors: prepareFlowSigningInstrumentation
 });
 
+//#endregion
+//#region src/modules/flow/submitFlowTransaction/submitFlowTransaction.instrumentation.ts
+/**
+* Explicit instrumentation payload for submitFlowTransaction. Logs
+* non-sensitive volume and routing dimensions only — never the wallet address
+* or any session token — so executed flow volume is measurable.
+*/
+const submitFlowTransactionInstrumentation = { resolved: (flow) => ({
+	amount: flow.amount ?? null,
+	currency: flow.currency ?? null,
+	fromChainId: flow.fromChainId ?? null,
+	fromChainName: flow.fromChainName ?? null,
+	mode: flow.mode ?? null,
+	sourceType: flow.sourceType ?? null
+}) };
+
 //#endregion
 //#region src/modules/flow/submitFlowTransaction/submitFlowTransaction.ts
 /**
@@ -3441,7 +3976,8 @@ const __submitFlowTransaction_wrapped = instrumentFunction({
 		} catch {
 			return;
 		}
-	}
+	},
+	selectors: submitFlowTransactionInstrumentation
 });
 
 //#endregion
@@ -3673,18 +4209,6 @@ const createKrakenExchangeTransfer = async (transferParams, client = getDefaultC
 		exchangeKey: ExchangeKeyEnum.Kraken
 	});
 };
-const __createKrakenExchangeTransfer_impl = createKrakenExchangeTransfer;
-const __createKrakenExchangeTransfer_wrapped = instrumentFunction({
-	fn: __createKrakenExchangeTransfer_impl,
-	functionName: "createKrakenExchangeTransfer",
-	getCore: () => {
-		try {
-			return getCore(getDefaultClient());
-		} catch {
-			return;
-		}
-	}
-});
 
 //#endregion
 //#region src/modules/funding/kraken/getKrakenAccounts/getKrakenAccounts.ts
@@ -3796,10 +4320,6 @@ var MoonPayProviderNotAvailableError = class extends BaseError {
 * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
 * @returns The signed MoonPay URL.
 * @instrumented
-* @redact-params - the return is a bare signed onramp URL whose query string
-* carries the provider signature plus the user's wallet address; a bare-string
-* return is logged under the synthetic `result` key, which no key-based rule
-* covers, so redact the whole event.
 */
 const getMoonPayUrl = async (params, client = getDefaultClient()) => {
 	const core = getCore(client);
@@ -3833,8 +4353,7 @@ const __getMoonPayUrl_wrapped = instrumentFunction({
 		} catch {
 			return;
 		}
-	},
-	redactAll: true
+	}
 });
 
 //#endregion
@@ -3843,7 +4362,17 @@ const __getMoonPayUrl_wrapped = instrumentFunction({
 * Allows waiting until all modules of the client have been properly initialized
 * and are ready for use.
 *
-* @returns a promise that resolves once the client is fully initialized.
+* @example
+* ```ts
+* const client = createDynamicClient({ environmentId: 'env-id' });
+* await waitForClientInitialized(client);
+* // Client is now fully ready
+* ```
+*
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns A promise that resolves once the client is fully initialized.
+* @see initializeClient
+* @see createDynamicClient
 * @notInstrumented
 * @noHook Client lifecycle management is not exposed as a hook; use useInitStatus.
 */
@@ -4418,7 +4947,6 @@ const getWalletConnectCatalogWalletByWalletProviderKey = async ({ walletProvider
 * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
 * @returns A promise that resolves to OTP verification details if verification is required, or undefined.
 * @instrumented
-* @redact-params
 */
 const updateUser = async ({ userFields }, client = getDefaultClient()) => {
 	const core = getCore(client);
@@ -4448,8 +4976,7 @@ const __updateUser_wrapped = instrumentFunction({
 		} catch {
 			return;
 		}
-	},
-	redactAll: true
+	}
 });
 
 //#endregion
@@ -4663,7 +5190,6 @@ const authenticateTotpMfaDevice = async ({ deviceId, code, createMfaTokenOptions
 * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
 * @returns A promise that resolves to the newly generated recovery codes.
 * @instrumented
-* @redact-params
 */
 const createNewMfaRecoveryCodes = async (client = getDefaultClient()) => {
 	const core = getCore(client);
@@ -4679,8 +5205,7 @@ const __createNewMfaRecoveryCodes_wrapped = instrumentFunction({
 		} catch {
 			return;
 		}
-	},
-	redactAll: true
+	}
 });
 
 //#endregion
@@ -4774,9 +5299,6 @@ const getMfaRecoveryCodes = async (client = getDefaultClient()) => {
 * @returns A promise that resolves to the TOTP registration response containing setup information,
 * like the secret key and the OTP Auth URI.
 * @instrumented
-* @redact-params - the response embeds the TOTP shared secret in both `secret`
-* and the `uri` (`otpauth://...?secret=...`); redact the whole event so the
-* seed never reaches logs via the un-keyed `uri` field.
 */
 const registerTotpMfaDevice = async (client = getDefaultClient()) => {
 	const core = getCore(client);
@@ -4792,8 +5314,7 @@ const __registerTotpMfaDevice_wrapped = instrumentFunction({
 		} catch {
 			return;
 		}
-	},
-	redactAll: true
+	}
 });
 
 //#endregion
@@ -4838,11 +5359,24 @@ const __setDefaultMfaDevice_wrapped = instrumentFunction({
 *
 * Once you have the OTP code, you should then use `verifyOTP` to verify it and complete the authentication process.
 *
+* @example
+* ```ts
+* const { verificationUUID } = await sendEmailOTP({
+*   email: 'user@example.com',
+* });
+* // Then verify with the code the user received
+* await verifyOTP({
+*   otpVerification: { email: 'user@example.com', verificationUUID },
+*   verificationToken: '123456',
+* });
+* ```
+*
 * @param params.email - The email address to send the OTP to.
 * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
 * @returns A promise that resolves to an OTPVerification object containing the email and verification UUID.
+* @see verifyOTP
+* @see sendSmsOTP
 * @instrumented
-* @redact-params
 */
 const sendEmailOTP = async ({ email }, client = getDefaultClient()) => {
 	const core = getCore(client);
@@ -4870,8 +5404,7 @@ const __sendEmailOTP_wrapped = instrumentFunction({
 		} catch {
 			return;
 		}
-	},
-	redactAll: true
+	}
 });
 
 //#endregion
@@ -5800,12 +6333,23 @@ const supportedCountries = {
 /**
 * Sends a one-time password (OTP) via SMS to the specified phone number.
 *
+* @example
+* ```ts
+* const { verificationUUID } = await sendSmsOTP({
+*   isoCountryCode: 'US',
+*   phoneNumber: '5551234567',
+* });
+* // Then verify with the code the user received
+* await verifyOTP({ otpVerification: { phoneNumber: '5551234567', verificationUUID }, verificationToken: '123456' });
+* ```
+*
 * @param params.isoCountryCode - The ISO country code for the phone number (e.g., 'US', 'CA', 'GB').
 * @param params.phoneNumber - The phone number to send the OTP to.
 * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
 * @returns A promise that resolves to an OTPVerification object containing the phone details and verification UUID.
+* @see verifyOTP
+* @see sendEmailOTP
 * @instrumented
-* @redact-params
 */
 const sendSmsOTP = async ({ isoCountryCode, phoneNumber }, client = getDefaultClient()) => {
 	const core = getCore(client);
@@ -5838,17 +6382,17 @@ const __sendSmsOTP_wrapped = instrumentFunction({
 		} catch {
 			return;
 		}
-	},
-	redactAll: true
+	}
 });
 
 //#endregion
 //#region src/modules/otp/verifyOTP/verifyOTPForUserSignIn/verifyOTPForUserSignIn.ts
 /** @notInstrumented */
-const verifyOTPForUserSignIn = async ({ otpVerification, verificationToken }, client) => {
+const verifyOTPForUserSignIn = async ({ allowNewMFALinking, otpVerification, verificationToken }, client) => {
 	const core = getCore(client);
 	const apiClient = createApiClient({}, client);
 	const verifyRequest = {
+		...allowNewMFALinking !== void 0 && { allowNewMFALinking },
 		verificationToken,
 		verificationUUID: otpVerification.verificationUUID
 	};
@@ -5891,14 +6435,26 @@ const verifyOTPForUserUpdate = async ({ otpVerification, verificationToken, requ
 * This function validates the OTP code provided by the user and completes
 * the verification process for either sign-in or account updates.
 *
+* @example
+* ```ts
+* const { verificationUUID } = await sendEmailOTP({ email: 'user@example.com' });
+* const response = await verifyOTP({
+*   otpVerification: { email: 'user@example.com', verificationUUID },
+*   verificationToken: '123456',
+* });
+* ```
+*
+* @param [params.allowNewMFALinking] - Whether sign-in may return a credential-link elevated token for users without MFA.
 * @param params.otpVerification - The OTP verification object containing verification details.
 * @param params.verificationToken - The token received from the OTP verification process.
+* @param [params.requestedScopes] - Optional token scopes to request during verification.
 * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
 * @returns A promise that resolves to the verify response object upon successful verification.
+* @see sendEmailOTP
+* @see sendSmsOTP
 * @instrumented
-* @redact-params
 */
-const verifyOTP = async ({ otpVerification, verificationToken, requestedScopes }, client = getDefaultClient()) => {
+const verifyOTP = async ({ allowNewMFALinking, otpVerification, requestedScopes, verificationToken }, client = getDefaultClient()) => {
 	preconnectWaasIframe(client);
 	let response;
 	if (client.user) response = await verifyOTPForUserUpdate({
@@ -5907,6 +6463,7 @@ const verifyOTP = async ({ otpVerification, verificationToken, requestedScopes }
 		verificationToken
 	}, client);
 	else response = await verifyOTPForUserSignIn({
+		allowNewMFALinking,
 		otpVerification,
 		verificationToken
 	}, client);
@@ -5923,8 +6480,7 @@ const __verifyOTP_wrapped = instrumentFunction({
 		} catch {
 			return;
 		}
-	},
-	redactAll: true
+	}
 });
 
 //#endregion
@@ -6006,6 +6562,33 @@ const getSwapStatus = async (params, client = getDefaultClient()) => {
 	}
 };
 
+//#endregion
+//#region src/modules/user/checkUserScopes/checkUserScopes.ts
+/**
+* Checks whether the given user has all the specified scopes.
+*
+* The user's `scope` field is a whitespace-separated string of granted
+* permissions (per RFC 8693 §4.2). This helper splits it and verifies that
+* every entry in `scopes` is present.
+*
+* @example
+* const user = getDefaultClient().user;
+* if (user && checkUserScopes({ user, scopes: ['wallets:read'] })) {
+*   showWalletBalances();
+* }
+*
+* @param params.user - The authenticated user to check.
+* @param params.scopes - The scope strings the user must have.
+* @returns `true` if the user has every scope in `scopes`, `false` otherwise.
+* @see User
+* @see updateUser
+* @notInstrumented
+*/
+const checkUserScopes = ({ scopes, user }) => {
+	const grantedScopes = user.scope?.split(/\s+/).filter(Boolean) ?? [];
+	return scopes.every((requiredScope) => grantedScopes.includes(requiredScope));
+};
+
 //#endregion
 //#region src/modules/user/deleteUser/deleteUser.ts
 /**
@@ -6014,8 +6597,16 @@ const getSwapStatus = async (params, client = getDefaultClient()) => {
 * This function performs a hard delete of the user account. Upon successful deletion,
 * the user will be automatically logged out and all authentication data will be cleared.
 *
+* @example
+* ```ts
+* // Permanently delete the user's account
+* await deleteUser();
+* ```
+*
 * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
 * @returns A promise that resolves when the user account is successfully deleted.
+* @see logout
+* @see refreshUser
 * @instrumented
 */
 const deleteUser = async (client = getDefaultClient()) => {
@@ -7349,8 +7940,14 @@ const getAddressesWithTypesFromConnectionResult = (connectionResult) => {
 *
 * Note: This function will not verify the wallet account, use the verifyWalletAccount function to do that
 * or connectAndVerifyWithWalletProvider to do that in a single step.
-* @see verifyWalletAccount
-* @see connectAndVerifyWithWalletProvider
+*
+* @example
+* ```ts
+* const walletAccount = await connectWithWalletProvider({
+*   walletProviderKey: 'metamaskevm',
+* });
+* console.log(walletAccount.address);
+* ```
 *
 * @param params.walletProviderKey - The unique key identifying the wallet provider to connect to (e.g. 'metamaskevm', 'phantomsol').
 * @param [params.addToDynamicWalletAccounts] - Whether to add the connected wallet account to the user's wallet accounts. Defaults to true.
@@ -7358,7 +7955,9 @@ const getAddressesWithTypesFromConnectionResult = (connectionResult) => {
 * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
 * @returns A promise that resolves to the connected wallet account.
 * @throws NoAddressFoundError If the request to connect was successful but no address is connected to your app.
-*  @instrumented
+* @see verifyWalletAccount
+* @see connectAndVerifyWithWalletProvider
+* @instrumented
 */
 const connectWithWalletProvider = async ({ walletProviderKey, addToDynamicWalletAccounts = true, hardwareWalletVendor }, client = getDefaultClient()) => {
 	const walletProvider = getWalletProviderByKey({ walletProviderKey }, client);
@@ -7495,9 +8094,19 @@ const getSignInMessage = async ({ nonce: nonceOverride, walletAccount }, client)
 * This function generates a sign-in message and requires the user to sign it
 * with their wallet's private key, proving they control the wallet address.
 *
+* @example
+* ```ts
+* const { messageToSign, signature } = await proveWalletAccountOwnership({
+*   walletAccount: wallets[0],
+* });
+* // Send signature to your backend for verification
+* ```
+*
 * @param params.walletAccount - The wallet account to prove ownership of.
 * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
 * @returns A promise that resolves to an object containing the message and signature.
+* @see signMessage
+* @see verifyWalletAccount
 * @instrumented
 */
 const proveWalletAccountOwnership = async ({ walletAccount }, client = getDefaultClient()) => {
@@ -7601,11 +8210,22 @@ const verifyWalletAccountForSignInOrTransfer = async ({ walletAccount, isTransfe
 * This function requires the user to sign a message to prove wallet ownership,
 * then sets the wallet account as verified.
 *
+* @example
+* ```ts
+* const walletAccount = await connectWithWalletProvider({
+*   walletProviderKey: 'metamaskevm',
+* });
+* const verified = await verifyWalletAccount({ walletAccount });
+* ```
+*
 * @param params.walletAccount - The wallet account to verify ownership of.
+* @param [params.requestedScopes] - Optional token scopes to request during verification.
 * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
 * @returns A promise that resolves to the verified wallet account.
 * @throws WalletAccountAlreadyVerifiedError If the wallet is already verified.
 * @throws WalletAlreadyLinkedToAnotherUserError If the wallet is linked to another user.
+* @see connectWithWalletProvider
+* @see connectAndVerifyWithWalletProvider
 * @instrumented
 */
 const verifyWalletAccount = async ({ walletAccount, requestedScopes }, client = getDefaultClient()) => {
@@ -7655,10 +8275,20 @@ const isDeeplinkWalletProvider = ({ walletProvider }) => walletProvider.walletPr
 * `verifyWalletAccount` separately from a new user gesture (e.g. a "Verify
 * Ownership" button).
 *
+* @example
+* ```ts
+* const walletAccount = await connectAndVerifyWithWalletProvider({
+*   walletProviderKey: 'metamaskevm',
+* });
+* console.log('Verified address:', walletAccount.address);
+* ```
+*
 * @param params.walletProviderKey - The unique key identifying the wallet provider to connect to.
 * @param [params.hardwareWalletVendor] - The hardware wallet vendor, if connecting via a hardware wallet (e.g. 'ledger').
 * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
 * @returns A promise that resolves to the connected and verified wallet account.
+* @see connectWithWalletProvider
+* @see verifyWalletAccount
 * @instrumented
 */
 const connectAndVerifyWithWalletProvider = async ({ walletProviderKey, hardwareWalletVendor }, client = getDefaultClient()) => {
@@ -7720,9 +8350,17 @@ const getAvailableWalletProvidersData = (client = getDefaultClient()) => {
 * This function returns the list of wallet addresses that are currently
 * connected and available through the specified wallet provider.
 *
+* @example
+* ```ts
+* const addresses = getConnectedAddresses({ walletProviderKey: 'metamaskevm' });
+* console.log('Connected:', addresses);
+* ```
+*
 * @param params.walletProviderKey - The unique key of the wallet provider to query.
 * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
 * @returns An array of connected wallet addresses.
+* @see connectWithWalletProvider
+* @see getWalletAccounts
 * @notInstrumented
 */
 const getConnectedAddresses = ({ walletProviderKey }, client = getDefaultClient()) => {
@@ -7754,6 +8392,7 @@ const getWalletAccountAddressByType = ({ type, walletAccount }) => {
 * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
 * @returns The data for the wallet provider.
 * @notInstrumented
+* @hook Exposed as a hook so consumers get reactive wallet provider data, updated when the wallet provider registry changes.
 */
 const getWalletProviderDataByKey = ({ walletProviderKey }, client = getDefaultClient()) => {
 	const { chain, groupKey, key, metadata, walletProviderType } = getWalletProviderByKey({ walletProviderKey }, client);
@@ -7802,8 +8441,17 @@ const isHardwareWalletAccount = ({ walletAccount }) => walletAccount.hardwareWal
 * else your app considers "signed in" (e.g. `client.user`, completed onboarding,
 * a required embedded wallet, …).
 *
+* @example
+* ```ts
+* if (isAnyWalletAccountConnected()) {
+*   console.log('At least one wallet is connected');
+* }
+* ```
+*
 * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
 * @returns True if the session has at least one wallet account, false otherwise.
+* @see getWalletAccounts
+* @see isWalletAccountVerified
 * @notInstrumented
 */
 const isAnyWalletAccountConnected = (client = getDefaultClient()) => getWalletAccounts(client).length > 0;
@@ -7813,8 +8461,16 @@ const isAnyWalletAccountConnected = (client = getDefaultClient()) => getWalletAc
 /**
 * Checks if a wallet account has been verified by a user.
 *
-* @param walletAccount - The wallet account to check.
+* @example
+* ```ts
+* const wallets = getWalletAccounts();
+* const verified = wallets.filter(w => isWalletAccountVerified({ walletAccount: w }));
+* ```
+*
+* @param params.walletAccount - The wallet account to check.
 * @returns True if the wallet account has been verified, false otherwise.
+* @see verifyWalletAccount
+* @see getWalletAccounts
 * @notInstrumented
 */
 const isWalletAccountVerified = ({ walletAccount }) => {
@@ -7904,9 +8560,17 @@ const getActiveNetworkId = ({ walletAccount }, client = getDefaultClient()) => {
 * {@link getTokenBalances}; for a multi-chain portfolio snapshot, use
 * {@link getMultichainTokenBalances}.
 *
+* @example
+* ```ts
+* const { balance } = await getNativeBalance({ walletAccount: wallets[0] });
+* console.log('Native balance:', balance);
+* ```
+*
 * @param params.walletAccount - The wallet account to get the balance for.
 * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
 * @returns A promise that resolves to an object containing the balance as a string or null.
+* @see getMultichainTokenBalances
+* @see switchActiveNetwork
 * @notInstrumented
 */
 const getNativeBalance = async ({ walletAccount }, client = getDefaultClient()) => {
@@ -7926,6 +8590,14 @@ const getNativeBalance = async ({ walletAccount }, client = getDefaultClient())
 * with the token-balance fetchers (`getTokenBalances` /
 * `getMultichainTokenBalances`).
 *
+* @example
+* ```ts
+* // Prefer getNativeBalance instead
+* const balance = await getNativeBalance({ walletAccount });
+* ```
+*
+* @see getNativeBalance
+* @see getMultichainBalances
 * @notInstrumented
 * @noHook Deprecated; the replacement is exposed via its own hook.
 */
@@ -8011,11 +8683,21 @@ const isProgrammaticNetworkSwitchAvailable = ({ walletAccount }, client = getDef
 * This function programmatically changes the network
 * that the wallet is currently connected to.
 *
+* @example
+* ```ts
+* await switchActiveNetwork({
+*   walletAccount: wallets[0],
+*   networkId: '137', // Polygon
+* });
+* ```
+*
 * @param params.networkId - The identifier of the network to switch to. Should match the networkId of the network data.
 * @param params.walletAccount - The wallet account to switch networks for.
 * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
 * @returns A promise that resolves when the network switch is complete.
 * @throws NetworkSwitchingUnavailableError If the wallet provider doesn't support network switching.
+* @see getNativeBalance
+* @see isProgrammaticNetworkSwitchAvailable
 * @instrumented
 */
 const switchActiveNetwork = async ({ networkId, walletAccount }, client = getDefaultClient()) => {
@@ -8041,15 +8723,37 @@ const __switchActiveNetwork_wrapped = instrumentFunction({
 });
 
 //#endregion
-//#region src/modules/wallets/primaryWalletAccount/selectPrimaryWalletAccount/selectPrimaryWalletAccount.ts
+//#region src/modules/wallets/selectedWalletAccount/setSelectedWalletAccount/setSelectedWalletAccount.ts
 /**
-* Make the wallet account provided as the primary wallet account.
+* Set the wallet account that is currently selected for the user.
+*
+* The SDK itself does not use or care about which wallet is "selected" — this
+* only records the selection (updating the backend `lastSelectedAt` and, for
+* verified wallets, persisting it server-side) so it can later be read back via
+* `getSelectedWalletAccount`. It has no bearing on authentication or signing.
+* Applications that need a notion of an active/current wallet should own that
+* selection state themselves.
+*
+* The one exception is the wagmi integration (`@dynamic-labs-sdk/wagmi`), which
+* relies on the selected EVM wallet.
+*
+* @example
+* ```ts
+* const wallets = getWalletAccounts();
+* await setSelectedWalletAccount({ walletAccount: wallets[1] });
+* ```
+*
+* @param params.walletAccount - The wallet account to mark as selected.
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns A promise that resolves when the selection is persisted.
+* @see getSelectedWalletAccount
+* @see getWalletAccounts
 * @instrumented
-* @noHook The primary-wallet concept is discouraged and not exposed as a hook.
+* @noHook The selected-wallet concept is not exposed as a hook.
 */
-const selectPrimaryWalletAccount = async ({ walletAccount }, client = getDefaultClient()) => {
+const setSelectedWalletAccount = async ({ walletAccount }, client = getDefaultClient()) => {
 	const core = getCore(client);
-	if (getPrimaryWalletAccount(client)?.id === walletAccount.id) return;
+	if (getSelectedWalletAccount(client)?.id === walletAccount.id) return;
 	if (walletAccount.verifiedCredentialId) updateAuthFromVerifyResponse({ response: await createApiClient({}, client).selectUserWallet({
 		environmentId: core.environmentId,
 		userWalletSelectionRequest: { walletId: walletAccount.verifiedCredentialId }
@@ -8059,6 +8763,68 @@ const selectPrimaryWalletAccount = async ({ walletAccount }, client = getDefault
 		lastSelectedAt: /* @__PURE__ */ new Date()
 	}] }, client);
 };
+const __setSelectedWalletAccount_impl = setSelectedWalletAccount;
+const __setSelectedWalletAccount_wrapped = instrumentFunction({
+	fn: __setSelectedWalletAccount_impl,
+	functionName: "setSelectedWalletAccount",
+	getCore: () => {
+		try {
+			return getCore(getDefaultClient());
+		} catch {
+			return;
+		}
+	}
+});
+
+//#endregion
+//#region src/modules/wallets/selectedWalletAccount/getPrimaryWalletAccount/getPrimaryWalletAccount.ts
+/**
+* Get the primary wallet account.
+*
+* @deprecated Renamed to `getSelectedWalletAccount`. The "primary wallet" naming was
+* misleading — the SDK does not use or care about which wallet is selected; it
+* only lets you *read* the user's most recently selected wallet. Migrate to
+* `getSelectedWalletAccount`, and own your own wallet-selection state in your
+* application rather than relying on the SDK's selected wallet.
+*
+* @example
+* ```ts
+* const primary = getPrimaryWalletAccount();
+* if (primary) {
+*   console.log('Primary wallet:', primary.address);
+* }
+* ```
+*
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns The primary wallet account, or null if no wallet has been selected.
+* @notInstrumented
+*/
+const getPrimaryWalletAccount = (client = getDefaultClient()) => getSelectedWalletAccount(client);
+
+//#endregion
+//#region src/modules/wallets/selectedWalletAccount/selectPrimaryWalletAccount/selectPrimaryWalletAccount.ts
+/**
+* Make the wallet account provided as the primary wallet account.
+*
+* @deprecated Renamed to `setSelectedWalletAccount`. The "primary wallet" naming was
+* misleading — the SDK does not use or care about which wallet is selected;
+* this only records the selection so it can later be read back. Migrate to
+* `setSelectedWalletAccount`, and own your own wallet-selection state in your
+* application rather than relying on the SDK's selected wallet.
+*
+* @example
+* ```ts
+* const wallets = getWalletAccounts();
+* await selectPrimaryWalletAccount({ walletAccount: wallets[1] });
+* ```
+*
+* @param params.walletAccount - The wallet account to set as primary.
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns A promise that resolves when the selection is persisted.
+* @instrumented
+* @noHook The selected-wallet concept is not exposed as a hook.
+*/
+const selectPrimaryWalletAccount = async ({ walletAccount }, client = getDefaultClient()) => __setSelectedWalletAccount_wrapped({ walletAccount }, client);
 const __selectPrimaryWalletAccount_impl = selectPrimaryWalletAccount;
 const __selectPrimaryWalletAccount_wrapped = instrumentFunction({
 	fn: __selectPrimaryWalletAccount_impl,
@@ -8075,10 +8841,23 @@ const __selectPrimaryWalletAccount_wrapped = instrumentFunction({
 //#endregion
 //#region src/modules/wallets/disconnectWalletAccount/disconnectWalletAccount.ts
 /**
-* This function disconnects the specified wallet account with the wallet provider.
+* Disconnects the specified wallet account from its wallet provider.
 *
-* The wallet account is not removed from the user's profile or from dynamic's state,
+* The wallet account is not removed from the user's profile or from Dynamic's state,
 * it is only responsible for terminating the connection with the wallet provider.
+* Use `removeWalletAccount` to fully remove a wallet from the user's session.
+*
+* @example
+* ```ts
+* const wallets = getWalletAccounts();
+* await disconnectWalletAccount({ walletAccount: wallets[0] }, client);
+* ```
+*
+* @param params.walletAccount - The wallet account to disconnect.
+* @param client - The Dynamic client instance.
+* @returns A promise that resolves when the wallet is disconnected from the provider.
+* @see removeWalletAccount
+* @see connectWithWalletProvider
 * @notInstrumented
 */
 const disconnectWalletAccount = async ({ walletAccount }, client) => {
@@ -8099,9 +8878,17 @@ const disconnectWalletAccount = async ({ walletAccount }, client) => {
 * updating local state and server records (if there is an authenticated user).
 * For verified wallets, it will unlink them from the user's account.
 *
+* @example
+* ```ts
+* const wallets = getWalletAccounts();
+* await removeWalletAccount({ walletAccount: wallets[0] });
+* ```
+*
 * @param params.walletAccount - The wallet account to remove.
 * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
 * @returns A promise that resolves when the wallet account is successfully removed.
+* @see getWalletAccounts
+* @see disconnectWalletAccount
 * @instrumented
 */
 const removeWalletAccount = async ({ walletAccount }, client = getDefaultClient()) => {
@@ -8138,10 +8925,21 @@ const __removeWalletAccount_wrapped = instrumentFunction({
 * This function uses the wallet's private key to cryptographically sign
 * the provided message.
 *
+* @example
+* ```ts
+* const wallets = getWalletAccounts();
+* const { signature } = await signMessage({
+*   walletAccount: wallets[0],
+*   message: 'Hello Dynamic!',
+* });
+* ```
+*
 * @param params.walletAccount - The wallet account to use for signing.
 * @param params.message - The message to sign.
 * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
 * @returns A promise that resolves to an object containing the signature.
+* @see getWalletAccounts
+* @see connectWithWalletProvider
 * @instrumented
 */
 const signMessage = async ({ walletAccount, message }, client = getDefaultClient()) => {
@@ -8174,13 +8972,24 @@ const __signMessage_wrapped = instrumentFunction({
 * Supports native token transfers and, where supported by the chain,
 * fungible/token transfers via the optional `token` parameter.
 *
+* @example
+* ```ts
+* const { transactionHash } = await transferAmount({
+*   walletAccount: wallets[0],
+*   amount: '0.1',
+*   recipient: '0x1234...abcd',
+* });
+* ```
+*
 * @param params.walletAccount - The wallet account to transfer from.
 * @param params.amount - The amount to transfer as a decimal string (e.g. "1.5").
 * @param params.recipient - The recipient address.
-* @param params.token - Optional token info for non-native transfers.
+* @param [params.token] - Optional token info for non-native transfers.
 * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
 * @returns A promise that resolves to an object containing the transaction hash.
 * @throws If the wallet provider does not support the transfer amount method.
+* @see getWalletAccounts
+* @see signMessage
 * @instrumented
 */
 const transferAmount = async ({ walletAccount, amount, recipient, token }, client = getDefaultClient()) => {
@@ -8215,9 +9024,18 @@ const __transferAmount_wrapped = instrumentFunction({
 * This function requires the user to sign a message to prove wallet ownership,
 * then transfers the wallet account to the current user's account.
 *
+* @example
+* ```ts
+* const walletAccount = await transferWalletAccount({
+*   walletProviderKey: 'metamaskevm',
+* });
+* ```
+*
 * @param params.walletProviderKey - The key of the wallet provider of the wallet account to transfer.
 * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
 * @returns A promise that resolves to the transferred wallet account.
+* @see connectWithWalletProvider
+* @see verifyWalletAccount
 * @instrumented
 */
 const transferWalletAccount = async ({ walletProviderKey }, client = getDefaultClient()) => {
@@ -8250,10 +9068,20 @@ const __transferWalletAccount_wrapped = instrumentFunction({
 * This function searches through the current session's wallet accounts
 * to find one matching the specified address and chain.
 *
+* @example
+* ```ts
+* const account = getWalletAccountFromAddress({
+*   address: '0x1234...abcd',
+*   chain: 'EVM',
+* });
+* ```
+*
 * @param params.address - The wallet address to search for.
 * @param params.chain - The blockchain the wallet belongs to.
 * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
 * @returns The matching wallet account, or undefined if not found.
+* @see getWalletAccounts
+* @see isWalletAccountVerified
 * @notInstrumented
 */
 const getWalletAccountFromAddress = ({ address, chain }, client = getDefaultClient()) => {
@@ -8412,5 +9240,5 @@ const parseUserAgent = ({ userAgent }) => {
 assertPackageVersion(name, version);
 
 //#endregion
-export { BaseError, CheckoutSessionTokenMissingError, ClientAlreadyInitializedError, DeeplinkConnectAndVerifyUnsupportedError, FeeEstimationFailedError, FlowSessionTokenMissingError, GOOGLE_DRIVE_BACKUP_REQUIRED_SCOPES, InvalidDeviceRegistrationRedirectError, InvalidExternalAuthError, InvalidParamError, InvalidRedirectStorageStateError, InvalidSocialCallbackOriginError, JwtVerifiedCredentialFormatEnum, LinkCredentialError, MFAAction, MfaInvalidOtpError, MfaRateLimitedError, MissingRedirectStorageStateError, MissingSocialUrlParamError, MissingUserVerificationError, NetworkAddingUnavailableError, NetworkNotAddedError, NetworkSwitchingUnavailableError, NoAddressFoundError, NoNetworkProvidersError, NoPasskeyCredentialsFoundError, NoSmartWalletAccountSignerFoundError, NoWebAuthNSupportError, NotWaasWalletAccountError, ProviderEnum, SandboxMaximumThresholdReachedError, SimulationFailedError, TokenScope, TokenSwapError, UnauthorizedError, UnavailableInServerSideError, UnrecognizedNetworkError, UserCancelledSocialPopUpError, UserNotAuthenticatedError, UserRejectedError, WaasOnboardingIncompleteError, WalletAccountAlreadyVerifiedError, WalletAccountNotSelectedError, WalletAlreadyLinkedToAnotherUserError, WalletProviderMethodUnavailableError, __acknowledgeRecoveryCodes_wrapped as acknowledgeRecoveryCodes, addCoinbaseOnrampOrderEventListener, __addNetwork_wrapped as addNetwork, appendConnectionUriToDeeplink, assertWalletAccountSigningAvailability, assertWalletProviderMethodDefined, __attachCheckoutTransactionSource_wrapped as attachCheckoutTransactionSource, __attachFlowSource_wrapped as attachFlowSource, authenticateMfaRecoveryCode, authenticatePasskeyMFA, authenticateTotpMfaDevice, __authenticateWithSocial_wrapped as authenticateWithSocial, __broadcastCheckoutTransaction_wrapped as broadcastCheckoutTransaction, __broadcastFlow_wrapped as broadcastFlow, canConnectWithHardwareWallet, __cancelCheckoutTransaction_wrapped as cancelCheckoutTransaction, __cancelFlow_wrapped as cancelFlow, __checkStepUpAuth_wrapped as checkStepUpAuth, __completeDeviceRegistration_wrapped as completeDeviceRegistration, __completeSocialAuthentication_wrapped as completeSocialAuthentication, __completeSocialRedirect_wrapped as completeSocialRedirect, __confirmTransaction_wrapped as confirmTransaction, __connectAndVerifyWithWalletProvider_wrapped as connectAndVerifyWithWalletProvider, __connectWithWalletProvider_wrapped as connectWithWalletProvider, __consumeMfaToken_wrapped as consumeMfaToken, __createCheckoutTransaction_wrapped as createCheckoutTransaction, __createCoinbaseOnrampOrder_wrapped as createCoinbaseOnrampOrder, __createCryptoDotComPayment_wrapped as createCryptoDotComPayment, __createDynamicClient_wrapped as createDynamicClient, __createKrakenExchangeTransfer_wrapped as createKrakenExchangeTransfer, __createNewMfaRecoveryCodes_wrapped as createNewMfaRecoveryCodes, __deleteMfaDevice_wrapped as deleteMfaDevice, __deletePasskey_wrapped as deletePasskey, __deleteUser_wrapped as deleteUser, detectDeviceRegistrationRedirect, detectOAuthRedirect, detectSocialRedirectUrl, excludeInstalledFromCatalog, __executeSwapTransaction_wrapped as executeSwapTransaction, fetchProjectSettings, findMissingGoogleDriveBackupScopes, getActiveNetworkData, getActiveNetworkId, getAvailableWalletProvidersData, getBalance, getBalanceForAddress, getBalances, getCheckoutTransaction, getCheckoutTransactionQuote, getCoinbaseBuyUrl, getConnectedAddresses, getDefaultClient, getDeviceRegistrationTokenFromUrl, getElevatedAccessToken, getFlow, getFlowQuote, __getGoogleDriveBackupReadiness_wrapped as getGoogleDriveBackupReadiness, getInstallationLinkForCurrentPlatform, getKrakenAccounts, getKrakenWhitelistedAddresses, getMfaDevices, getMfaMethods, getMfaRecoveryCodes, getMissingVerificationForCoinbaseOnrampOrder, __getMoonPayCurrencies_wrapped as getMoonPayCurrencies, __getMoonPayUrl_wrapped as getMoonPayUrl, getMultichainBalances, getMultichainTokenBalances, getNativeBalance, getNetworksData, getOwnerWalletAccountForSmartWalletAccount, getPasskeys, getPrimaryWalletAccount, getRegisteredDevices, getSwapQuote, getSwapStatus, getTokenBalances, getTransactionHistory, getUserSocialAccounts, getWalletAccountAddressByType, getWalletAccountFromAddress, getWalletAccounts, getWalletConnectCatalog, getWalletConnectCatalogWalletByWalletProviderKey, getWalletOptionsCatalogue, getWalletProviderDataByKey, hasAllGoogleDriveBackupScopes, hasExtension, __initializeClient_wrapped as initializeClient, isAnyWalletAccountConnected, isCaptchaRequired, isDeeplinkWalletProvider, isDeviceRegistrationRequired, isHardwareWalletAccount, isInsufficientGoogleDriveScopesError, isMfaRequiredForAction, isMobile, isPendingRecoveryCodesAcknowledgment, isProgrammaticNetworkSwitchAvailable, isSignedIn, isUserMissingMfaAuth, isUserOnboardingComplete, isWalletAccountVerified, logout, matchWalletProvidersToCatalogGroup, offEvent, offWalletProviderEvent, onEvent, onWalletProviderEvent, onceEvent, parseUserAgent, __prepareCheckoutTransaction_wrapped as prepareCheckoutTransaction, __prepareFlowSigning_wrapped as prepareFlowSigning, __proveWalletAccountOwnership_wrapped as proveWalletAccountOwnership, __refreshAuth_wrapped as refreshAuth, __refreshUser_wrapped as refreshUser, __registerPasskey_wrapped as registerPasskey, __registerTotpMfaDevice_wrapped as registerTotpMfaDevice, __removeWalletAccount_wrapped as removeWalletAccount, __requestExternalAuthElevatedToken_wrapped as requestExternalAuthElevatedToken, requiresConversion, __revokeAllRegisteredDevices_wrapped as revokeAllRegisteredDevices, __revokeRegisteredDevice_wrapped as revokeRegisteredDevice, __selectPrimaryWalletAccount_wrapped as selectPrimaryWalletAccount, __sendEmailOTP_wrapped as sendEmailOTP, __sendSmsOTP_wrapped as sendSmsOTP, __setCaptchaToken_wrapped as setCaptchaToken, __setDefaultMfaDevice_wrapped as setDefaultMfaDevice, __setInstrumentationEnabled_wrapped as setInstrumentationEnabled, __signInWithExternalJwt_wrapped as signInWithExternalJwt, __signInWithPasskey_wrapped as signInWithPasskey, __signInWithSocialPopUp_wrapped as signInWithSocialPopUp, __signInWithSocialRedirect_wrapped as signInWithSocialRedirect, __signMessage_wrapped as signMessage, __submitCheckoutTransaction_wrapped as submitCheckoutTransaction, __submitFlowTransaction_wrapped as submitFlowTransaction, supportedCountries, __switchActiveNetwork_wrapped as switchActiveNetwork, trackCheckoutTransaction, __transferAmount_wrapped as transferAmount, __transferWalletAccount_wrapped as transferWalletAccount, __unlinkSocialAccount_wrapped as unlinkSocialAccount, __updateUser_wrapped as updateUser, __verifyOTP_wrapped as verifyOTP, __verifyWalletAccount_wrapped as verifyWalletAccount, waitForClientInitialized };
+export { BaseError, CaptchaProviderEnum, CheckoutSessionTokenMissingError, ClientAlreadyInitializedError, DeeplinkConnectAndVerifyUnsupportedError, DeviceRegistrationIdentityMismatchError, FeeEstimationFailedError, FlowSessionTokenMissingError, GOOGLE_DRIVE_BACKUP_REQUIRED_SCOPES, InvalidDeviceRegistrationRedirectError, InvalidExternalAuthError, InvalidParamError, InvalidRedirectStorageStateError, InvalidSocialCallbackOriginError, JwtVerifiedCredentialFormatEnum, LinkCredentialError, MFAAction, MergeAccountsConfirmationError, MfaInvalidOtpError, MfaRateLimitedError, MissingRedirectStorageStateError, MissingSocialUrlParamError, MissingUserVerificationError, NetworkAddingUnavailableError, NetworkNotAddedError, NetworkSwitchingUnavailableError, NoAddressFoundError, NoNetworkProvidersError, NoPasskeyCredentialsFoundError, NoSmartWalletAccountSignerFoundError, NoWebAuthNSupportError, NotWaasWalletAccountError, ProviderEnum, SandboxMaximumThresholdReachedError, SimulationFailedError, TokenScope, TokenSwapError, UnauthorizedError, UnavailableInServerSideError, UnrecognizedNetworkError, UserCancelledSocialPopUpError, UserNotAuthenticatedError, UserRejectedError, WaasOnboardingIncompleteError, WalletAccountAlreadyVerifiedError, WalletAccountNotSelectedError, WalletAlreadyLinkedToAnotherUserError, WalletProviderMethodUnavailableError, WalletScreeningBlockedError, __acknowledgeRecoveryCodes_wrapped as acknowledgeRecoveryCodes, addCoinbaseOnrampOrderEventListener, __addNetwork_wrapped as addNetwork, appendConnectionUriToDeeplink, assertWalletAccountSigningAvailability, assertWalletProviderMethodDefined, __attachCheckoutTransactionSource_wrapped as attachCheckoutTransactionSource, __attachFlowSource_wrapped as attachFlowSource, authenticateMfaRecoveryCode, authenticatePasskeyMFA, authenticateTotpMfaDevice, __authenticateWithSocial_wrapped as authenticateWithSocial, __broadcastCheckoutTransaction_wrapped as broadcastCheckoutTransaction, __broadcastFlow_wrapped as broadcastFlow, canConnectWithHardwareWallet, __cancelCheckoutTransaction_wrapped as cancelCheckoutTransaction, __cancelFlow_wrapped as cancelFlow, __checkStepUpAuth_wrapped as checkStepUpAuth, checkUserScopes, clearDeviceRegistrationRedirectParams, clearSocialRedirectParams, __completeDeviceRegistration_wrapped as completeDeviceRegistration, __completeSocialAuthentication_wrapped as completeSocialAuthentication, __completeSocialRedirect_wrapped as completeSocialRedirect, __confirmTransaction_wrapped as confirmTransaction, __connectAndVerifyWithWalletProvider_wrapped as connectAndVerifyWithWalletProvider, __connectWithWalletProvider_wrapped as connectWithWalletProvider, __consumeMfaToken_wrapped as consumeMfaToken, __createCheckoutTransaction_wrapped as createCheckoutTransaction, __createCoinbaseOnrampOrder_wrapped as createCoinbaseOnrampOrder, __createCryptoDotComPayment_wrapped as createCryptoDotComPayment, __createDynamicClient_wrapped as createDynamicClient, createKrakenExchangeTransfer, __createNewMfaRecoveryCodes_wrapped as createNewMfaRecoveryCodes, __deleteMfaDevice_wrapped as deleteMfaDevice, __deletePasskey_wrapped as deletePasskey, __deleteUser_wrapped as deleteUser, detectDeviceRegistrationRedirect, detectOAuthRedirect, detectSocialRedirectUrl, excludeInstalledFromCatalog, __executeSwapTransaction_wrapped as executeSwapTransaction, fetchProjectSettings, findMissingGoogleDriveBackupScopes, getActiveNetworkData, getActiveNetworkId, getAvailableWalletProvidersData, getBalance, getBalanceForAddress, getBalances, getCaptchaSettings, getCheckoutTransaction, getCheckoutTransactionQuote, getCoinbaseBuyUrl, getConnectedAddresses, getDefaultClient, getDeviceRegistrationTokenFromUrl, getElevatedAccessToken, getFlow, getFlowQuote, __getGoogleDriveBackupReadiness_wrapped as getGoogleDriveBackupReadiness, getInstallationLinkForCurrentPlatform, getKrakenAccounts, getKrakenWhitelistedAddresses, getMfaDevices, getMfaMethods, getMfaRecoveryCodes, getMissingVerificationForCoinbaseOnrampOrder, __getMoonPayCurrencies_wrapped as getMoonPayCurrencies, __getMoonPayUrl_wrapped as getMoonPayUrl, getMultichainBalances, getMultichainTokenBalances, getNativeBalance, getNetworksData, getOwnerWalletAccountForSmartWalletAccount, getPasskeys, getPrimaryWalletAccount, getRegisteredDevices, getSelectedWalletAccount, getSwapQuote, getSwapStatus, getTokenBalances, getTransactionHistory, getUserSocialAccounts, getWalletAccountAddressByType, getWalletAccountFromAddress, getWalletAccounts, getWalletConnectCatalog, getWalletConnectCatalogWalletByWalletProviderKey, getWalletOptionsCatalogue, getWalletProviderDataByKey, hasAllGoogleDriveBackupScopes, hasExtension, __initializeClient_wrapped as initializeClient, isAnyWalletAccountConnected, isCaptchaRequired, isDeeplinkWalletProvider, isDeviceRegistrationRequired, isHardwareWalletAccount, isInsufficientGoogleDriveScopesError, isMfaRequiredForAction, isMobile, isPendingRecoveryCodesAcknowledgment, isProgrammaticNetworkSwitchAvailable, isSignedIn, isUserMissingMfaAuth, isUserOnboardingComplete, isWalletAccountVerified, logout, matchWalletProvidersToCatalogGroup, mergeUserAccounts, offEvent, offWalletProviderEvent, onEvent, onWalletProviderEvent, onceEvent, parseUserAgent, __prepareCheckoutTransaction_wrapped as prepareCheckoutTransaction, __prepareFlowSigning_wrapped as prepareFlowSigning, __proveWalletAccountOwnership_wrapped as proveWalletAccountOwnership, __refreshAuth_wrapped as refreshAuth, __refreshUser_wrapped as refreshUser, __registerPasskey_wrapped as registerPasskey, __registerTotpMfaDevice_wrapped as registerTotpMfaDevice, __removeWalletAccount_wrapped as removeWalletAccount, __requestExternalAuthElevatedToken_wrapped as requestExternalAuthElevatedToken, requiresConversion, __revokeAllRegisteredDevices_wrapped as revokeAllRegisteredDevices, __revokeRegisteredDevice_wrapped as revokeRegisteredDevice, __selectPrimaryWalletAccount_wrapped as selectPrimaryWalletAccount, __sendEmailOTP_wrapped as sendEmailOTP, __sendSmsOTP_wrapped as sendSmsOTP, __setCaptchaToken_wrapped as setCaptchaToken, __setDefaultMfaDevice_wrapped as setDefaultMfaDevice, __setInstrumentationEnabled_wrapped as setInstrumentationEnabled, __setSelectedWalletAccount_wrapped as setSelectedWalletAccount, __signInWithExternalJwt_wrapped as signInWithExternalJwt, __signInWithPasskey_wrapped as signInWithPasskey, __signInWithSocialPopUp_wrapped as signInWithSocialPopUp, __signInWithSocialRedirect_wrapped as signInWithSocialRedirect, __signMessage_wrapped as signMessage, __submitCheckoutTransaction_wrapped as submitCheckoutTransaction, __submitFlowTransaction_wrapped as submitFlowTransaction, supportedCountries, __switchActiveNetwork_wrapped as switchActiveNetwork, trackCheckoutTransaction, __transferAmount_wrapped as transferAmount, __transferWalletAccount_wrapped as transferWalletAccount, __unlinkSocialAccount_wrapped as unlinkSocialAccount, __updateUser_wrapped as updateUser, __verifyOTP_wrapped as verifyOTP, __verifyWalletAccount_wrapped as verifyWalletAccount, waitForClientInitialized };
 //# sourceMappingURL=index.esm.js.map