@dynamic-labs-sdk/client 1.17.1 → 1.19.0

package/dist/index.cjs

@@ -1,9 +1,9 @@
-const require_isMfaRequiredForAction = require('./isMfaRequiredForAction-Btejc5g3.cjs');
-const require_updateAuthFromVerifyResponse = require('./updateAuthFromVerifyResponse-CElYpi97.cjs');
-const require_getNetworkProviderFromNetworkId = require('./getNetworkProviderFromNetworkId-CS4r9hi7.cjs');
-const require_isDynamicWaasEnabled = require('./isDynamicWaasEnabled-BwP1oowd.cjs');
-const require_isUserOnboardingComplete = require('./isUserOnboardingComplete-C86NDY7I.cjs');
-const require_getWalletProviderByKey = require('./getWalletProviderByKey-CP9Te5Sz.cjs');
+const require_isMfaRequiredForAction = require('./isMfaRequiredForAction-BuvyBN_r.cjs');
+const require_updateAuthFromVerifyResponse = require('./updateAuthFromVerifyResponse-pgYXvDvj.cjs');
+const require_getNetworkProviderFromNetworkId = require('./getNetworkProviderFromNetworkId-BJX2AMGR.cjs');
+const require_isDynamicWaasEnabled = require('./isDynamicWaasEnabled-BawttOeb.cjs');
+const require_isUserOnboardingComplete = require('./isUserOnboardingComplete-CkyzRYrg.cjs');
+const require_getWalletProviderByKey = require('./getWalletProviderByKey-C6aS7KgD.cjs');
 let _dynamic_labs_sdk_assert_package_version = require("@dynamic-labs-sdk/assert-package-version");
 let _dynamic_labs_sdk_api_core = require("@dynamic-labs/sdk-api-core");
 let zod_mini = require("zod/mini");
@@ -355,13 +355,26 @@ const initializeStorageSync = async (client) => {
 //#endregion
 //#region src/modules/user/refreshUser/refreshUser.ts
 /**
-* Refreshes the current user's data from the server.
+* Refreshes the current user's profile from the server.
 *
-* This function fetches the latest authenticated user information from the backend
-* and updates the local user state.
+* This fetches the latest authenticated user from the backend and updates only
+* the local user state, returning the `SdkUser`. It does not touch the auth
+* token — use it when you just need up-to-date user data.
+*
+* Prefer `refreshAuth` when you need to rotate the auth token as well: it runs
+* a full verify, updates both token and user state, and returns the raw
+* `VerifyResponse` (including the new token).
+*
+* @example
+* ```ts
+* const user = await refreshUser();
+* console.log('Updated user:', user.email);
+* ```
 *
 * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
 * @returns A promise that resolves to the authenticated user.
+* @see refreshAuth
+* @see deleteUser
 * @instrumented
 * @noHook Low-level refresh primitive that is not exposed as a React hook.
 */
@@ -412,9 +425,25 @@ var ClientAlreadyInitializedError = class extends require_updateAuthFromVerifyRe
 *
 * You only need to call this function if you are not using `autoInitialize: true` in createDynamicClient.
 *
+* @example
+* ```ts
+* const client = createDynamicClient({
+*   environmentId: 'env-id',
+*   autoInitialize: false,
+* });
+*
+* try {
+*   await initializeClient(client);
+* } catch (error) {
+*   console.error('Failed to initialize:', error);
+* }
+* ```
+*
 * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
 * @returns A promise that resolves when initialization is complete.
 * @throws ClientAlreadyInitializedError If the client is already initialized.
+* @see createDynamicClient
+* @see waitForClientInitialized
 * @instrumented
 * @noHook Client lifecycle management is not exposed as a React hook.
 */
@@ -751,10 +780,67 @@ const createDynamicTransport = (params) => {
 const createNavigationHandler = () => {
 	if (require_getNetworkProviderFromNetworkId.isServerSideRendering()) return () => Promise.reject(new UnavailableInServerSideError("createNavigationHandler"));
 	return async (url) => {
+		require_getNetworkProviderFromNetworkId.assertSafeNavigationUrl(url);
 		window.location.href = url;
 	};
 };
 
+//#endregion
+//#region src/errors/UnsafeDeeplinkUrlError.ts
+/**
+* Thrown when a deeplink is opened with a URL whose scheme can execute script
+* in the current origin (`javascript:`, `data:`, `vbscript:`). Unlike
+* navigation, deeplinks legitimately use custom app schemes (e.g. `phantom:`,
+* `metamask:`), so this guards via a denylist of dangerous schemes rather than
+* an `http(s)` allowlist, preventing DOM XSS through the `window.location.assign`
+* sink while leaving valid wallet deeplinks untouched.
+*/
+var UnsafeDeeplinkUrlError = class extends require_updateAuthFromVerifyResponse.BaseError {
+	constructor({ scheme }) {
+		super({
+			cause: null,
+			code: "unsafe_deeplink_url_error",
+			docsUrl: null,
+			name: "UnsafeDeeplinkUrlError",
+			shortMessage: `Refusing to open a deeplink with an unsafe scheme "${scheme}". Script-executing schemes (javascript:, data:, vbscript:) are not allowed. This may indicate a compromised or misconfigured deeplink URL.`
+		});
+	}
+};
+
+//#endregion
+//#region src/utils/assertSafeDeeplinkUrl/assertSafeDeeplinkUrl.ts
+/**
+* Schemes that can execute script in the current origin and must never reach a
+* deeplink navigation sink. Deeplinks legitimately use arbitrary custom app
+* schemes (e.g. `phantom:`, `metamask:`), so a denylist of dangerous schemes is
+* used here instead of the `http(s)` allowlist applied to standard navigation.
+*/
+const DANGEROUS_DEEPLINK_SCHEMES = new Set([
+	"javascript:",
+	"data:",
+	"vbscript:",
+	"blob:"
+]);
+/**
+* Asserts that the given deeplink URL is safe to open, i.e. its scheme is not
+* one that can execute script (`javascript:`, `data:`, `vbscript:`, `blob:`). Used as a
+* defense-in-depth guard on the `window.location.assign` deeplink sink to
+* prevent DOM XSS, while still permitting custom wallet app schemes.
+*
+* @param url - The deeplink URL string to validate.
+* @throws {UnsafeDeeplinkUrlError} If the URL cannot be parsed or its scheme can execute script.
+* @notInstrumented
+*/
+const assertSafeDeeplinkUrl = (url) => {
+	let parsed;
+	try {
+		parsed = new URL(url);
+	} catch {
+		throw new UnsafeDeeplinkUrlError({ scheme: "unknown" });
+	}
+	if (DANGEROUS_DEEPLINK_SCHEMES.has(parsed.protocol)) throw new UnsafeDeeplinkUrlError({ scheme: parsed.protocol });
+};
+
 //#endregion
 //#region src/services/openDeeplink/createWebDeeplinkOpener/createWebDeeplinkOpener.ts
 /**
@@ -774,6 +860,7 @@ const createNavigationHandler = () => {
 const createWebDeeplinkOpener = () => {
 	if (require_getNetworkProviderFromNetworkId.isServerSideRendering()) return () => Promise.reject(new UnavailableInServerSideError("createWebDeeplinkOpener"));
 	return async (url) => {
+		assertSafeDeeplinkUrl(url);
 		window.location.assign(url);
 	};
 };
@@ -1040,8 +1127,18 @@ const createCore = (config) => {
 * Manually calling `initializeClient` also allows you to catch any potential
 * errors that may occur during initialization.
 *
+* @example
+* ```ts
+* const client = createDynamicClient({
+*   environmentId: 'your-environment-id',
+*   appUrl: 'https://myapp.com',
+* });
+* ```
+*
 * @param config - The configuration for the Dynamic client, like the environment ID, app url, etc.
 * @returns The Dynamic client instance.
+* @see initializeClient
+* @see getDefaultClient
 * @instrumented
 */
 const createDynamicClient = (config) => {
@@ -1130,6 +1227,42 @@ var DeeplinkConnectAndVerifyUnsupportedError = class extends require_updateAuthF
 	}
 };
 
+//#endregion
+//#region src/errors/DeviceRegistrationIdentityMismatchError.ts
+/**
+* Thrown when completing device registration would replace the current session
+* with a different user's identity.
+*
+* The device registration token resolved to a user other than the one currently
+* authenticated, which can indicate a login-CSRF / session-fixation attempt, so
+* the returned session is rejected and the current session is left untouched.
+*
+* @example
+* ```ts
+* try {
+*   await completeDeviceRegistration({ token });
+* } catch (error) {
+*   if (error instanceof DeviceRegistrationIdentityMismatchError) {
+*     // The current session was preserved; ask the user to retry on this device.
+*   }
+* }
+* ```
+* @see completeDeviceRegistration
+* @see InvalidDeviceRegistrationRedirectError
+*/
+var DeviceRegistrationIdentityMismatchError = class extends require_updateAuthFromVerifyResponse.BaseError {
+	constructor() {
+		super({
+			cause: null,
+			code: "device_registration_identity_mismatch_error",
+			docsUrl: null,
+			metaMessages: ["The device registration token resolved to a different user than the one currently authenticated.", "This can indicate a login-CSRF / session-fixation attempt, so the returned session was rejected and the current session was left untouched."],
+			name: "DeviceRegistrationIdentityMismatchError",
+			shortMessage: "Device registration completion was rejected because it would have replaced the current session with a different identity."
+		});
+	}
+};
+
 //#endregion
 //#region src/errors/FeeEstimationFailedError.ts
 var FeeEstimationFailedError = class extends require_updateAuthFromVerifyResponse.BaseError {
@@ -1577,7 +1710,6 @@ const __checkStepUpAuth_wrapped = require_updateAuthFromVerifyResponse.instrumen
 * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
 * @returns A promise that resolves to the assertion response containing the elevated access token.
 * @instrumented
-* @redact-params
 */
 const requestExternalAuthElevatedToken = async ({ externalJwt }, client = require_updateAuthFromVerifyResponse.getDefaultClient()) => {
 	const core = require_updateAuthFromVerifyResponse.getCore(client);
@@ -1605,8 +1737,7 @@ const __requestExternalAuthElevatedToken_wrapped = require_updateAuthFromVerifyR
 		} catch {
 			return;
 		}
-	},
-	redactAll: true
+	}
 });
 
 //#endregion
@@ -1617,11 +1748,20 @@ const __requestExternalAuthElevatedToken_wrapped = require_updateAuthFromVerifyR
 * This function allows authentication using JWT tokens from external providers,
 * enabling integration with custom authentication systems.
 *
+* @example
+* ```ts
+* const response = await signInWithExternalJwt({
+*   externalJwt: 'eyJhbGciOiJSUzI1NiIs...',
+* });
+* ```
+*
 * @param [params.externalJwt] - Optional external JWT token to authenticate with. Not required when using cookie based auth.
+* @param [params.sessionPublicKey] - Optional session public key for session-based auth.
 * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
 * @returns A promise that resolves to the authentication response from the server.
+* @see logout
+* @see refreshAuth
 * @instrumented
-* @redact-params
 */
 const signInWithExternalJwt = async ({ externalJwt, sessionPublicKey } = {}, client = require_updateAuthFromVerifyResponse.getDefaultClient()) => {
 	const core = require_updateAuthFromVerifyResponse.getCore(client);
@@ -1645,8 +1785,7 @@ const __signInWithExternalJwt_wrapped = require_updateAuthFromVerifyResponse.ins
 		} catch {
 			return;
 		}
-	},
-	redactAll: true
+	}
 });
 
 //#endregion
@@ -1654,8 +1793,21 @@ const __signInWithExternalJwt_wrapped = require_updateAuthFromVerifyResponse.ins
 /**
 * Logs out the current user and clears all authentication data.
 *
+* @example
+* ```ts
+* await logout();
+* ```
+*
+* @example
+* ```ts
+* // With explicit client for multi-client setups
+* await logout(myClient);
+* ```
+*
 * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
 * @returns A promise that resolves when the logout process is complete.
+* @see isAnyWalletAccountConnected
+* @see refreshAuth
 * @notInstrumented
 */
 const logout = async (client = require_updateAuthFromVerifyResponse.getDefaultClient()) => {
@@ -1668,6 +1820,58 @@ const logout = async (client = require_updateAuthFromVerifyResponse.getDefaultCl
 	return require_isMfaRequiredForAction.__logoutWithReason_wrapped({ reason: "user-intent" }, client);
 };
 
+//#endregion
+//#region src/modules/auth/mergeUserAccounts/mergeUserAccounts.ts
+/**
+* Completes an account merge after a credential was found to already belong to
+* another user (surfaced as `MergeAccountsConfirmationError` during
+* verification / linking).
+*
+* When the merge has no field-level conflicts, call it with no resolutions to
+* merge directly. When the two accounts hold different values for the same
+* profile field, pass the user's chosen `conflictResolutions` (one per
+* conflict) so the backend knows which value to keep. On success the two users
+* are folded into one, the merged session is persisted, and the merged user is
+* returned.
+*
+* @example
+* ```ts
+* try {
+*   await verifyWalletAccount({ walletAccount });
+* } catch (error) {
+*   if (error instanceof MergeAccountsConfirmationError) {
+*     // resolveConflicts is your own function (not provided by the SDK): given
+*     // the conflicting fields, decide which value to keep for each one —
+*     // usually by prompting the user — and return them as MergeUserConflictResolution[].
+*     await mergeUserAccounts(
+*       error.mergeConflicts
+*         ? { conflictResolutions: resolveConflicts(error.mergeConflicts) }
+*         : undefined,
+*     );
+*   }
+* }
+* ```
+* @param params.conflictResolutions - Optional per-field conflict resolutions.
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns A promise that resolves to the merged user.
+* @see MergeAccountsConfirmationError
+* @see MergeUserConflictResolution
+* @notInstrumented
+*/
+const mergeUserAccounts = async ({ conflictResolutions } = {}, client = require_updateAuthFromVerifyResponse.getDefaultClient()) => {
+	const core = require_updateAuthFromVerifyResponse.getCore(client);
+	const apiClient = require_updateAuthFromVerifyResponse.createApiClient({}, client);
+	const hasConflictResolutions = conflictResolutions !== void 0 && conflictResolutions.length > 0;
+	let response;
+	if (hasConflictResolutions) response = await apiClient.verifyMergeUsers({
+		environmentId: core.environmentId,
+		mergeUserConflictResolutions: { mergeUserResolutions: conflictResolutions }
+	});
+	else response = await apiClient.mergeUsers({ environmentId: core.environmentId });
+	require_updateAuthFromVerifyResponse.updateAuthFromVerifyResponse({ response }, client);
+	return response.user;
+};
+
 //#endregion
 //#region src/modules/auth/passkeys/deletePasskey/deletePasskey.ts
 /**
@@ -1753,12 +1957,18 @@ const serverRegisterPasskey = async ({ registration, createMfaToken }, client) =
 * passwordless authentication. The user will be prompted to create a passkey
 * using their device's biometric authentication or security key.
 *
+* @example
+* ```ts
+* await registerPasskey();
+* ```
+*
 * @param [params.createMfaToken] - Optional configuration for MFA token creation.
 * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
 * @returns A promise that resolves to the registration response.
 * @throws NoWebAuthNSupportError If WebAuthn is not supported by the browser.
+* @see signInWithPasskey
+* @see getPasskeys
 * @instrumented
-* @redact-params
 */
 const registerPasskey = async ({ createMfaToken } = {}, client = require_updateAuthFromVerifyResponse.getDefaultClient()) => {
 	const core = require_updateAuthFromVerifyResponse.getCore(client);
@@ -1781,8 +1991,7 @@ const __registerPasskey_wrapped = require_updateAuthFromVerifyResponse.instrumen
 		} catch {
 			return;
 		}
-	},
-	redactAll: true
+	}
 });
 
 //#endregion
@@ -1823,11 +2032,19 @@ const serverSigninPasskey = async ({ authentication, createMfaToken }, client) =
 * credential, providing passwordless authentication using biometrics or
 * security keys.
 *
+* @example
+* ```ts
+* const response = await signInWithPasskey();
+* console.log('Signed in:', response.user.email);
+* ```
+*
+* @param [params.relatedOriginRpId] - Optional relying party ID for cross-origin authentication.
 * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
 * @returns A promise that resolves to the authentication response.
 * @throws NoWebAuthNSupportError If WebAuthn is not supported by the browser.
+* @see registerPasskey
+* @see getPasskeys
 * @instrumented
-* @redact-params
 */
 const signInWithPasskey = async ({ relatedOriginRpId } = {}, client = require_updateAuthFromVerifyResponse.getDefaultClient()) => {
 	const core = require_updateAuthFromVerifyResponse.getCore(client);
@@ -1847,8 +2064,7 @@ const __signInWithPasskey_wrapped = require_updateAuthFromVerifyResponse.instrum
 		} catch {
 			return;
 		}
-	},
-	redactAll: true
+	}
 });
 
 //#endregion
@@ -1952,22 +2168,29 @@ const addOAuthUrlParams = ({ baseUrl, isGoogleDriveBackupEnabled, provider }) =>
 
 //#endregion
 //#region src/modules/auth/social/oauth/signInWithSocialRedirect/buildOAuthUrl/getOAuthBaseUrl/getOAuthBaseUrl.ts
-/** Helper function to build the OAuth base URL for a given provider.  * @notInstrumented
+/**
+* Resolves the raw base URL string for a provider before parsing/validation.
 */
-const getOAuthBaseUrl = (provider) => {
+const resolveBaseUrl = (provider) => {
 	require_updateAuthFromVerifyResponse.assertDefined(provider.provider, "Provider type not found");
 	const providerType = provider.provider;
 	if (providerType === _dynamic_labs_sdk_api_core.ProviderEnum.Telegram) {
 		require_updateAuthFromVerifyResponse.assertDefined(provider.authorizationUrl, "Telegram authorization URL not found");
-		return new URL(provider.authorizationUrl);
+		return provider.authorizationUrl;
 	}
 	require_updateAuthFromVerifyResponse.assertDefined(provider.baseAuthUrl, "Base auth URL not found");
 	if (providerType === _dynamic_labs_sdk_api_core.ProviderEnum.Shopify) {
 		require_updateAuthFromVerifyResponse.assertDefined(provider.shopifyStore, "Shopify store value not found in provider");
-		const loginBaseUrl = provider.baseAuthUrl.replace("{{shopifyStore}}", provider.shopifyStore);
-		return new URL(loginBaseUrl);
+		return provider.baseAuthUrl.replace("{{shopifyStore}}", provider.shopifyStore);
 	}
-	return new URL(provider.baseAuthUrl);
+	return provider.baseAuthUrl;
+};
+/** Helper function to build the OAuth base URL for a given provider.  * @notInstrumented
+*/
+const getOAuthBaseUrl = (provider) => {
+	const urlString = resolveBaseUrl(provider);
+	require_getNetworkProviderFromNetworkId.assertSafeNavigationUrl(urlString);
+	return new URL(urlString);
 };
 
 //#endregion
@@ -2016,9 +2239,19 @@ const buildOAuthUrl = async (core, provider) => {
 * back because of this flow, then call `completeSocialRedirect` to finish
 * the social authentication.
 *
+* @example
+* ```ts
+* await signInWithSocialRedirect({
+*   provider: 'google',
+*   redirectUrl: window.location.href,
+* });
+* ```
+*
 * @param params.provider - The social provider to authenticate with (e.g., 'google', 'github').
 * @param params.redirectUrl - The URL to redirect back to after authentication.
 * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @see completeSocialRedirect
+* @see detectSocialRedirectUrl
 * @instrumented
 */
 const signInWithSocialRedirect = async ({ provider, redirectUrl }, client = require_updateAuthFromVerifyResponse.getDefaultClient()) => {
@@ -2061,6 +2294,14 @@ const __signInWithSocialRedirect_wrapped = require_updateAuthFromVerifyResponse.
 * @deprecated Renamed to {@link signInWithSocialRedirect}. This alias will be
 * removed in a future major version.
 *
+* @example
+* ```ts
+* // Prefer signInWithSocialRedirect instead
+* await signInWithSocialRedirect({ provider: 'google', redirectUrl: window.location.href });
+* ```
+*
+* @see signInWithSocialRedirect
+* @see completeSocialRedirect
 * @instrumented
 * @noHook Deprecated alias that is not exposed as a React hook.
 */
@@ -2078,6 +2319,45 @@ const __authenticateWithSocial_wrapped = require_updateAuthFromVerifyResponse.in
 	}
 });
 
+//#endregion
+//#region src/modules/auth/social/oauth/clearSocialRedirectParams/clearSocialRedirectParams.ts
+/**
+* Removes the social OAuth redirect parameters that `signInWithSocialRedirect`
+* appends to the return URL from the browser's current URL, leaving every other
+* query parameter, the path, and the hash untouched.
+*
+* Call this once you have finished `completeSocialRedirect` so a page refresh
+* doesn't re-trigger the redirect flow. Unlike clearing the whole query
+* string, this preserves any of your own parameters on the callback URL.
+*
+* This reads and rewrites `window.location`, so it can only run in the
+* browser. Calling it during server-side rendering (no `window`) throws
+* `UnavailableInServerSideError`.
+*
+* @returns Nothing. The current URL is rewritten in place via
+* `window.history.replaceState`.
+*
+* @throws {UnavailableInServerSideError} When called without a `window`
+* (e.g. during server-side rendering).
+*
+* @example
+* ```ts
+* await completeSocialRedirect({ url: new URL(window.location.href) });
+* clearSocialRedirectParams();
+* ```
+*
+* @see {@link completeSocialRedirect} to finish the redirect sign-in before
+* clearing the parameters.
+* @see {@link detectSocialRedirectUrl} to check whether the current URL is a
+* social OAuth callback.
+*
+* @notInstrumented
+*/
+const clearSocialRedirectParams = () => {
+	if (require_getNetworkProviderFromNetworkId.isServerSideRendering()) throw new UnavailableInServerSideError("clearSocialRedirectParams");
+	window.history.replaceState({}, "", removeDynamicOauthParamsFromUrl(window.location.href));
+};
+
 //#endregion
 //#region src/modules/auth/social/oauth/processSocialCallback/processSocialCallback.ts
 /**
@@ -2159,12 +2439,23 @@ const __processSocialCallback_wrapped = require_updateAuthFromVerifyResponse.ins
 * authenticating (or linking) the user with the social provider. This is the
 * final step after `signInWithSocialRedirect` + `detectSocialRedirectUrl`.
 *
+* @example
+* ```ts
+* const redirectUrl = detectSocialRedirectUrl();
+* if (redirectUrl) {
+*   const user = await completeSocialRedirect({ url: redirectUrl });
+* }
+* ```
+*
 * @param params.url - The callback URL containing OAuth response parameters.
 * @param [params.requestedScopes] - Optional scopes to request an elevated access token when verifying (linking) a social account.
 * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
 * @returns A promise that resolves to the authenticated user or null.
 * @throws MissingSocialUrlParamError If required OAuth parameters are missing.
 * @throws InvalidRedirectStorageStateError If the stored state doesn't match.
+* @see signInWithSocialRedirect
+* @see detectSocialRedirectUrl
+* @see clearSocialRedirectParams
 * @instrumented
 */
 const completeSocialRedirect = ({ url, requestedScopes }, client = require_updateAuthFromVerifyResponse.getDefaultClient()) => __processSocialCallback_wrapped({
@@ -2220,7 +2511,6 @@ const __completeSocialAuthentication_wrapped = require_updateAuthFromVerifyRespo
 * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
 * @returns A promise that resolves to true if the URL is an OAuth redirect, false otherwise.
 * @notInstrumented
-* @noHook Low-level redirect-detection primitive that is not exposed as a React hook.
 */
 const detectSocialRedirectUrl = async ({ url }, client = require_updateAuthFromVerifyResponse.getDefaultClient()) => {
 	const core = require_updateAuthFromVerifyResponse.getCore(client);
@@ -2252,7 +2542,19 @@ const detectOAuthRedirect = (params, client = require_updateAuthFromVerifyRespon
 * {@link signInWithSocialRedirect} + {@link completeSocialRedirect} instead —
 * the browser already owns the tab so there is no popup to open.
 *
+* @example
+* ```ts
+* // React Native only
+* const user = await signInWithSocialPopUp({ provider: 'google' });
+* ```
+*
+* @param params.provider - The social provider to authenticate with.
+* @param [params.requestedScopes] - Optional scopes to request from the provider.
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns A promise that resolves to the authenticated user or null.
 * @throws MethodNotImplementedError Always on web.
+* @see signInWithSocialRedirect
+* @see completeSocialRedirect
 * @instrumented
 */
 const signInWithSocialPopUp = async ({ provider, requestedScopes }, client = require_updateAuthFromVerifyResponse.getDefaultClient()) => {
@@ -2272,19 +2574,39 @@ const __signInWithSocialPopUp_wrapped = require_updateAuthFromVerifyResponse.ins
 });
 
 //#endregion
-//#region src/modules/wallets/primaryWalletAccount/getPrimaryWalletAccount/getPrimaryWalletAccount.ts
+//#region src/modules/wallets/selectedWalletAccount/getSelectedWalletAccount/getSelectedWalletAccount.ts
 /**
-* Get the primary wallet account.
-* The primary wallet account is the one that was last selected by the user.
-* This information is stored in both unverified and verified wallet accounts.
-* This function consolidates this information to determine which wallet was most recently selected.
+* Get the wallet account currently selected for the user.
+*
+* The SDK itself does not use or care about which wallet is "selected" — it has
+* no bearing on authentication, signing, or any other SDK behaviour. This is
+* purely a convenience for *reading* which wallet the user most recently
+* selected (derived from the backend `lastSelectedAt` timestamp, across both
+* unverified and verified wallet accounts). Applications that need a notion of
+* an active/current wallet should own that selection state themselves.
+*
+* The one exception is the wagmi integration (`@dynamic-labs-sdk/wagmi`), which
+* mirrors the selected EVM wallet into wagmi's connector state.
+*
+* @example
+* ```ts
+* const selected = getSelectedWalletAccount();
+* if (selected) {
+*   console.log('Selected wallet:', selected.address);
+* }
+* ```
+*
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns The selected wallet account, or null if no wallet has been selected.
+* @see setSelectedWalletAccount
+* @see getWalletAccounts
 * @notInstrumented
 */
-const getPrimaryWalletAccount = (client = require_updateAuthFromVerifyResponse.getDefaultClient()) => {
+const getSelectedWalletAccount = (client = require_updateAuthFromVerifyResponse.getDefaultClient()) => {
 	const sortedLastSelectedWalletAccounts = require_updateAuthFromVerifyResponse.getWalletAccounts(client).filter((walletAccount) => Boolean(walletAccount.lastSelectedAt)).sort((a, b) => b.lastSelectedAt.getTime() - a.lastSelectedAt.getTime());
 	if (sortedLastSelectedWalletAccounts.length === 0) return null;
-	const [primaryWalletAccount] = sortedLastSelectedWalletAccounts;
-	return primaryWalletAccount;
+	const [selectedWallet] = sortedLastSelectedWalletAccounts;
+	return selectedWallet;
 };
 
 //#endregion
@@ -2302,14 +2624,13 @@ const getPrimaryWalletAccount = (client = require_updateAuthFromVerifyResponse.g
 * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
 * @returns A promise that resolves to the verify response.
 * @instrumented
-* @redact-params
 */
 const unlinkSocialAccount = async ({ verifiedCredentialId }, client = require_updateAuthFromVerifyResponse.getDefaultClient()) => {
 	const core = require_updateAuthFromVerifyResponse.getCore(client);
 	const apiClient = require_updateAuthFromVerifyResponse.createApiClient({ elevatedAccessTokenScope: _dynamic_labs_sdk_api_core.TokenScope.Credentialunlink }, client);
-	const primaryWalletAccount = getPrimaryWalletAccount(client);
-	const walletId = primaryWalletAccount?.verifiedCredentialId?.replace("-zerodev", "") ?? void 0;
-	const isEmbeddedWallet = !!primaryWalletAccount && require_getWalletProviderByKey.getVerifiedCredentialForWalletAccount({ walletAccount: primaryWalletAccount }, client)?.walletProvider === _dynamic_labs_sdk_api_core.WalletProviderEnum.EmbeddedWallet;
+	const selectedWallet = getSelectedWalletAccount(client);
+	const walletId = selectedWallet?.verifiedCredentialId?.replace("-zerodev", "") ?? void 0;
+	const isEmbeddedWallet = !!selectedWallet && require_getWalletProviderByKey.getVerifiedCredentialForWalletAccount({ walletAccount: selectedWallet }, client)?.walletProvider === _dynamic_labs_sdk_api_core.WalletProviderEnum.EmbeddedWallet;
 	const response = await apiClient.verifyUnlink({
 		environmentId: core.environmentId,
 		verifyUnlinkRequest: {
@@ -2330,8 +2651,7 @@ const __unlinkSocialAccount_wrapped = require_updateAuthFromVerifyResponse.instr
 		} catch {
 			return;
 		}
-	},
-	redactAll: true
+	}
 });
 
 //#endregion
@@ -2423,6 +2743,59 @@ const getMultichainTokenBalances = async ({ balanceRequest }, client = require_u
 */
 const getMultichainBalances = (params, client = require_updateAuthFromVerifyResponse.getDefaultClient()) => getMultichainTokenBalances(params, client);
 
+//#endregion
+//#region src/modules/captcha/getCaptchaSettings/getCaptchaSettings.ts
+/**
+* The captcha providers Dynamic can be configured to use for an environment.
+* Use it to branch on which captcha widget to render for the active provider.
+*
+* Redeclared locally (rather than re-exported directly from the generated
+* `sdk-api-core`) so the public client entry point owns its own documented,
+* stable surface for this token.
+*
+* @example
+* ```ts
+* const settings = getCaptchaSettings();
+* if (settings?.provider === CaptchaProviderEnum.Hcaptcha) {
+*   renderHcaptcha(settings.siteKey);
+* }
+* ```
+* @see getCaptchaSettings
+* @see CaptchaSettingsResult
+*/
+const CaptchaProviderEnum = _dynamic_labs_sdk_api_core.CaptchaProviderEnum;
+/**
+* Returns the active captcha provider and site key, or undefined if captcha is not enabled.
+* Use this to determine which captcha widget to render and which site key to pass it.
+*
+* @example
+* ```ts
+* const settings = getCaptchaSettings();
+* if (settings) renderCaptcha(settings.provider, settings.siteKey);
+* ```
+* @see CaptchaSettingsResult
+* @see CaptchaProviderEnum
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns The active captcha provider and site key, or undefined when captcha is not enabled.
+* @notInstrumented
+*/
+const getCaptchaSettings = (client = require_updateAuthFromVerifyResponse.getDefaultClient()) => {
+	const projectSettings = client.projectSettings;
+	if (!projectSettings) return void 0;
+	const { security } = projectSettings;
+	if (security.captcha) {
+		if (security.captcha.enabled) return {
+			provider: security.captcha.provider ?? CaptchaProviderEnum.Hcaptcha,
+			siteKey: security.captcha.siteKey
+		};
+		return;
+	}
+	if (security.hCaptcha?.enabled) return {
+		provider: CaptchaProviderEnum.Hcaptcha,
+		siteKey: security.hCaptcha.siteKey
+	};
+};
+
 //#endregion
 //#region src/modules/checkout/utils/createCheckoutSessionTokenStorageKey/createCheckoutSessionTokenStorageKey.ts
 /** @notInstrumented */
@@ -2982,14 +3355,65 @@ const requiresConversion = async ({ transaction }, client = require_updateAuthFr
 	return !checkout.settlementConfig.settlements.some((settlement) => settlement.chainName === transaction.fromChainName && settlement.chainId === transaction.fromChainId && settlement.tokenAddress === transaction.fromToken);
 };
 
+//#endregion
+//#region src/modules/deviceRegistration/clearDeviceRegistrationRedirectParams/clearDeviceRegistrationRedirectParams.ts
+/**
+* Removes the device registration redirect parameters that the device
+* registration email link appends to the return URL from the browser's current
+* URL, leaving every other query parameter, the path, and the hash untouched.
+*
+* Call this once you have finished `completeDeviceRegistration` so a page
+* refresh doesn't re-trigger the registration flow. Unlike clearing the whole
+* query string, this preserves any of your own parameters on the callback URL.
+*
+* This reads and rewrites `window.location`, so it can only run in the
+* browser. Calling it during server-side rendering (no `window`) throws
+* `UnavailableInServerSideError`.
+*
+* @returns Nothing. The current URL is rewritten in place via
+* `window.history.replaceState`.
+*
+* @throws {UnavailableInServerSideError} When called without a `window`
+* (e.g. during server-side rendering).
+*
+* @example
+* ```ts
+* const deviceToken = getDeviceRegistrationTokenFromUrl({ url: window.location.href });
+* await completeDeviceRegistration({ deviceToken });
+* clearDeviceRegistrationRedirectParams();
+* ```
+*
+* @see {@link completeDeviceRegistration} to finish the registration before
+* clearing the parameters.
+* @see {@link detectDeviceRegistrationRedirect} to check whether the current
+* URL is a device registration callback.
+*
+* @notInstrumented
+*/
+const clearDeviceRegistrationRedirectParams = () => {
+	if (require_getNetworkProviderFromNetworkId.isServerSideRendering()) throw new UnavailableInServerSideError("clearDeviceRegistrationRedirectParams");
+	const url = new URL(window.location.href);
+	url.searchParams.delete("deviceRegistrationToken");
+	window.history.replaceState({}, "", url.toString());
+};
+
 //#endregion
 //#region src/modules/deviceRegistration/completeDeviceRegistration/completeDeviceRegistration.ts
 const DEVICE_REGISTRATION_TOKEN_HEADER = "x-dynamic-device-registration-token";
-/** @instrumented */
+/**
+* Completes device registration using the token from a device registration
+* redirect, authenticating the current device against the user's account.
+*
+* @see detectDeviceRegistrationRedirect
+* @see clearDeviceRegistrationRedirectParams
+* @instrumented
+*/
 const completeDeviceRegistration = async ({ deviceToken }, client = require_updateAuthFromVerifyResponse.getDefaultClient()) => {
 	require_updateAuthFromVerifyResponse.assertDefined(deviceToken, "deviceToken is required");
 	const core = require_updateAuthFromVerifyResponse.getCore(client);
+	const currentUser = core.state.get().user;
 	const response = await require_updateAuthFromVerifyResponse.createApiClient({ headers: { [DEVICE_REGISTRATION_TOKEN_HEADER]: deviceToken } }, client).deviceRegistration({ environmentId: core.environmentId });
+	if (currentUser && response.user?.id !== currentUser.id) throw new DeviceRegistrationIdentityMismatchError();
 	require_updateAuthFromVerifyResponse.updateAuthFromVerifyResponse({ response }, client);
 	require_updateAuthFromVerifyResponse.emitEvent({ event: "deviceRegistrationCompleted" }, client);
 	return response;
@@ -3170,6 +3594,22 @@ const withFlowSessionTokenCleanupOn401 = async ({ call, flowId }, client) => {
 	}
 };
 
+//#endregion
+//#region src/modules/flow/attachFlowSource/attachFlowSource.instrumentation.ts
+/**
+* Explicit instrumentation payload for attachFlowSource. Reads the nested
+* `flow` and logs non-sensitive volume and routing dimensions only — never the
+* wallet address, and never the response's session token.
+*/
+const attachFlowSourceInstrumentation = { resolved: ({ flow }) => ({
+	amount: flow.amount ?? null,
+	currency: flow.currency ?? null,
+	fromChainId: flow.fromChainId ?? null,
+	fromChainName: flow.fromChainName ?? null,
+	mode: flow.mode ?? null,
+	sourceType: flow.sourceType ?? null
+}) };
+
 //#endregion
 //#region src/modules/flow/attachFlowSource/attachFlowSource.ts
 /**
@@ -3222,7 +3662,8 @@ const __attachFlowSource_wrapped = require_updateAuthFromVerifyResponse.instrume
 		} catch {
 			return;
 		}
-	}
+	},
+	selectors: attachFlowSourceInstrumentation
 });
 
 //#endregion
@@ -3240,6 +3681,22 @@ const createFlowApiClient = async ({ flowId }, client) => {
 	};
 };
 
+//#endregion
+//#region src/modules/flow/broadcastFlow/broadcastFlow.instrumentation.ts
+/**
+* Explicit instrumentation payload for broadcastFlow. Logs non-sensitive
+* volume and routing dimensions only — never the wallet address or any
+* session token — so we can understand volume moved through the flow product.
+*/
+const broadcastFlowInstrumentation = { resolved: (flow) => ({
+	amount: flow.amount ?? null,
+	currency: flow.currency ?? null,
+	fromChainId: flow.fromChainId ?? null,
+	fromChainName: flow.fromChainName ?? null,
+	mode: flow.mode ?? null,
+	sourceType: flow.sourceType ?? null
+}) };
+
 //#endregion
 //#region src/modules/flow/broadcastFlow/broadcastFlow.ts
 /**
@@ -3276,17 +3733,40 @@ const __broadcastFlow_wrapped = require_updateAuthFromVerifyResponse.instrumentF
 		} catch {
 			return;
 		}
-	}
+	},
+	selectors: broadcastFlowInstrumentation
 });
 
+//#endregion
+//#region src/modules/flow/cancelFlow/cancelFlow.instrumentation.ts
+/**
+* Explicit instrumentation payload for cancelFlow. Logs non-sensitive volume
+* and routing dimensions only — never the wallet address or any session token.
+*/
+const cancelFlowInstrumentation = { resolved: (flow) => ({
+	amount: flow.amount ?? null,
+	currency: flow.currency ?? null,
+	fromChainId: flow.fromChainId ?? null,
+	fromChainName: flow.fromChainName ?? null,
+	mode: flow.mode ?? null,
+	sourceType: flow.sourceType ?? null
+}) };
+
 //#endregion
 //#region src/modules/flow/cancelFlow/cancelFlow.ts
 /**
-* Cancels a flow before it has been broadcasted
+* Cancels a flow before it has been broadcasted.
+*
+* @example
+* ```ts
+* const cancelledFlow = await cancelFlow({ flowId: 'flow-abc123' });
+* ```
 *
-* @param params CancelFlowParams - The flow to cancel.
+* @param params.flowId - The unique identifier of the flow to cancel.
 * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
-* @returns The cancelled flow
+* @returns A promise that resolves to the cancelled flow.
+* @see getFlow
+* @see getFlowQuote
 * @instrumented
 */
 const cancelFlow = async ({ flowId }, client = require_updateAuthFromVerifyResponse.getDefaultClient()) => {
@@ -3312,17 +3792,26 @@ const __cancelFlow_wrapped = require_updateAuthFromVerifyResponse.instrumentFunc
 		} catch {
 			return;
 		}
-	}
+	},
+	selectors: cancelFlowInstrumentation
 });
 
 //#endregion
 //#region src/modules/flow/getFlow/getFlow.ts
 /**
-* Fetches a flow by its ID
+* Fetches a flow by its ID.
 *
-* @param params GetFlowParams - The parameters for fetching the flow.
+* @example
+* ```ts
+* const flow = await getFlow({ flowId: 'flow-abc123' });
+* console.log('Flow status:', flow.status);
+* ```
+*
+* @param params.flowId - The unique identifier of the flow to fetch.
 * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
-* @returns The flow
+* @returns A promise that resolves to the flow object.
+* @see cancelFlow
+* @see getFlowQuote
 * @notInstrumented
 */
 const getFlow = async ({ flowId }, client = require_updateAuthFromVerifyResponse.getDefaultClient()) => {
@@ -3336,11 +3825,24 @@ const getFlow = async ({ flowId }, client = require_updateAuthFromVerifyResponse
 //#endregion
 //#region src/modules/flow/getFlowQuote/getFlowQuote.ts
 /**
-* Fetches a quote for a flow
+* Fetches a quote for a flow.
+*
+* @example
+* ```ts
+* const flow = await getFlowQuote({
+*   flowId: 'flow-abc123',
+*   slippage: 0.5,
+* });
+* ```
 *
-* @param params GetFlowQuoteParams - The quote parameters.
+* @param params.flowId - The unique identifier of the flow.
+* @param [params.fromChainId] - Optional chain ID overriding the one set at attachFlowSource time.
+* @param [params.fromTokenAddress] - Optional token address (defaults to native token).
+* @param [params.slippage] - Acceptable slippage percentage.
 * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
-* @returns The updated flow with quote data
+* @returns A promise that resolves to the updated flow with quote data.
+* @see getFlow
+* @see cancelFlow
 * @notInstrumented
 */
 const getFlowQuote = async ({ flowId, fromChainId, fromTokenAddress, slippage }, client = require_updateAuthFromVerifyResponse.getDefaultClient()) => {
@@ -3360,6 +3862,22 @@ const getFlowQuote = async ({ flowId, fromChainId, fromTokenAddress, slippage },
 	}, client);
 };
 
+//#endregion
+//#region src/modules/flow/prepareFlowSigning/prepareFlowSigning.instrumentation.ts
+/**
+* Explicit instrumentation payload for prepareFlowSigning. Logs non-sensitive
+* volume and routing dimensions only — never the wallet address or any
+* session token.
+*/
+const prepareFlowSigningInstrumentation = { resolved: (flow) => ({
+	amount: flow.amount ?? null,
+	currency: flow.currency ?? null,
+	fromChainId: flow.fromChainId ?? null,
+	fromChainName: flow.fromChainName ?? null,
+	mode: flow.mode ?? null,
+	sourceType: flow.sourceType ?? null
+}) };
+
 //#endregion
 //#region src/modules/flow/prepareFlowSigning/prepareFlowSigning.ts
 /**
@@ -3397,9 +3915,26 @@ const __prepareFlowSigning_wrapped = require_updateAuthFromVerifyResponse.instru
 		} catch {
 			return;
 		}
-	}
+	},
+	selectors: prepareFlowSigningInstrumentation
 });
 
+//#endregion
+//#region src/modules/flow/submitFlowTransaction/submitFlowTransaction.instrumentation.ts
+/**
+* Explicit instrumentation payload for submitFlowTransaction. Logs
+* non-sensitive volume and routing dimensions only — never the wallet address
+* or any session token — so executed flow volume is measurable.
+*/
+const submitFlowTransactionInstrumentation = { resolved: (flow) => ({
+	amount: flow.amount ?? null,
+	currency: flow.currency ?? null,
+	fromChainId: flow.fromChainId ?? null,
+	fromChainName: flow.fromChainName ?? null,
+	mode: flow.mode ?? null,
+	sourceType: flow.sourceType ?? null
+}) };
+
 //#endregion
 //#region src/modules/flow/submitFlowTransaction/submitFlowTransaction.ts
 /**
@@ -3443,7 +3978,8 @@ const __submitFlowTransaction_wrapped = require_updateAuthFromVerifyResponse.ins
 		} catch {
 			return;
 		}
-	}
+	},
+	selectors: submitFlowTransactionInstrumentation
 });
 
 //#endregion
@@ -3675,18 +4211,6 @@ const createKrakenExchangeTransfer = async (transferParams, client = require_upd
 		exchangeKey: _dynamic_labs_sdk_api_core.ExchangeKeyEnum.Kraken
 	});
 };
-const __createKrakenExchangeTransfer_impl = createKrakenExchangeTransfer;
-const __createKrakenExchangeTransfer_wrapped = require_updateAuthFromVerifyResponse.instrumentFunction({
-	fn: __createKrakenExchangeTransfer_impl,
-	functionName: "createKrakenExchangeTransfer",
-	getCore: () => {
-		try {
-			return require_updateAuthFromVerifyResponse.getCore(require_updateAuthFromVerifyResponse.getDefaultClient());
-		} catch {
-			return;
-		}
-	}
-});
 
 //#endregion
 //#region src/modules/funding/kraken/getKrakenAccounts/getKrakenAccounts.ts
@@ -3798,10 +4322,6 @@ var MoonPayProviderNotAvailableError = class extends require_updateAuthFromVerif
 * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
 * @returns The signed MoonPay URL.
 * @instrumented
-* @redact-params - the return is a bare signed onramp URL whose query string
-* carries the provider signature plus the user's wallet address; a bare-string
-* return is logged under the synthetic `result` key, which no key-based rule
-* covers, so redact the whole event.
 */
 const getMoonPayUrl = async (params, client = require_updateAuthFromVerifyResponse.getDefaultClient()) => {
 	const core = require_updateAuthFromVerifyResponse.getCore(client);
@@ -3835,8 +4355,7 @@ const __getMoonPayUrl_wrapped = require_updateAuthFromVerifyResponse.instrumentF
 		} catch {
 			return;
 		}
-	},
-	redactAll: true
+	}
 });
 
 //#endregion
@@ -3845,7 +4364,17 @@ const __getMoonPayUrl_wrapped = require_updateAuthFromVerifyResponse.instrumentF
 * Allows waiting until all modules of the client have been properly initialized
 * and are ready for use.
 *
-* @returns a promise that resolves once the client is fully initialized.
+* @example
+* ```ts
+* const client = createDynamicClient({ environmentId: 'env-id' });
+* await waitForClientInitialized(client);
+* // Client is now fully ready
+* ```
+*
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns A promise that resolves once the client is fully initialized.
+* @see initializeClient
+* @see createDynamicClient
 * @notInstrumented
 * @noHook Client lifecycle management is not exposed as a hook; use useInitStatus.
 */
@@ -4420,7 +4949,6 @@ const getWalletConnectCatalogWalletByWalletProviderKey = async ({ walletProvider
 * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
 * @returns A promise that resolves to OTP verification details if verification is required, or undefined.
 * @instrumented
-* @redact-params
 */
 const updateUser = async ({ userFields }, client = require_updateAuthFromVerifyResponse.getDefaultClient()) => {
 	const core = require_updateAuthFromVerifyResponse.getCore(client);
@@ -4450,8 +4978,7 @@ const __updateUser_wrapped = require_updateAuthFromVerifyResponse.instrumentFunc
 		} catch {
 			return;
 		}
-	},
-	redactAll: true
+	}
 });
 
 //#endregion
@@ -4665,7 +5192,6 @@ const authenticateTotpMfaDevice = async ({ deviceId, code, createMfaTokenOptions
 * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
 * @returns A promise that resolves to the newly generated recovery codes.
 * @instrumented
-* @redact-params
 */
 const createNewMfaRecoveryCodes = async (client = require_updateAuthFromVerifyResponse.getDefaultClient()) => {
 	const core = require_updateAuthFromVerifyResponse.getCore(client);
@@ -4681,8 +5207,7 @@ const __createNewMfaRecoveryCodes_wrapped = require_updateAuthFromVerifyResponse
 		} catch {
 			return;
 		}
-	},
-	redactAll: true
+	}
 });
 
 //#endregion
@@ -4776,9 +5301,6 @@ const getMfaRecoveryCodes = async (client = require_updateAuthFromVerifyResponse
 * @returns A promise that resolves to the TOTP registration response containing setup information,
 * like the secret key and the OTP Auth URI.
 * @instrumented
-* @redact-params - the response embeds the TOTP shared secret in both `secret`
-* and the `uri` (`otpauth://...?secret=...`); redact the whole event so the
-* seed never reaches logs via the un-keyed `uri` field.
 */
 const registerTotpMfaDevice = async (client = require_updateAuthFromVerifyResponse.getDefaultClient()) => {
 	const core = require_updateAuthFromVerifyResponse.getCore(client);
@@ -4794,8 +5316,7 @@ const __registerTotpMfaDevice_wrapped = require_updateAuthFromVerifyResponse.ins
 		} catch {
 			return;
 		}
-	},
-	redactAll: true
+	}
 });
 
 //#endregion
@@ -4840,11 +5361,24 @@ const __setDefaultMfaDevice_wrapped = require_updateAuthFromVerifyResponse.instr
 *
 * Once you have the OTP code, you should then use `verifyOTP` to verify it and complete the authentication process.
 *
+* @example
+* ```ts
+* const { verificationUUID } = await sendEmailOTP({
+*   email: 'user@example.com',
+* });
+* // Then verify with the code the user received
+* await verifyOTP({
+*   otpVerification: { email: 'user@example.com', verificationUUID },
+*   verificationToken: '123456',
+* });
+* ```
+*
 * @param params.email - The email address to send the OTP to.
 * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
 * @returns A promise that resolves to an OTPVerification object containing the email and verification UUID.
+* @see verifyOTP
+* @see sendSmsOTP
 * @instrumented
-* @redact-params
 */
 const sendEmailOTP = async ({ email }, client = require_updateAuthFromVerifyResponse.getDefaultClient()) => {
 	const core = require_updateAuthFromVerifyResponse.getCore(client);
@@ -4872,8 +5406,7 @@ const __sendEmailOTP_wrapped = require_updateAuthFromVerifyResponse.instrumentFu
 		} catch {
 			return;
 		}
-	},
-	redactAll: true
+	}
 });
 
 //#endregion
@@ -5802,12 +6335,23 @@ const supportedCountries = {
 /**
 * Sends a one-time password (OTP) via SMS to the specified phone number.
 *
+* @example
+* ```ts
+* const { verificationUUID } = await sendSmsOTP({
+*   isoCountryCode: 'US',
+*   phoneNumber: '5551234567',
+* });
+* // Then verify with the code the user received
+* await verifyOTP({ otpVerification: { phoneNumber: '5551234567', verificationUUID }, verificationToken: '123456' });
+* ```
+*
 * @param params.isoCountryCode - The ISO country code for the phone number (e.g., 'US', 'CA', 'GB').
 * @param params.phoneNumber - The phone number to send the OTP to.
 * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
 * @returns A promise that resolves to an OTPVerification object containing the phone details and verification UUID.
+* @see verifyOTP
+* @see sendEmailOTP
 * @instrumented
-* @redact-params
 */
 const sendSmsOTP = async ({ isoCountryCode, phoneNumber }, client = require_updateAuthFromVerifyResponse.getDefaultClient()) => {
 	const core = require_updateAuthFromVerifyResponse.getCore(client);
@@ -5840,17 +6384,17 @@ const __sendSmsOTP_wrapped = require_updateAuthFromVerifyResponse.instrumentFunc
 		} catch {
 			return;
 		}
-	},
-	redactAll: true
+	}
 });
 
 //#endregion
 //#region src/modules/otp/verifyOTP/verifyOTPForUserSignIn/verifyOTPForUserSignIn.ts
 /** @notInstrumented */
-const verifyOTPForUserSignIn = async ({ otpVerification, verificationToken }, client) => {
+const verifyOTPForUserSignIn = async ({ allowNewMFALinking, otpVerification, verificationToken }, client) => {
 	const core = require_updateAuthFromVerifyResponse.getCore(client);
 	const apiClient = require_updateAuthFromVerifyResponse.createApiClient({}, client);
 	const verifyRequest = {
+		...allowNewMFALinking !== void 0 && { allowNewMFALinking },
 		verificationToken,
 		verificationUUID: otpVerification.verificationUUID
 	};
@@ -5893,14 +6437,26 @@ const verifyOTPForUserUpdate = async ({ otpVerification, verificationToken, requ
 * This function validates the OTP code provided by the user and completes
 * the verification process for either sign-in or account updates.
 *
+* @example
+* ```ts
+* const { verificationUUID } = await sendEmailOTP({ email: 'user@example.com' });
+* const response = await verifyOTP({
+*   otpVerification: { email: 'user@example.com', verificationUUID },
+*   verificationToken: '123456',
+* });
+* ```
+*
+* @param [params.allowNewMFALinking] - Whether sign-in may return a credential-link elevated token for users without MFA.
 * @param params.otpVerification - The OTP verification object containing verification details.
 * @param params.verificationToken - The token received from the OTP verification process.
+* @param [params.requestedScopes] - Optional token scopes to request during verification.
 * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
 * @returns A promise that resolves to the verify response object upon successful verification.
+* @see sendEmailOTP
+* @see sendSmsOTP
 * @instrumented
-* @redact-params
 */
-const verifyOTP = async ({ otpVerification, verificationToken, requestedScopes }, client = require_updateAuthFromVerifyResponse.getDefaultClient()) => {
+const verifyOTP = async ({ allowNewMFALinking, otpVerification, requestedScopes, verificationToken }, client = require_updateAuthFromVerifyResponse.getDefaultClient()) => {
 	require_isUserOnboardingComplete.preconnectWaasIframe(client);
 	let response;
 	if (client.user) response = await verifyOTPForUserUpdate({
@@ -5909,6 +6465,7 @@ const verifyOTP = async ({ otpVerification, verificationToken, requestedScopes }
 		verificationToken
 	}, client);
 	else response = await verifyOTPForUserSignIn({
+		allowNewMFALinking,
 		otpVerification,
 		verificationToken
 	}, client);
@@ -5925,8 +6482,7 @@ const __verifyOTP_wrapped = require_updateAuthFromVerifyResponse.instrumentFunct
 		} catch {
 			return;
 		}
-	},
-	redactAll: true
+	}
 });
 
 //#endregion
@@ -6008,6 +6564,33 @@ const getSwapStatus = async (params, client = require_updateAuthFromVerifyRespon
 	}
 };
 
+//#endregion
+//#region src/modules/user/checkUserScopes/checkUserScopes.ts
+/**
+* Checks whether the given user has all the specified scopes.
+*
+* The user's `scope` field is a whitespace-separated string of granted
+* permissions (per RFC 8693 §4.2). This helper splits it and verifies that
+* every entry in `scopes` is present.
+*
+* @example
+* const user = getDefaultClient().user;
+* if (user && checkUserScopes({ user, scopes: ['wallets:read'] })) {
+*   showWalletBalances();
+* }
+*
+* @param params.user - The authenticated user to check.
+* @param params.scopes - The scope strings the user must have.
+* @returns `true` if the user has every scope in `scopes`, `false` otherwise.
+* @see User
+* @see updateUser
+* @notInstrumented
+*/
+const checkUserScopes = ({ scopes, user }) => {
+	const grantedScopes = user.scope?.split(/\s+/).filter(Boolean) ?? [];
+	return scopes.every((requiredScope) => grantedScopes.includes(requiredScope));
+};
+
 //#endregion
 //#region src/modules/user/deleteUser/deleteUser.ts
 /**
@@ -6016,8 +6599,16 @@ const getSwapStatus = async (params, client = require_updateAuthFromVerifyRespon
 * This function performs a hard delete of the user account. Upon successful deletion,
 * the user will be automatically logged out and all authentication data will be cleared.
 *
+* @example
+* ```ts
+* // Permanently delete the user's account
+* await deleteUser();
+* ```
+*
 * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
 * @returns A promise that resolves when the user account is successfully deleted.
+* @see logout
+* @see refreshUser
 * @instrumented
 */
 const deleteUser = async (client = require_updateAuthFromVerifyResponse.getDefaultClient()) => {
@@ -7351,8 +7942,14 @@ const getAddressesWithTypesFromConnectionResult = (connectionResult) => {
 *
 * Note: This function will not verify the wallet account, use the verifyWalletAccount function to do that
 * or connectAndVerifyWithWalletProvider to do that in a single step.
-* @see verifyWalletAccount
-* @see connectAndVerifyWithWalletProvider
+*
+* @example
+* ```ts
+* const walletAccount = await connectWithWalletProvider({
+*   walletProviderKey: 'metamaskevm',
+* });
+* console.log(walletAccount.address);
+* ```
 *
 * @param params.walletProviderKey - The unique key identifying the wallet provider to connect to (e.g. 'metamaskevm', 'phantomsol').
 * @param [params.addToDynamicWalletAccounts] - Whether to add the connected wallet account to the user's wallet accounts. Defaults to true.
@@ -7360,7 +7957,9 @@ const getAddressesWithTypesFromConnectionResult = (connectionResult) => {
 * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
 * @returns A promise that resolves to the connected wallet account.
 * @throws NoAddressFoundError If the request to connect was successful but no address is connected to your app.
-*  @instrumented
+* @see verifyWalletAccount
+* @see connectAndVerifyWithWalletProvider
+* @instrumented
 */
 const connectWithWalletProvider = async ({ walletProviderKey, addToDynamicWalletAccounts = true, hardwareWalletVendor }, client = require_updateAuthFromVerifyResponse.getDefaultClient()) => {
 	const walletProvider = require_getWalletProviderByKey.getWalletProviderByKey({ walletProviderKey }, client);
@@ -7497,9 +8096,19 @@ const getSignInMessage = async ({ nonce: nonceOverride, walletAccount }, client)
 * This function generates a sign-in message and requires the user to sign it
 * with their wallet's private key, proving they control the wallet address.
 *
+* @example
+* ```ts
+* const { messageToSign, signature } = await proveWalletAccountOwnership({
+*   walletAccount: wallets[0],
+* });
+* // Send signature to your backend for verification
+* ```
+*
 * @param params.walletAccount - The wallet account to prove ownership of.
 * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
 * @returns A promise that resolves to an object containing the message and signature.
+* @see signMessage
+* @see verifyWalletAccount
 * @instrumented
 */
 const proveWalletAccountOwnership = async ({ walletAccount }, client = require_updateAuthFromVerifyResponse.getDefaultClient()) => {
@@ -7603,11 +8212,22 @@ const verifyWalletAccountForSignInOrTransfer = async ({ walletAccount, isTransfe
 * This function requires the user to sign a message to prove wallet ownership,
 * then sets the wallet account as verified.
 *
+* @example
+* ```ts
+* const walletAccount = await connectWithWalletProvider({
+*   walletProviderKey: 'metamaskevm',
+* });
+* const verified = await verifyWalletAccount({ walletAccount });
+* ```
+*
 * @param params.walletAccount - The wallet account to verify ownership of.
+* @param [params.requestedScopes] - Optional token scopes to request during verification.
 * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
 * @returns A promise that resolves to the verified wallet account.
 * @throws WalletAccountAlreadyVerifiedError If the wallet is already verified.
 * @throws WalletAlreadyLinkedToAnotherUserError If the wallet is linked to another user.
+* @see connectWithWalletProvider
+* @see connectAndVerifyWithWalletProvider
 * @instrumented
 */
 const verifyWalletAccount = async ({ walletAccount, requestedScopes }, client = require_updateAuthFromVerifyResponse.getDefaultClient()) => {
@@ -7657,10 +8277,20 @@ const isDeeplinkWalletProvider = ({ walletProvider }) => walletProvider.walletPr
 * `verifyWalletAccount` separately from a new user gesture (e.g. a "Verify
 * Ownership" button).
 *
+* @example
+* ```ts
+* const walletAccount = await connectAndVerifyWithWalletProvider({
+*   walletProviderKey: 'metamaskevm',
+* });
+* console.log('Verified address:', walletAccount.address);
+* ```
+*
 * @param params.walletProviderKey - The unique key identifying the wallet provider to connect to.
 * @param [params.hardwareWalletVendor] - The hardware wallet vendor, if connecting via a hardware wallet (e.g. 'ledger').
 * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
 * @returns A promise that resolves to the connected and verified wallet account.
+* @see connectWithWalletProvider
+* @see verifyWalletAccount
 * @instrumented
 */
 const connectAndVerifyWithWalletProvider = async ({ walletProviderKey, hardwareWalletVendor }, client = require_updateAuthFromVerifyResponse.getDefaultClient()) => {
@@ -7722,9 +8352,17 @@ const getAvailableWalletProvidersData = (client = require_updateAuthFromVerifyRe
 * This function returns the list of wallet addresses that are currently
 * connected and available through the specified wallet provider.
 *
+* @example
+* ```ts
+* const addresses = getConnectedAddresses({ walletProviderKey: 'metamaskevm' });
+* console.log('Connected:', addresses);
+* ```
+*
 * @param params.walletProviderKey - The unique key of the wallet provider to query.
 * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
 * @returns An array of connected wallet addresses.
+* @see connectWithWalletProvider
+* @see getWalletAccounts
 * @notInstrumented
 */
 const getConnectedAddresses = ({ walletProviderKey }, client = require_updateAuthFromVerifyResponse.getDefaultClient()) => {
@@ -7756,6 +8394,7 @@ const getWalletAccountAddressByType = ({ type, walletAccount }) => {
 * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
 * @returns The data for the wallet provider.
 * @notInstrumented
+* @hook Exposed as a hook so consumers get reactive wallet provider data, updated when the wallet provider registry changes.
 */
 const getWalletProviderDataByKey = ({ walletProviderKey }, client = require_updateAuthFromVerifyResponse.getDefaultClient()) => {
 	const { chain, groupKey, key, metadata, walletProviderType } = require_getWalletProviderByKey.getWalletProviderByKey({ walletProviderKey }, client);
@@ -7804,8 +8443,17 @@ const isHardwareWalletAccount = ({ walletAccount }) => walletAccount.hardwareWal
 * else your app considers "signed in" (e.g. `client.user`, completed onboarding,
 * a required embedded wallet, …).
 *
+* @example
+* ```ts
+* if (isAnyWalletAccountConnected()) {
+*   console.log('At least one wallet is connected');
+* }
+* ```
+*
 * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
 * @returns True if the session has at least one wallet account, false otherwise.
+* @see getWalletAccounts
+* @see isWalletAccountVerified
 * @notInstrumented
 */
 const isAnyWalletAccountConnected = (client = require_updateAuthFromVerifyResponse.getDefaultClient()) => require_updateAuthFromVerifyResponse.getWalletAccounts(client).length > 0;
@@ -7815,8 +8463,16 @@ const isAnyWalletAccountConnected = (client = require_updateAuthFromVerifyRespon
 /**
 * Checks if a wallet account has been verified by a user.
 *
-* @param walletAccount - The wallet account to check.
+* @example
+* ```ts
+* const wallets = getWalletAccounts();
+* const verified = wallets.filter(w => isWalletAccountVerified({ walletAccount: w }));
+* ```
+*
+* @param params.walletAccount - The wallet account to check.
 * @returns True if the wallet account has been verified, false otherwise.
+* @see verifyWalletAccount
+* @see getWalletAccounts
 * @notInstrumented
 */
 const isWalletAccountVerified = ({ walletAccount }) => {
@@ -7906,9 +8562,17 @@ const getActiveNetworkId = ({ walletAccount }, client = require_updateAuthFromVe
 * {@link getTokenBalances}; for a multi-chain portfolio snapshot, use
 * {@link getMultichainTokenBalances}.
 *
+* @example
+* ```ts
+* const { balance } = await getNativeBalance({ walletAccount: wallets[0] });
+* console.log('Native balance:', balance);
+* ```
+*
 * @param params.walletAccount - The wallet account to get the balance for.
 * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
 * @returns A promise that resolves to an object containing the balance as a string or null.
+* @see getMultichainTokenBalances
+* @see switchActiveNetwork
 * @notInstrumented
 */
 const getNativeBalance = async ({ walletAccount }, client = require_updateAuthFromVerifyResponse.getDefaultClient()) => {
@@ -7928,6 +8592,14 @@ const getNativeBalance = async ({ walletAccount }, client = require_updateAuthFr
 * with the token-balance fetchers (`getTokenBalances` /
 * `getMultichainTokenBalances`).
 *
+* @example
+* ```ts
+* // Prefer getNativeBalance instead
+* const balance = await getNativeBalance({ walletAccount });
+* ```
+*
+* @see getNativeBalance
+* @see getMultichainBalances
 * @notInstrumented
 * @noHook Deprecated; the replacement is exposed via its own hook.
 */
@@ -8013,11 +8685,21 @@ const isProgrammaticNetworkSwitchAvailable = ({ walletAccount }, client = requir
 * This function programmatically changes the network
 * that the wallet is currently connected to.
 *
+* @example
+* ```ts
+* await switchActiveNetwork({
+*   walletAccount: wallets[0],
+*   networkId: '137', // Polygon
+* });
+* ```
+*
 * @param params.networkId - The identifier of the network to switch to. Should match the networkId of the network data.
 * @param params.walletAccount - The wallet account to switch networks for.
 * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
 * @returns A promise that resolves when the network switch is complete.
 * @throws NetworkSwitchingUnavailableError If the wallet provider doesn't support network switching.
+* @see getNativeBalance
+* @see isProgrammaticNetworkSwitchAvailable
 * @instrumented
 */
 const switchActiveNetwork = async ({ networkId, walletAccount }, client = require_updateAuthFromVerifyResponse.getDefaultClient()) => {
@@ -8043,15 +8725,37 @@ const __switchActiveNetwork_wrapped = require_updateAuthFromVerifyResponse.instr
 });
 
 //#endregion
-//#region src/modules/wallets/primaryWalletAccount/selectPrimaryWalletAccount/selectPrimaryWalletAccount.ts
+//#region src/modules/wallets/selectedWalletAccount/setSelectedWalletAccount/setSelectedWalletAccount.ts
 /**
-* Make the wallet account provided as the primary wallet account.
+* Set the wallet account that is currently selected for the user.
+*
+* The SDK itself does not use or care about which wallet is "selected" — this
+* only records the selection (updating the backend `lastSelectedAt` and, for
+* verified wallets, persisting it server-side) so it can later be read back via
+* `getSelectedWalletAccount`. It has no bearing on authentication or signing.
+* Applications that need a notion of an active/current wallet should own that
+* selection state themselves.
+*
+* The one exception is the wagmi integration (`@dynamic-labs-sdk/wagmi`), which
+* relies on the selected EVM wallet.
+*
+* @example
+* ```ts
+* const wallets = getWalletAccounts();
+* await setSelectedWalletAccount({ walletAccount: wallets[1] });
+* ```
+*
+* @param params.walletAccount - The wallet account to mark as selected.
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns A promise that resolves when the selection is persisted.
+* @see getSelectedWalletAccount
+* @see getWalletAccounts
 * @instrumented
-* @noHook The primary-wallet concept is discouraged and not exposed as a hook.
+* @noHook The selected-wallet concept is not exposed as a hook.
 */
-const selectPrimaryWalletAccount = async ({ walletAccount }, client = require_updateAuthFromVerifyResponse.getDefaultClient()) => {
+const setSelectedWalletAccount = async ({ walletAccount }, client = require_updateAuthFromVerifyResponse.getDefaultClient()) => {
 	const core = require_updateAuthFromVerifyResponse.getCore(client);
-	if (getPrimaryWalletAccount(client)?.id === walletAccount.id) return;
+	if (getSelectedWalletAccount(client)?.id === walletAccount.id) return;
 	if (walletAccount.verifiedCredentialId) require_updateAuthFromVerifyResponse.updateAuthFromVerifyResponse({ response: await require_updateAuthFromVerifyResponse.createApiClient({}, client).selectUserWallet({
 		environmentId: core.environmentId,
 		userWalletSelectionRequest: { walletId: walletAccount.verifiedCredentialId }
@@ -8061,6 +8765,68 @@ const selectPrimaryWalletAccount = async ({ walletAccount }, client = require_up
 		lastSelectedAt: /* @__PURE__ */ new Date()
 	}] }, client);
 };
+const __setSelectedWalletAccount_impl = setSelectedWalletAccount;
+const __setSelectedWalletAccount_wrapped = require_updateAuthFromVerifyResponse.instrumentFunction({
+	fn: __setSelectedWalletAccount_impl,
+	functionName: "setSelectedWalletAccount",
+	getCore: () => {
+		try {
+			return require_updateAuthFromVerifyResponse.getCore(require_updateAuthFromVerifyResponse.getDefaultClient());
+		} catch {
+			return;
+		}
+	}
+});
+
+//#endregion
+//#region src/modules/wallets/selectedWalletAccount/getPrimaryWalletAccount/getPrimaryWalletAccount.ts
+/**
+* Get the primary wallet account.
+*
+* @deprecated Renamed to `getSelectedWalletAccount`. The "primary wallet" naming was
+* misleading — the SDK does not use or care about which wallet is selected; it
+* only lets you *read* the user's most recently selected wallet. Migrate to
+* `getSelectedWalletAccount`, and own your own wallet-selection state in your
+* application rather than relying on the SDK's selected wallet.
+*
+* @example
+* ```ts
+* const primary = getPrimaryWalletAccount();
+* if (primary) {
+*   console.log('Primary wallet:', primary.address);
+* }
+* ```
+*
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns The primary wallet account, or null if no wallet has been selected.
+* @notInstrumented
+*/
+const getPrimaryWalletAccount = (client = require_updateAuthFromVerifyResponse.getDefaultClient()) => getSelectedWalletAccount(client);
+
+//#endregion
+//#region src/modules/wallets/selectedWalletAccount/selectPrimaryWalletAccount/selectPrimaryWalletAccount.ts
+/**
+* Make the wallet account provided as the primary wallet account.
+*
+* @deprecated Renamed to `setSelectedWalletAccount`. The "primary wallet" naming was
+* misleading — the SDK does not use or care about which wallet is selected;
+* this only records the selection so it can later be read back. Migrate to
+* `setSelectedWalletAccount`, and own your own wallet-selection state in your
+* application rather than relying on the SDK's selected wallet.
+*
+* @example
+* ```ts
+* const wallets = getWalletAccounts();
+* await selectPrimaryWalletAccount({ walletAccount: wallets[1] });
+* ```
+*
+* @param params.walletAccount - The wallet account to set as primary.
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns A promise that resolves when the selection is persisted.
+* @instrumented
+* @noHook The selected-wallet concept is not exposed as a hook.
+*/
+const selectPrimaryWalletAccount = async ({ walletAccount }, client = require_updateAuthFromVerifyResponse.getDefaultClient()) => __setSelectedWalletAccount_wrapped({ walletAccount }, client);
 const __selectPrimaryWalletAccount_impl = selectPrimaryWalletAccount;
 const __selectPrimaryWalletAccount_wrapped = require_updateAuthFromVerifyResponse.instrumentFunction({
 	fn: __selectPrimaryWalletAccount_impl,
@@ -8077,10 +8843,23 @@ const __selectPrimaryWalletAccount_wrapped = require_updateAuthFromVerifyRespons
 //#endregion
 //#region src/modules/wallets/disconnectWalletAccount/disconnectWalletAccount.ts
 /**
-* This function disconnects the specified wallet account with the wallet provider.
+* Disconnects the specified wallet account from its wallet provider.
 *
-* The wallet account is not removed from the user's profile or from dynamic's state,
+* The wallet account is not removed from the user's profile or from Dynamic's state,
 * it is only responsible for terminating the connection with the wallet provider.
+* Use `removeWalletAccount` to fully remove a wallet from the user's session.
+*
+* @example
+* ```ts
+* const wallets = getWalletAccounts();
+* await disconnectWalletAccount({ walletAccount: wallets[0] }, client);
+* ```
+*
+* @param params.walletAccount - The wallet account to disconnect.
+* @param client - The Dynamic client instance.
+* @returns A promise that resolves when the wallet is disconnected from the provider.
+* @see removeWalletAccount
+* @see connectWithWalletProvider
 * @notInstrumented
 */
 const disconnectWalletAccount = async ({ walletAccount }, client) => {
@@ -8101,9 +8880,17 @@ const disconnectWalletAccount = async ({ walletAccount }, client) => {
 * updating local state and server records (if there is an authenticated user).
 * For verified wallets, it will unlink them from the user's account.
 *
+* @example
+* ```ts
+* const wallets = getWalletAccounts();
+* await removeWalletAccount({ walletAccount: wallets[0] });
+* ```
+*
 * @param params.walletAccount - The wallet account to remove.
 * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
 * @returns A promise that resolves when the wallet account is successfully removed.
+* @see getWalletAccounts
+* @see disconnectWalletAccount
 * @instrumented
 */
 const removeWalletAccount = async ({ walletAccount }, client = require_updateAuthFromVerifyResponse.getDefaultClient()) => {
@@ -8140,10 +8927,21 @@ const __removeWalletAccount_wrapped = require_updateAuthFromVerifyResponse.instr
 * This function uses the wallet's private key to cryptographically sign
 * the provided message.
 *
+* @example
+* ```ts
+* const wallets = getWalletAccounts();
+* const { signature } = await signMessage({
+*   walletAccount: wallets[0],
+*   message: 'Hello Dynamic!',
+* });
+* ```
+*
 * @param params.walletAccount - The wallet account to use for signing.
 * @param params.message - The message to sign.
 * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
 * @returns A promise that resolves to an object containing the signature.
+* @see getWalletAccounts
+* @see connectWithWalletProvider
 * @instrumented
 */
 const signMessage = async ({ walletAccount, message }, client = require_updateAuthFromVerifyResponse.getDefaultClient()) => {
@@ -8176,13 +8974,24 @@ const __signMessage_wrapped = require_updateAuthFromVerifyResponse.instrumentFun
 * Supports native token transfers and, where supported by the chain,
 * fungible/token transfers via the optional `token` parameter.
 *
+* @example
+* ```ts
+* const { transactionHash } = await transferAmount({
+*   walletAccount: wallets[0],
+*   amount: '0.1',
+*   recipient: '0x1234...abcd',
+* });
+* ```
+*
 * @param params.walletAccount - The wallet account to transfer from.
 * @param params.amount - The amount to transfer as a decimal string (e.g. "1.5").
 * @param params.recipient - The recipient address.
-* @param params.token - Optional token info for non-native transfers.
+* @param [params.token] - Optional token info for non-native transfers.
 * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
 * @returns A promise that resolves to an object containing the transaction hash.
 * @throws If the wallet provider does not support the transfer amount method.
+* @see getWalletAccounts
+* @see signMessage
 * @instrumented
 */
 const transferAmount = async ({ walletAccount, amount, recipient, token }, client = require_updateAuthFromVerifyResponse.getDefaultClient()) => {
@@ -8217,9 +9026,18 @@ const __transferAmount_wrapped = require_updateAuthFromVerifyResponse.instrument
 * This function requires the user to sign a message to prove wallet ownership,
 * then transfers the wallet account to the current user's account.
 *
+* @example
+* ```ts
+* const walletAccount = await transferWalletAccount({
+*   walletProviderKey: 'metamaskevm',
+* });
+* ```
+*
 * @param params.walletProviderKey - The key of the wallet provider of the wallet account to transfer.
 * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
 * @returns A promise that resolves to the transferred wallet account.
+* @see connectWithWalletProvider
+* @see verifyWalletAccount
 * @instrumented
 */
 const transferWalletAccount = async ({ walletProviderKey }, client = require_updateAuthFromVerifyResponse.getDefaultClient()) => {
@@ -8252,10 +9070,20 @@ const __transferWalletAccount_wrapped = require_updateAuthFromVerifyResponse.ins
 * This function searches through the current session's wallet accounts
 * to find one matching the specified address and chain.
 *
+* @example
+* ```ts
+* const account = getWalletAccountFromAddress({
+*   address: '0x1234...abcd',
+*   chain: 'EVM',
+* });
+* ```
+*
 * @param params.address - The wallet address to search for.
 * @param params.chain - The blockchain the wallet belongs to.
 * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
 * @returns The matching wallet account, or undefined if not found.
+* @see getWalletAccounts
+* @see isWalletAccountVerified
 * @notInstrumented
 */
 const getWalletAccountFromAddress = ({ address, chain }, client = require_updateAuthFromVerifyResponse.getDefaultClient()) => {
@@ -8415,9 +9243,11 @@ const parseUserAgent = ({ userAgent }) => {
 
 //#endregion
 exports.BaseError = require_updateAuthFromVerifyResponse.BaseError;
+exports.CaptchaProviderEnum = CaptchaProviderEnum;
 exports.CheckoutSessionTokenMissingError = CheckoutSessionTokenMissingError;
 exports.ClientAlreadyInitializedError = ClientAlreadyInitializedError;
 exports.DeeplinkConnectAndVerifyUnsupportedError = DeeplinkConnectAndVerifyUnsupportedError;
+exports.DeviceRegistrationIdentityMismatchError = DeviceRegistrationIdentityMismatchError;
 exports.FeeEstimationFailedError = FeeEstimationFailedError;
 exports.FlowSessionTokenMissingError = FlowSessionTokenMissingError;
 exports.GOOGLE_DRIVE_BACKUP_REQUIRED_SCOPES = GOOGLE_DRIVE_BACKUP_REQUIRED_SCOPES;
@@ -8439,6 +9269,7 @@ Object.defineProperty(exports, 'MFAAction', {
     return _dynamic_labs_sdk_api_core.MFAAction;
   }
 });
+exports.MergeAccountsConfirmationError = require_getNetworkProviderFromNetworkId.MergeAccountsConfirmationError;
 exports.MfaInvalidOtpError = require_updateAuthFromVerifyResponse.MfaInvalidOtpError;
 exports.MfaRateLimitedError = require_updateAuthFromVerifyResponse.MfaRateLimitedError;
 exports.MissingRedirectStorageStateError = MissingRedirectStorageStateError;
@@ -8479,6 +9310,7 @@ exports.WalletAccountAlreadyVerifiedError = WalletAccountAlreadyVerifiedError;
 exports.WalletAccountNotSelectedError = WalletAccountNotSelectedError;
 exports.WalletAlreadyLinkedToAnotherUserError = require_getNetworkProviderFromNetworkId.WalletAlreadyLinkedToAnotherUserError;
 exports.WalletProviderMethodUnavailableError = WalletProviderMethodUnavailableError;
+exports.WalletScreeningBlockedError = require_getNetworkProviderFromNetworkId.WalletScreeningBlockedError;
 exports.acknowledgeRecoveryCodes = __acknowledgeRecoveryCodes_wrapped;
 exports.addCoinbaseOnrampOrderEventListener = addCoinbaseOnrampOrderEventListener;
 exports.addNetwork = __addNetwork_wrapped;
@@ -8497,6 +9329,9 @@ exports.canConnectWithHardwareWallet = canConnectWithHardwareWallet;
 exports.cancelCheckoutTransaction = __cancelCheckoutTransaction_wrapped;
 exports.cancelFlow = __cancelFlow_wrapped;
 exports.checkStepUpAuth = __checkStepUpAuth_wrapped;
+exports.checkUserScopes = checkUserScopes;
+exports.clearDeviceRegistrationRedirectParams = clearDeviceRegistrationRedirectParams;
+exports.clearSocialRedirectParams = clearSocialRedirectParams;
 exports.completeDeviceRegistration = __completeDeviceRegistration_wrapped;
 exports.completeSocialAuthentication = __completeSocialAuthentication_wrapped;
 exports.completeSocialRedirect = __completeSocialRedirect_wrapped;
@@ -8508,7 +9343,7 @@ exports.createCheckoutTransaction = __createCheckoutTransaction_wrapped;
 exports.createCoinbaseOnrampOrder = __createCoinbaseOnrampOrder_wrapped;
 exports.createCryptoDotComPayment = __createCryptoDotComPayment_wrapped;
 exports.createDynamicClient = __createDynamicClient_wrapped;
-exports.createKrakenExchangeTransfer = __createKrakenExchangeTransfer_wrapped;
+exports.createKrakenExchangeTransfer = createKrakenExchangeTransfer;
 exports.createNewMfaRecoveryCodes = __createNewMfaRecoveryCodes_wrapped;
 exports.deleteMfaDevice = __deleteMfaDevice_wrapped;
 exports.deletePasskey = __deletePasskey_wrapped;
@@ -8526,6 +9361,7 @@ exports.getAvailableWalletProvidersData = getAvailableWalletProvidersData;
 exports.getBalance = getBalance;
 exports.getBalanceForAddress = getBalanceForAddress;
 exports.getBalances = getBalances;
+exports.getCaptchaSettings = getCaptchaSettings;
 exports.getCheckoutTransaction = getCheckoutTransaction;
 exports.getCheckoutTransactionQuote = getCheckoutTransactionQuote;
 exports.getCoinbaseBuyUrl = getCoinbaseBuyUrl;
@@ -8553,6 +9389,7 @@ exports.getOwnerWalletAccountForSmartWalletAccount = getOwnerWalletAccountForSma
 exports.getPasskeys = getPasskeys;
 exports.getPrimaryWalletAccount = getPrimaryWalletAccount;
 exports.getRegisteredDevices = getRegisteredDevices;
+exports.getSelectedWalletAccount = getSelectedWalletAccount;
 exports.getSwapQuote = getSwapQuote;
 exports.getSwapStatus = getSwapStatus;
 exports.getTokenBalances = getTokenBalances;
@@ -8584,6 +9421,7 @@ exports.isUserOnboardingComplete = require_isUserOnboardingComplete.isUserOnboar
 exports.isWalletAccountVerified = isWalletAccountVerified;
 exports.logout = logout;
 exports.matchWalletProvidersToCatalogGroup = matchWalletProvidersToCatalogGroup;
+exports.mergeUserAccounts = mergeUserAccounts;
 exports.offEvent = require_updateAuthFromVerifyResponse.offEvent;
 exports.offWalletProviderEvent = offWalletProviderEvent;
 exports.onEvent = require_updateAuthFromVerifyResponse.onEvent;
@@ -8608,6 +9446,7 @@ exports.sendSmsOTP = __sendSmsOTP_wrapped;
 exports.setCaptchaToken = require_getNetworkProviderFromNetworkId.__setCaptchaToken_wrapped;
 exports.setDefaultMfaDevice = __setDefaultMfaDevice_wrapped;
 exports.setInstrumentationEnabled = __setInstrumentationEnabled_wrapped;
+exports.setSelectedWalletAccount = __setSelectedWalletAccount_wrapped;
 exports.signInWithExternalJwt = __signInWithExternalJwt_wrapped;
 exports.signInWithPasskey = __signInWithPasskey_wrapped;
 exports.signInWithSocialPopUp = __signInWithSocialPopUp_wrapped;