@dynamic-labs-sdk/client 1.3.0 → 1.4.0

package/dist/index.esm.js

@@ -1,8 +1,8 @@
-import { A as extractSessionId, B as name, C as isCookieEnabled, D as instrumentFunction, E as __getElevatedAccessToken_wrapped, F as getDefaultClient, I as setDefaultClient, O as DEFAULT_PII_FIELDS, P as NONCE_POOL_SIZE, R as BaseError, T as ValueMustBeDefinedError, V as version, _ as MfaRateLimitedError, a as DYNAMIC_ICONIC_SPRITE_URL, b as InvalidExternalAuthError, c as CHAINS_INFO_MAP, d as UnauthorizedError, g as SandboxMaximumThresholdReachedError, h as getNonce, j as randomString, k as getUserAgent, l as fetchAndStoreNonces, o as SDK_API_CORE_VERSION, s as getChainFromVerifiedCredentialChain, t as InvalidParamError, u as createApiClient, v as MfaInvalidOtpError, w as assertDefined, x as APIError, y as LinkCredentialError, z as getCore } from "./InvalidParamError-Za4cvW7K.esm.js";
-import { A as INITIALIZE_STORAGE_SYNC_TRACKER_KEY, C as createLogger, D as createDeferredPromise, E as CannotTrackError, F as __logoutWithReason_wrapped, G as isEqualShallow, H as isSignedIn, I as generateSessionKeys, L as fetchProjectSettings, M as REFRESH_USER_STATE_FROM_VALID_TOKEN_TRACKER_KEY, N as isServerSideRendering, O as FETCH_PROJECT_SETTINGS_TRACKER_KEY, P as getBuffer, R as createStorageKeySchema, S as createKeychainService, U as retryOnFail, V as createLocalStorageAdapter, W as subscribeWithSelector, _ as MethodNotImplementedError, a as updateWalletProviderKeysForVerifiedCredentials, b as getKeychainIndexedDBName, c as createSignInMessageStatement, d as setUnverifiedWalletAccounts, f as createVisit, g as isCaptchaRequired, h as consumeCaptchaToken, i as getNetworksData, j as REFRESH_USER_STATE_FROM_COOKIE_TRACKER_KEY, k as GENERATE_SESSION_KEYS_TRACKER_KEY, l as formatSignInMessage, m as __setCaptchaToken_wrapped, o as verifyMessageSignatureOwnership, p as hasExtension, s as removeUnverifiedWalletAccount, t as getNetworkProviderFromNetworkId, u as getAppMetadata, v as WalletAlreadyLinkedToAnotherUserError, w as createCrossTabBroadcast, x as createRealtimeService, y as NoNetworkProvidersError, z as createStorage } from "./getNetworkProviderFromNetworkId-RWcIZDgC.esm.js";
-import { A as onceEvent, C as formatWalletAccountId, D as emitEvent, O as offEvent, T as splitWalletProviderKey, _ as getWalletProviderRegistry, a as parseElevatedAccessToken, b as getWalletAccounts, d as isUserMissingMfaAuth, f as checkAndRaiseWalletAccountsChangedEvent, g as WalletProviderPriority, h as getWalletProviderFromWalletAccount, i as upsertElevatedAccessToken, k as onEvent, n as getWalletProviderByKey, o as restoreUserSharesForAllWalletAccounts, p as emitWalletAccountsChangedEvent, r as updateAuthFromVerifyResponse, t as getVerifiedCredentialForWalletAccount, u as getWalletProviders, w as normalizeAddress, y as NoWalletProviderFoundError } from "./getVerifiedCredentialForWalletAccount-Ozctwnyv.esm.js";
-import { n as __refreshAuth_wrapped, t as NotWaasWalletAccountError } from "./NotWaasWalletAccountError-By3Y4taq.esm.js";
-import { n as getMfaMethods, r as __consumeMfaToken_wrapped, t as isMfaRequiredForAction } from "./isMfaRequiredForAction-C1u4Z__n.esm.js";
+import { A as getUserAgent, B as getCore, C as isCookieEnabled, D as instrumentFunction, E as __getElevatedAccessToken_wrapped, F as NONCE_POOL_SIZE, H as version, I as getDefaultClient, L as setDefaultClient, M as randomString, O as scrubParameters, T as ValueMustBeDefinedError, V as name, _ as MfaRateLimitedError, a as DYNAMIC_ICONIC_SPRITE_URL, b as InvalidExternalAuthError, c as CHAINS_INFO_MAP, d as UnauthorizedError, g as SandboxMaximumThresholdReachedError, h as getNonce, j as extractSessionId, k as DEFAULT_PII_FIELDS, l as fetchAndStoreNonces, o as SDK_API_CORE_VERSION, s as getChainFromVerifiedCredentialChain, t as InvalidParamError, u as createApiClient, v as MfaInvalidOtpError, w as assertDefined, x as APIError, y as LinkCredentialError, z as BaseError } from "./InvalidParamError-BPMi0iWC.esm.js";
+import { A as GENERATE_SESSION_KEYS_TRACKER_KEY, B as createStorage, C as createKeychainService, D as CannotTrackError, F as getBuffer, G as subscribeWithSelector, H as createLocalStorageAdapter, I as __logoutWithReason_wrapped, K as isEqualShallow, L as generateSessionKeys, M as REFRESH_USER_STATE_FROM_COOKIE_TRACKER_KEY, N as REFRESH_USER_STATE_FROM_VALID_TOKEN_TRACKER_KEY, O as createDeferredPromise, P as isServerSideRendering, R as fetchProjectSettings, S as createRealtimeService, T as createCrossTabBroadcast, U as isSignedIn, W as retryOnFail, _ as isCaptchaRequired, a as verifyMessageSignatureOwnership, b as NoNetworkProvidersError, c as formatSignInMessage, d as updateWalletProviderKeysForVerifiedCredentials, f as setUnverifiedWalletAccounts, g as consumeCaptchaToken, h as __setCaptchaToken_wrapped, i as getNetworksData, j as INITIALIZE_STORAGE_SYNC_TRACKER_KEY, k as FETCH_PROJECT_SETTINGS_TRACKER_KEY, l as getAppMetadata, m as hasExtension, o as removeUnverifiedWalletAccount, p as createVisit, s as createSignInMessageStatement, t as getNetworkProviderFromNetworkId, u as reconcileWalletAccountsAgainstClient, v as MethodNotImplementedError, w as createLogger, x as getKeychainIndexedDBName, y as WalletAlreadyLinkedToAnotherUserError, z as createStorageKeySchema } from "./getNetworkProviderFromNetworkId-CEeFL-gV.esm.js";
+import { A as onceEvent, C as formatWalletAccountId, D as emitEvent, O as offEvent, T as splitWalletProviderKey, _ as getWalletProviderRegistry, a as parseElevatedAccessToken, b as getWalletAccounts, d as isUserMissingMfaAuth, f as checkAndRaiseWalletAccountsChangedEvent, g as WalletProviderPriority, h as getWalletProviderFromWalletAccount, i as upsertElevatedAccessToken, k as onEvent, n as getWalletProviderByKey, o as restoreUserSharesForAllWalletAccounts, r as updateAuthFromVerifyResponse, t as getVerifiedCredentialForWalletAccount, u as getWalletProviders, w as normalizeAddress, y as NoWalletProviderFoundError } from "./getVerifiedCredentialForWalletAccount-DzwIoeHm.esm.js";
+import { n as __refreshAuth_wrapped, t as NotWaasWalletAccountError } from "./NotWaasWalletAccountError-Cntietge.esm.js";
+import { n as getMfaMethods, r as __consumeMfaToken_wrapped, t as isMfaRequiredForAction } from "./isMfaRequiredForAction-D9p_du8C.esm.js";
 import { assertPackageVersion } from "@dynamic-labs-sdk/assert-package-version";
 import { AuthModeEnum, ExchangeKeyEnum, JwtVerifiedCredentialFormatEnum, MFAAction, MfaBackupCodeAcknowledgement, ProviderEnum, TokenScope, WaasBackupOptionsEnum, WalletProviderEnum } from "@dynamic-labs/sdk-api-core";
 import * as z from "zod/mini";
@@ -25,6 +25,36 @@ const stateChangeEvents = {
 	user: "userChanged"
 };
 
+//#endregion
+//#region src/utils/appendConnectionUriToDeeplink/appendConnectionUriToDeeplink.ts
+/**
+* Appends a wallet connection URI to a deeplink URL.
+*
+* Generic across URI-deeplink connection options — works for both
+* WalletConnect pairing URIs and MetaMask SDK URIs. Determines the
+* appropriate query parameter separator based on whether the deeplink
+* already contains query parameters.
+*
+* @param params.deeplinkUrl - The base deeplink URL (e.g., `walletapp://wc` or `walletapp://wc?param=value`).
+* @param params.connectionUri - The connection URI to append.
+* @returns The deeplink URL with the connection URI appended as a query parameter.
+*
+* @example
+* ```ts
+* appendConnectionUriToDeeplink({ deeplinkUrl: 'walletapp://wc', connectionUri: 'wc:123-456' })
+* // Returns: 'walletapp://wc?uri=wc%3A123-456'
+*
+* appendConnectionUriToDeeplink({ deeplinkUrl: 'walletapp://wc?param=value', connectionUri: 'wc:123-456' })
+* // Returns: 'walletapp://wc?param=value&uri=wc%3A123-456'
+* ```
+* @not-instrumented
+*/
+const appendConnectionUriToDeeplink = ({ connectionUri, deeplinkUrl }) => {
+	const url = new URL(deeplinkUrl);
+	url.searchParams.set("uri", connectionUri);
+	return url.href;
+};
+
 //#endregion
 //#region src/utils/getNonce/prefetchNoncesIfNeeded/prefetchNoncesIfNeeded.ts
 /** @not-instrumented */
@@ -626,10 +656,13 @@ const connectLoggerToInstrumentation = ({ environmentId, extensions, instrumenta
 		const { token, user } = state.get();
 		instrumentation.log({
 			environmentId,
-			parameters: {
-				args,
-				message
-			},
+			parameters: scrubParameters({
+				piiFields: instrumentation.config.piiFields,
+				value: {
+					args,
+					message
+				}
+			}),
 			registeredExtensionKeys: Array.from(extensions),
 			sdkSessionId,
 			sdkVersion,
@@ -1541,6 +1574,7 @@ const __checkStepUpAuth_wrapped = instrumentFunction({
 * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
 * @returns A promise that resolves to the assertion response containing the elevated access token.
 * @instrumented
+* @redact-params
 */
 const requestExternalAuthElevatedToken = async ({ externalJwt }, client = getDefaultClient()) => {
 	const core = getCore(client);
@@ -1568,7 +1602,8 @@ const __requestExternalAuthElevatedToken_wrapped = instrumentFunction({
 		} catch {
 			return;
 		}
-	}
+	},
+	redactAll: true
 });
 
 //#endregion
@@ -1720,6 +1755,7 @@ const serverRegisterPasskey = async ({ registration, createMfaToken }, client) =
 * @returns A promise that resolves to the registration response.
 * @throws NoWebAuthNSupportError If WebAuthn is not supported by the browser.
 * @instrumented
+* @redact-params
 */
 const registerPasskey = async ({ createMfaToken } = {}, client = getDefaultClient()) => {
 	const core = getCore(client);
@@ -1742,7 +1778,8 @@ const __registerPasskey_wrapped = instrumentFunction({
 		} catch {
 			return;
 		}
-	}
+	},
+	redactAll: true
 });
 
 //#endregion
@@ -1787,6 +1824,7 @@ const serverSigninPasskey = async ({ authentication, createMfaToken }, client) =
 * @returns A promise that resolves to the authentication response.
 * @throws NoWebAuthNSupportError If WebAuthn is not supported by the browser.
 * @instrumented
+* @redact-params
 */
 const signInWithPasskey = async ({ relatedOriginRpId } = {}, client = getDefaultClient()) => {
 	const core = getCore(client);
@@ -1806,7 +1844,8 @@ const __signInWithPasskey_wrapped = instrumentFunction({
 		} catch {
 			return;
 		}
-	}
+	},
+	redactAll: true
 });
 
 //#endregion
@@ -2248,6 +2287,7 @@ const getPrimaryWalletAccount = (client = getDefaultClient()) => {
 * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
 * @returns A promise that resolves to the verify response.
 * @instrumented
+* @redact-params
 */
 const unlinkSocialAccount = async ({ verifiedCredentialId }, client = getDefaultClient()) => {
 	const core = getCore(client);
@@ -2273,7 +2313,8 @@ const __unlinkSocialAccount_wrapped = instrumentFunction({
 		} catch {
 			return;
 		}
-	}
+	},
+	redactAll: true
 });
 
 //#endregion
@@ -2355,6 +2396,52 @@ const createCheckoutApiClient = async ({ transactionId }, client) => {
 	};
 };
 
+//#endregion
+//#region src/modules/checkout/utils/clearCheckoutSessionToken/clearCheckoutSessionToken.ts
+/**
+* Removes the locally stored checkout session token for the given transaction.
+*
+* The checkout session token is the anonymous credential that authorizes
+* mutations to a single in-flight checkout transaction. Once the transaction
+* has reached a terminal state (cancelled, expired, failed, completed) it can
+* no longer be advanced, and the token is dead weight that should not be
+* persisted in browser storage — leaving it around lets a later XSS payload
+* exfiltrate a credential with no further use, and it can also confuse the
+* SDK on subsequent loads into believing an active session exists.
+*
+* The server-side revocation lives in dashboard-api; this is the SDK-side
+* defense-in-depth.
+*
+* @not-instrumented
+*/
+const clearCheckoutSessionToken = async ({ transactionId }, client) => {
+	await getCore(client).storage.removeItem(createCheckoutSessionTokenStorageKey(transactionId));
+};
+
+//#endregion
+//#region src/modules/checkout/utils/withCheckoutSessionTokenCleanupOn401/withCheckoutSessionTokenCleanupOn401.ts
+/**
+* Checkout mutation routes are guarded server-side only by session-token
+* validation, so a 401 means the token is dead (revoked, expired, deleted,
+* or invalid). Leaving a dead token in `localStorage` widens the XSS
+* exfiltration surface for no benefit and makes the next SDK load attempt
+* requests that are guaranteed to fail.
+*
+* @not-instrumented
+*/
+const withCheckoutSessionTokenCleanupOn401 = async ({ call, transactionId }, client) => {
+	try {
+		return await call();
+	} catch (error) {
+		if (error instanceof APIError && error.status === 401) try {
+			await clearCheckoutSessionToken({ transactionId }, client);
+		} catch (cleanupError) {
+			getCore(client).logger.error("Failed to clear checkout session token after 401", cleanupError);
+		}
+		throw error;
+	}
+};
+
 //#endregion
 //#region src/modules/checkout/attachCheckoutTransactionSource/attachCheckoutTransactionSource.ts
 /**
@@ -2379,12 +2466,15 @@ const attachCheckoutTransactionSource = async (params, client = getDefaultClient
 		attachSourceRequest.fromChainId = params.fromChainId;
 		attachSourceRequest.fromChainName = params.fromChainName;
 	}
-	return apiClient.attachSource({
-		attachSourceRequest,
-		environmentId,
-		transactionId,
-		xDynamicCheckoutSessionToken: sessionToken
-	});
+	return withCheckoutSessionTokenCleanupOn401({
+		call: () => apiClient.attachSource({
+			attachSourceRequest,
+			environmentId,
+			transactionId,
+			xDynamicCheckoutSessionToken: sessionToken
+		}),
+		transactionId
+	}, client);
 };
 const __attachCheckoutTransactionSource_impl = attachCheckoutTransactionSource;
 const __attachCheckoutTransactionSource_wrapped = instrumentFunction({
@@ -2415,12 +2505,15 @@ const __attachCheckoutTransactionSource_wrapped = instrumentFunction({
 */
 const broadcastCheckoutTransaction = async ({ transactionId, txHash }, client = getDefaultClient()) => {
 	const { apiClient, environmentId, sessionToken } = await createCheckoutApiClient({ transactionId }, client);
-	return apiClient.recordCheckoutBroadcast({
-		environmentId,
-		recordBroadcastRequest: { txHash },
-		transactionId,
-		xDynamicCheckoutSessionToken: sessionToken
-	});
+	return withCheckoutSessionTokenCleanupOn401({
+		call: () => apiClient.recordCheckoutBroadcast({
+			environmentId,
+			recordBroadcastRequest: { txHash },
+			transactionId,
+			xDynamicCheckoutSessionToken: sessionToken
+		}),
+		transactionId
+	}, client);
 };
 const __broadcastCheckoutTransaction_impl = broadcastCheckoutTransaction;
 const __broadcastCheckoutTransaction_wrapped = instrumentFunction({
@@ -2447,12 +2540,15 @@ const __broadcastCheckoutTransaction_wrapped = instrumentFunction({
 */
 const cancelCheckoutTransaction = async ({ transactionId }, client = getDefaultClient()) => {
 	const { apiClient, environmentId, sessionToken } = await createCheckoutApiClient({ transactionId }, client);
-	const result = await apiClient.cancelCheckoutTransaction({
-		environmentId,
-		transactionId,
-		xDynamicCheckoutSessionToken: sessionToken
-	});
-	await getCore(client).storage.removeItem(createCheckoutSessionTokenStorageKey(transactionId));
+	const result = await withCheckoutSessionTokenCleanupOn401({
+		call: () => apiClient.cancelCheckoutTransaction({
+			environmentId,
+			transactionId,
+			xDynamicCheckoutSessionToken: sessionToken
+		}),
+		transactionId
+	}, client);
+	await clearCheckoutSessionToken({ transactionId }, client);
 	return result;
 };
 const __cancelCheckoutTransaction_impl = cancelCheckoutTransaction;
@@ -2553,16 +2649,19 @@ const getCheckoutTransaction = async ({ transactionId }, client = getDefaultClie
 */
 const getCheckoutTransactionQuote = async ({ fromChainId, fromTokenAddress, slippage, transactionId }, client = getDefaultClient()) => {
 	const { apiClient, environmentId, sessionToken } = await createCheckoutApiClient({ transactionId }, client);
-	return apiClient.quoteCheckoutTransaction({
-		environmentId,
-		quoteRequest: {
-			fromChainId,
-			fromTokenAddress,
-			slippage
-		},
-		transactionId,
-		xDynamicCheckoutSessionToken: sessionToken
-	});
+	return withCheckoutSessionTokenCleanupOn401({
+		call: () => apiClient.quoteCheckoutTransaction({
+			environmentId,
+			quoteRequest: {
+				fromChainId,
+				fromTokenAddress,
+				slippage
+			},
+			transactionId,
+			xDynamicCheckoutSessionToken: sessionToken
+		}),
+		transactionId
+	}, client);
 };
 
 //#endregion
@@ -2579,15 +2678,18 @@ const getCheckoutTransactionQuote = async ({ fromChainId, fromTokenAddress, slip
 */
 const prepareCheckoutTransaction = async ({ assertBalanceForGasCost, assertBalanceForTransferAmount, transactionId }, client = getDefaultClient()) => {
 	const { apiClient, environmentId, sessionToken } = await createCheckoutApiClient({ transactionId }, client);
-	return apiClient.prepareCheckoutTransaction({
-		environmentId,
-		prepareSigningRequest: {
-			assertBalanceForGasCost: assertBalanceForGasCost ?? false,
-			assertBalanceForTransferAmount: assertBalanceForTransferAmount ?? false
-		},
-		transactionId,
-		xDynamicCheckoutSessionToken: sessionToken
-	});
+	return withCheckoutSessionTokenCleanupOn401({
+		call: () => apiClient.prepareCheckoutTransaction({
+			environmentId,
+			prepareSigningRequest: {
+				assertBalanceForGasCost: assertBalanceForGasCost ?? false,
+				assertBalanceForTransferAmount: assertBalanceForTransferAmount ?? false
+			},
+			transactionId,
+			xDynamicCheckoutSessionToken: sessionToken
+		}),
+		transactionId
+	}, client);
 };
 const __prepareCheckoutTransaction_impl = prepareCheckoutTransaction;
 const __prepareCheckoutTransaction_wrapped = instrumentFunction({
@@ -3838,7 +3940,7 @@ const getWalletConnectCatalogWalletByWalletProviderKey = async ({ walletProvider
 //#region src/modules/walletOptionsCatalogue/resolveWalletBookWalletOptionKey/resolveWalletBookWalletOptionKey.ts
 /**
 * Resolves which wallet option (group) a wallet book entry belongs to. Used
-* by the catalogue's wallet-book-driven transformers (`walletConnect`,
+* by the catalogue's wallet-book-driven transformers (URI deeplink,
 * `inAppBrowser`, `installation`) to bucket their emitted options.
 *
 * Wallet book entries inconsistently use `group` / `chainGroup` /
@@ -3993,30 +4095,50 @@ const buildInstallationUrlsByWalletOptionKey = ({ walletBook }) => {
 };
 
 //#endregion
-//#region src/modules/walletOptionsCatalogue/buildWalletConnectOptions/buildWalletConnectOptions.ts
+//#region src/modules/walletOptionsCatalogue/buildUriDeeplinkOptions/resolveUriConnectionType/resolveUriConnectionType.ts
+/**
+* Picks the connection-option `type` discriminator for a wallet-book-
+* derived URI deeplink option. MetaMask is steered toward its own
+* MetaMask SDK URI connection extension (`metamaskSdkUri`) so we route
+* customers off generic WalletConnect for that wallet; every other
+* wallet uses the standard `walletConnect` discriminator.
+*
+* @param params.walletOptionKey - The resolved wallet option key.
+* @returns The connection-option discriminator to emit.
+* @not-instrumented
+*/
+const resolveUriConnectionType = ({ walletOptionKey }) => walletOptionKey === "metamask" ? "metamaskSdkUri" : "walletConnect";
+
+//#endregion
+//#region src/modules/walletOptionsCatalogue/buildUriDeeplinkOptions/buildUriDeeplinkOptions.ts
 /**
-* A wallet only deserves a `walletConnect` catalogue option if it has at
-* least one mobile deeplink — that's the value-add the option provides over
-* the bare WC pairing URI. Wallets that exist in the wallet book but don't
-* expose a deeplink (rare, but present) are silently skipped.
+* A wallet only deserves a URI-deeplink catalogue option if it has at
+* least one mobile deeplink — that's the value-add the option provides
+* over the bare pairing URI. Wallets that exist in the wallet book but
+* don't expose a deeplink (rare, but present) are silently skipped.
 */
 const hasUsableDeeplink = ({ wallet }) => Boolean(wallet.mobile?.native || wallet.mobile?.universal);
 /**
-* Builds the `walletConnect` catalogue options from a fetched wallet book.
+* Builds the URI-deeplink catalogue options from a fetched wallet book.
 * Applies the WalletConnect-specific eligibility filter
 * (`shouldFilterWalletForWalletConnect`) so embedded wallets and entries
 * without `sign_v2` support are excluded — same surface as
 * `getWalletConnectCatalog`.
 *
 * Each emitted option carries the wallet's mobile deeplinks. Customers
-* combine these with their chain's `connectWithWalletConnect<Chain>` URI via
-* `appendWalletConnectUriToDeepLink` to open the wallet's app.
+* combine these with their chain's connection URI via
+* `appendConnectionUriToDeeplink` to open the wallet's app:
+*
+* - `'walletConnect'`: mint via `connectWithWalletConnect<Chain>`.
+* - `'metamaskSdkUri'`: mint via `connectWithMetaMaskUriEvm` or
+*   `connectWithMetaMaskUriSolana`. Emitted only for the MetaMask
+*   wallet entry — see `resolveUriConnectionType`.
 *
 * @param params.walletBook - The fetched wallet book.
-* @returns Tagged `walletConnect` options paired with their wallet option keys.
+* @returns Tagged options paired with their wallet option keys.
 * @not-instrumented
 */
-const buildWalletConnectOptions = ({ walletBook }) => {
+const buildUriDeeplinkOptions = ({ walletBook }) => {
 	const result = [];
 	for (const [walletKey, wallet] of Object.entries(walletBook.wallets)) {
 		if (shouldFilterWalletForWalletConnect({
@@ -4039,7 +4161,7 @@ const buildWalletConnectOptions = ({ walletBook }) => {
 					native: wallet.mobile?.native,
 					universal: wallet.mobile?.universal
 				},
-				type: "walletConnect"
+				type: resolveUriConnectionType({ walletOptionKey })
 			},
 			walletOptionKey
 		});
@@ -4380,10 +4502,11 @@ const groupOptionsByWalletOption = ({ options }) => {
 * wallet-option list is ordered — that's controlled by
 * `WalletOptionOrdering`.
 *
-* `withWalletProvider > walletConnect > inAppBrowser`
+* `withWalletProvider > walletConnect / metamaskSdkUri > inAppBrowser`
 */
 const CONNECTION_OPTION_PRIORITY = {
 	inAppBrowser: 2,
+	metamaskSdkUri: 1,
 	walletConnect: 1,
 	withWalletProvider: 0
 };
@@ -4402,7 +4525,7 @@ const getConnectionOptionPriority = ({ option }) => CONNECTION_OPTION_PRIORITY[o
 /**
 * Sorts a wallet option's `connectionOptions` so the most preferred option lands at
 * index 0. Primary sort is by option-type priority
-* (`withWalletProvider` > `walletConnect` > `inAppBrowser`);
+* (`withWalletProvider` > URI deeplink > `inAppBrowser`);
 * within a type, ties break alphabetically by `chain` for deterministic
 * output across calls.
 *
@@ -4526,7 +4649,7 @@ const hasInstalledProvider = ({ walletOption }) => walletOption.connectionOption
 *   this order:
 *     1. **Installed provider** — user already has the wallet available
 *        (`withWalletProvider` at index 0).
-*     2. **Connectable** — has at least one connection (`walletConnect`
+*     2. **Connectable** — has at least one connection (URI deeplink
 *        or `inAppBrowser`) but no installed provider.
 *     3. **Install-only** — no connection at all; only `installationUrls`.
 *   Within each tier, rank by the hand-curated {@link PRIORITY_WALLET_KEYS}
@@ -4576,45 +4699,28 @@ const EMPTY_WALLET_BOOK = {
 	wallets: {}
 };
 /**
-* Returns a catalogue of the external wallet options a user can sign in
-* with through this client. Each wallet option carries an ordered
-* `connectionOptions` array — `withWalletProvider` (direct), `walletConnect`
-* (deeplink/QR), or `inAppBrowser` (mobile webview). Wallet options without
-* any matching connections are omitted.
-*
-* `includeWithWalletProvider` defaults to `true`; all other inclusion flags
-* are opt-in. `walletOptionOrdering` defaults to `'relevance'` (Dynamic's
-* recommended order); pass `'alphabetical'` to sort by wallet option name
-* within each option-priority tier.
+* Returns the catalogue of external wallet options a user can sign in
+* with through this client. Always includes installed wallet providers;
+* pass `includeMobileOptions: true` to additionally surface
+* WalletConnect, in-app-browser, and install links.
 *
-* The wallet book is fetched only when an enabled flag needs it
-* (`includeWalletConnect`, `includeInAppBrowser`). Calls that only need
-* `includeWithWalletProvider` skip the fetch entirely.
-*
-* @param [params] - Inclusion flags + ordering preference.
+* @param [params] - Inclusion flag + ordering preference.
 * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
 * @returns A promise that resolves to the wallet options catalogue.
 * @not-instrumented
 */
 const getWalletOptionsCatalogue = async (params = {}, client = getDefaultClient()) => {
-	const includeWithWalletProvider = params.includeWithWalletProvider ?? true;
-	const includeWalletConnect = params.includeWalletConnect ?? false;
-	const includeInAppBrowser = params.includeInAppBrowser ?? false;
-	const includeInstallation = params.includeInstallation ?? false;
+	const includeMobileOptions = params.includeMobileOptions ?? false;
 	const walletOptionOrdering = params.walletOptionOrdering ?? "relevance";
-	if (!includeWithWalletProvider && !includeWalletConnect && !includeInAppBrowser && !includeInstallation) return [];
-	const walletBook = includeWalletConnect || includeInAppBrowser || includeInstallation ? await fetchLegacyWalletBook(client) : EMPTY_WALLET_BOOK;
+	const walletBook = includeMobileOptions ? await fetchLegacyWalletBook(client) : EMPTY_WALLET_BOOK;
 	const allConnectionOptions = [];
-	if (includeWithWalletProvider) {
-		const entries = getWalletProviderRegistry(client).listProviderEntries();
-		allConnectionOptions.push(...buildWithWalletProviderOptions({
-			entries,
-			walletBook
-		}, client));
-	}
-	if (includeWalletConnect) allConnectionOptions.push(...buildWalletConnectOptions({ walletBook }));
-	if (includeInAppBrowser) allConnectionOptions.push(...buildInAppBrowserOptions({ walletBook }));
-	const installationUrlsByKey = includeInstallation ? buildInstallationUrlsByWalletOptionKey({ walletBook }) : /* @__PURE__ */ new Map();
+	const entries = getWalletProviderRegistry(client).listProviderEntries();
+	allConnectionOptions.push(...buildWithWalletProviderOptions({
+		entries,
+		walletBook
+	}, client));
+	if (includeMobileOptions) allConnectionOptions.push(...buildUriDeeplinkOptions({ walletBook }), ...buildInAppBrowserOptions({ walletBook }));
+	const installationUrlsByKey = includeMobileOptions ? buildInstallationUrlsByWalletOptionKey({ walletBook }) : /* @__PURE__ */ new Map();
 	const grouped = groupOptionsByWalletOption({ options: allConnectionOptions });
 	const allWalletOptionKeys = new Set([...grouped.keys(), ...installationUrlsByKey.keys()]);
 	const walletOptions = [];
@@ -4894,6 +5000,7 @@ const authenticateTotpMfaDevice = async ({ deviceId, code, createMfaTokenOptions
 * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
 * @returns A promise that resolves to the newly generated recovery codes.
 * @instrumented
+* @redact-params
 */
 const createNewMfaRecoveryCodes = async (client = getDefaultClient()) => {
 	const core = getCore(client);
@@ -4909,7 +5016,8 @@ const __createNewMfaRecoveryCodes_wrapped = instrumentFunction({
 		} catch {
 			return;
 		}
-	}
+	},
+	redactAll: true
 });
 
 //#endregion
@@ -6136,6 +6244,7 @@ const verifyOTPForUserUpdate = async ({ otpVerification, verificationToken, requ
 * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
 * @returns A promise that resolves to the verify response object upon successful verification.
 * @instrumented
+* @redact-params
 */
 const verifyOTP = async ({ otpVerification, verificationToken, requestedScopes }, client = getDefaultClient()) => {
 	let response;
@@ -6161,7 +6270,8 @@ const __verifyOTP_wrapped = instrumentFunction({
 		} catch {
 			return;
 		}
-	}
+	},
+	redactAll: true
 });
 
 //#endregion
@@ -6585,13 +6695,12 @@ const getAddressesWithTypesFromConnectionResult = (connectionResult) => {
 * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
 * @returns A promise that resolves to the connected wallet account.
 * @throws NoAddressFoundError If the request to connect was successful but no address is connected to your app.
-* @instrumented
+*  @instrumented
 */
 const connectWithWalletProvider = async ({ walletProviderKey, addToDynamicWalletAccounts = true, hardwareWalletVendor }, client = getDefaultClient()) => {
 	const walletProvider = getWalletProviderByKey({ walletProviderKey }, client);
 	assertWalletProviderMethodDefined(walletProvider, "connect");
 	const { addresses } = await walletProvider.connect();
-	const currentAddresses = getWalletAccounts(client).map(({ address }) => address);
 	const mainAddress = addresses?.length ? addresses[0].address : null;
 	/**
 	* This error is thrown in case the wallet has no addresses connected
@@ -6599,27 +6708,25 @@ const connectWithWalletProvider = async ({ walletProviderKey, addToDynamicWallet
 	* user on the next steps.
 	*/
 	if (!mainAddress) throw new NoAddressFoundError();
-	const walletAccount = {
-		address: mainAddress,
-		addressesWithTypes: getAddressesWithTypesFromConnectionResult({ addresses }),
-		chain: walletProvider.chain,
-		hardwareWalletVendor,
-		id: formatWalletAccountId({
+	const [reconciledWalletAccount] = reconcileWalletAccountsAgainstClient({
+		addToDynamicWalletAccounts,
+		walletAccounts: [{
 			address: mainAddress,
+			addressesWithTypes: getAddressesWithTypesFromConnectionResult({ addresses }),
 			chain: walletProvider.chain,
+			hardwareWalletVendor,
+			id: formatWalletAccountId({
+				address: mainAddress,
+				chain: walletProvider.chain,
+				walletProviderKey
+			}),
+			lastSelectedAt: null,
+			verifiedCredentialId: null,
 			walletProviderKey
-		}),
-		lastSelectedAt: null,
-		verifiedCredentialId: null,
+		}],
 		walletProviderKey
-	};
-	if (currentAddresses.includes(mainAddress)) return walletAccount;
-	if (addToDynamicWalletAccounts) {
-		setUnverifiedWalletAccounts({ unverifiedWalletAccountsToUpdate: [walletAccount] }, client);
-		emitWalletAccountsChangedEvent(client);
-		createVisit({ walletAccount }, client);
-	}
-	return walletAccount;
+	}, client);
+	return reconciledWalletAccount;
 };
 const __connectWithWalletProvider_impl = connectWithWalletProvider;
 const __connectWithWalletProvider_wrapped = instrumentFunction({
@@ -7550,5 +7657,5 @@ const parseUserAgent = ({ userAgent }) => {
 assertPackageVersion(name, version);
 
 //#endregion
-export { BaseError, CheckoutSessionTokenMissingError, ClientAlreadyInitializedError, DeeplinkConnectAndVerifyUnsupportedError, FeeEstimationFailedError, GOOGLE_DRIVE_BACKUP_REQUIRED_SCOPES, InvalidDeviceRegistrationRedirectError, InvalidExternalAuthError, InvalidParamError, InvalidRedirectStorageStateError, InvalidSocialCallbackOriginError, LinkCredentialError, MFAAction, MfaInvalidOtpError, MfaRateLimitedError, MissingRedirectStorageStateError, MissingSocialUrlParamError, MissingUserVerificationError, NetworkAddingUnavailableError, NetworkNotAddedError, NetworkSwitchingUnavailableError, NoAddressFoundError, NoNetworkProvidersError, NoPasskeyCredentialsFoundError, NoSmartWalletAccountSignerFoundError, NoWebAuthNSupportError, NotWaasWalletAccountError, SandboxMaximumThresholdReachedError, SimulationFailedError, TokenSwapError, UnauthorizedError, UnavailableInServerSideError, UnrecognizedNetworkError, UserCancelledSocialPopUpError, UserNotAuthenticatedError, UserRejectedError, WalletAccountAlreadyVerifiedError, WalletAccountNotSelectedError, WalletAlreadyLinkedToAnotherUserError, WalletProviderMethodUnavailableError, __acknowledgeRecoveryCodes_wrapped as acknowledgeRecoveryCodes, addCoinbaseOnrampOrderEventListener, __addNetwork_wrapped as addNetwork, assertWalletAccountSigningAvailability, assertWalletProviderMethodDefined, __attachCheckoutTransactionSource_wrapped as attachCheckoutTransactionSource, authenticateMfaRecoveryCode, authenticatePasskeyMFA, authenticateTotpMfaDevice, __authenticateWithSocial_wrapped as authenticateWithSocial, __broadcastCheckoutTransaction_wrapped as broadcastCheckoutTransaction, canConnectWithHardwareWallet, __cancelCheckoutTransaction_wrapped as cancelCheckoutTransaction, __checkStepUpAuth_wrapped as checkStepUpAuth, __completeDeviceRegistration_wrapped as completeDeviceRegistration, __completeSocialAuthentication_wrapped as completeSocialAuthentication, __completeSocialRedirect_wrapped as completeSocialRedirect, __confirmTransaction_wrapped as confirmTransaction, __connectAndVerifyWithWalletProvider_wrapped as connectAndVerifyWithWalletProvider, __connectWithWalletProvider_wrapped as connectWithWalletProvider, __consumeMfaToken_wrapped as consumeMfaToken, __createCheckoutTransaction_wrapped as createCheckoutTransaction, __createCoinbaseOnrampOrder_wrapped as createCoinbaseOnrampOrder, __createCryptoDotComPayment_wrapped as createCryptoDotComPayment, __createDynamicClient_wrapped as createDynamicClient, __createKrakenExchangeTransfer_wrapped as createKrakenExchangeTransfer, __createNewMfaRecoveryCodes_wrapped as createNewMfaRecoveryCodes, __deleteMfaDevice_wrapped as deleteMfaDevice, __deletePasskey_wrapped as deletePasskey, __deleteUser_wrapped as deleteUser, detectDeviceRegistrationRedirect, detectOAuthRedirect, detectSocialRedirectUrl, excludeInstalledFromCatalog, __executeSwapTransaction_wrapped as executeSwapTransaction, fetchProjectSettings, findMissingGoogleDriveBackupScopes, getActiveNetworkData, getActiveNetworkId, getAvailableWalletProvidersData, getBalance, getBalanceForAddress, getBalances, getCheckoutTransaction, getCheckoutTransactionQuote, getCoinbaseBuyUrl, getConnectedAddresses, getDefaultClient, getDeviceRegistrationTokenFromUrl, __getElevatedAccessToken_wrapped as getElevatedAccessToken, __getGoogleDriveBackupReadiness_wrapped as getGoogleDriveBackupReadiness, getKrakenAccounts, getKrakenWhitelistedAddresses, getMfaDevices, getMfaMethods, getMfaRecoveryCodes, getMissingVerificationForCoinbaseOnrampOrder, getMultichainBalances, getNetworksData, getOwnerWalletAccountForSmartWalletAccount, getPasskeys, getPrimaryWalletAccount, getRegisteredDevices, getSwapQuote, getSwapStatus, getTransactionHistory, getUserSocialAccounts, getWalletAccountAddressByType, getWalletAccountFromAddress, getWalletAccounts, getWalletConnectCatalog, getWalletConnectCatalogWalletByWalletProviderKey, getWalletOptionsCatalogue, getWalletProviderDataByKey, hasAllGoogleDriveBackupScopes, hasExtension, __initializeClient_wrapped as initializeClient, isCaptchaRequired, isDeeplinkWalletProvider, isDeviceRegistrationRequired, isHardwareWalletAccount, isInsufficientGoogleDriveScopesError, isMfaRequiredForAction, isMobile, isPendingRecoveryCodesAcknowledgment, isProgrammaticNetworkSwitchAvailable, isSignedIn, isUserMissingMfaAuth, isUserOnboardingComplete, isWalletAccountVerified, logout, matchWalletProvidersToCatalogGroup, offEvent, offWalletProviderEvent, onEvent, onWalletProviderEvent, onceEvent, parseUserAgent, __prepareCheckoutTransaction_wrapped as prepareCheckoutTransaction, __proveWalletAccountOwnership_wrapped as proveWalletAccountOwnership, __refreshAuth_wrapped as refreshAuth, __refreshUser_wrapped as refreshUser, __registerPasskey_wrapped as registerPasskey, __registerTotpMfaDevice_wrapped as registerTotpMfaDevice, __removeWalletAccount_wrapped as removeWalletAccount, __requestExternalAuthElevatedToken_wrapped as requestExternalAuthElevatedToken, requiresConversion, __revokeAllRegisteredDevices_wrapped as revokeAllRegisteredDevices, __revokeRegisteredDevice_wrapped as revokeRegisteredDevice, __selectPrimaryWalletAccount_wrapped as selectPrimaryWalletAccount, __sendEmailOTP_wrapped as sendEmailOTP, __sendSmsOTP_wrapped as sendSmsOTP, __setCaptchaToken_wrapped as setCaptchaToken, __setDefaultMfaDevice_wrapped as setDefaultMfaDevice, __setInstrumentationEnabled_wrapped as setInstrumentationEnabled, __signInWithExternalJwt_wrapped as signInWithExternalJwt, __signInWithPasskey_wrapped as signInWithPasskey, __signInWithSocialPopUp_wrapped as signInWithSocialPopUp, __signInWithSocialRedirect_wrapped as signInWithSocialRedirect, __signMessage_wrapped as signMessage, __submitCheckoutTransaction_wrapped as submitCheckoutTransaction, supportedCountries, __switchActiveNetwork_wrapped as switchActiveNetwork, trackCheckoutTransaction, __transferAmount_wrapped as transferAmount, __transferWalletAccount_wrapped as transferWalletAccount, __unlinkSocialAccount_wrapped as unlinkSocialAccount, __updateUser_wrapped as updateUser, __verifyOTP_wrapped as verifyOTP, __verifyWalletAccount_wrapped as verifyWalletAccount, waitForClientInitialized };
+export { BaseError, CheckoutSessionTokenMissingError, ClientAlreadyInitializedError, DeeplinkConnectAndVerifyUnsupportedError, FeeEstimationFailedError, GOOGLE_DRIVE_BACKUP_REQUIRED_SCOPES, InvalidDeviceRegistrationRedirectError, InvalidExternalAuthError, InvalidParamError, InvalidRedirectStorageStateError, InvalidSocialCallbackOriginError, LinkCredentialError, MFAAction, MfaInvalidOtpError, MfaRateLimitedError, MissingRedirectStorageStateError, MissingSocialUrlParamError, MissingUserVerificationError, NetworkAddingUnavailableError, NetworkNotAddedError, NetworkSwitchingUnavailableError, NoAddressFoundError, NoNetworkProvidersError, NoPasskeyCredentialsFoundError, NoSmartWalletAccountSignerFoundError, NoWebAuthNSupportError, NotWaasWalletAccountError, SandboxMaximumThresholdReachedError, SimulationFailedError, TokenSwapError, UnauthorizedError, UnavailableInServerSideError, UnrecognizedNetworkError, UserCancelledSocialPopUpError, UserNotAuthenticatedError, UserRejectedError, WalletAccountAlreadyVerifiedError, WalletAccountNotSelectedError, WalletAlreadyLinkedToAnotherUserError, WalletProviderMethodUnavailableError, __acknowledgeRecoveryCodes_wrapped as acknowledgeRecoveryCodes, addCoinbaseOnrampOrderEventListener, __addNetwork_wrapped as addNetwork, appendConnectionUriToDeeplink, assertWalletAccountSigningAvailability, assertWalletProviderMethodDefined, __attachCheckoutTransactionSource_wrapped as attachCheckoutTransactionSource, authenticateMfaRecoveryCode, authenticatePasskeyMFA, authenticateTotpMfaDevice, __authenticateWithSocial_wrapped as authenticateWithSocial, __broadcastCheckoutTransaction_wrapped as broadcastCheckoutTransaction, canConnectWithHardwareWallet, __cancelCheckoutTransaction_wrapped as cancelCheckoutTransaction, __checkStepUpAuth_wrapped as checkStepUpAuth, __completeDeviceRegistration_wrapped as completeDeviceRegistration, __completeSocialAuthentication_wrapped as completeSocialAuthentication, __completeSocialRedirect_wrapped as completeSocialRedirect, __confirmTransaction_wrapped as confirmTransaction, __connectAndVerifyWithWalletProvider_wrapped as connectAndVerifyWithWalletProvider, __connectWithWalletProvider_wrapped as connectWithWalletProvider, __consumeMfaToken_wrapped as consumeMfaToken, __createCheckoutTransaction_wrapped as createCheckoutTransaction, __createCoinbaseOnrampOrder_wrapped as createCoinbaseOnrampOrder, __createCryptoDotComPayment_wrapped as createCryptoDotComPayment, __createDynamicClient_wrapped as createDynamicClient, __createKrakenExchangeTransfer_wrapped as createKrakenExchangeTransfer, __createNewMfaRecoveryCodes_wrapped as createNewMfaRecoveryCodes, __deleteMfaDevice_wrapped as deleteMfaDevice, __deletePasskey_wrapped as deletePasskey, __deleteUser_wrapped as deleteUser, detectDeviceRegistrationRedirect, detectOAuthRedirect, detectSocialRedirectUrl, excludeInstalledFromCatalog, __executeSwapTransaction_wrapped as executeSwapTransaction, fetchProjectSettings, findMissingGoogleDriveBackupScopes, getActiveNetworkData, getActiveNetworkId, getAvailableWalletProvidersData, getBalance, getBalanceForAddress, getBalances, getCheckoutTransaction, getCheckoutTransactionQuote, getCoinbaseBuyUrl, getConnectedAddresses, getDefaultClient, getDeviceRegistrationTokenFromUrl, __getElevatedAccessToken_wrapped as getElevatedAccessToken, __getGoogleDriveBackupReadiness_wrapped as getGoogleDriveBackupReadiness, getKrakenAccounts, getKrakenWhitelistedAddresses, getMfaDevices, getMfaMethods, getMfaRecoveryCodes, getMissingVerificationForCoinbaseOnrampOrder, getMultichainBalances, getNetworksData, getOwnerWalletAccountForSmartWalletAccount, getPasskeys, getPrimaryWalletAccount, getRegisteredDevices, getSwapQuote, getSwapStatus, getTransactionHistory, getUserSocialAccounts, getWalletAccountAddressByType, getWalletAccountFromAddress, getWalletAccounts, getWalletConnectCatalog, getWalletConnectCatalogWalletByWalletProviderKey, getWalletOptionsCatalogue, getWalletProviderDataByKey, hasAllGoogleDriveBackupScopes, hasExtension, __initializeClient_wrapped as initializeClient, isCaptchaRequired, isDeeplinkWalletProvider, isDeviceRegistrationRequired, isHardwareWalletAccount, isInsufficientGoogleDriveScopesError, isMfaRequiredForAction, isMobile, isPendingRecoveryCodesAcknowledgment, isProgrammaticNetworkSwitchAvailable, isSignedIn, isUserMissingMfaAuth, isUserOnboardingComplete, isWalletAccountVerified, logout, matchWalletProvidersToCatalogGroup, offEvent, offWalletProviderEvent, onEvent, onWalletProviderEvent, onceEvent, parseUserAgent, __prepareCheckoutTransaction_wrapped as prepareCheckoutTransaction, __proveWalletAccountOwnership_wrapped as proveWalletAccountOwnership, __refreshAuth_wrapped as refreshAuth, __refreshUser_wrapped as refreshUser, __registerPasskey_wrapped as registerPasskey, __registerTotpMfaDevice_wrapped as registerTotpMfaDevice, __removeWalletAccount_wrapped as removeWalletAccount, __requestExternalAuthElevatedToken_wrapped as requestExternalAuthElevatedToken, requiresConversion, __revokeAllRegisteredDevices_wrapped as revokeAllRegisteredDevices, __revokeRegisteredDevice_wrapped as revokeRegisteredDevice, __selectPrimaryWalletAccount_wrapped as selectPrimaryWalletAccount, __sendEmailOTP_wrapped as sendEmailOTP, __sendSmsOTP_wrapped as sendSmsOTP, __setCaptchaToken_wrapped as setCaptchaToken, __setDefaultMfaDevice_wrapped as setDefaultMfaDevice, __setInstrumentationEnabled_wrapped as setInstrumentationEnabled, __signInWithExternalJwt_wrapped as signInWithExternalJwt, __signInWithPasskey_wrapped as signInWithPasskey, __signInWithSocialPopUp_wrapped as signInWithSocialPopUp, __signInWithSocialRedirect_wrapped as signInWithSocialRedirect, __signMessage_wrapped as signMessage, __submitCheckoutTransaction_wrapped as submitCheckoutTransaction, supportedCountries, __switchActiveNetwork_wrapped as switchActiveNetwork, trackCheckoutTransaction, __transferAmount_wrapped as transferAmount, __transferWalletAccount_wrapped as transferWalletAccount, __unlinkSocialAccount_wrapped as unlinkSocialAccount, __updateUser_wrapped as updateUser, __verifyOTP_wrapped as verifyOTP, __verifyWalletAccount_wrapped as verifyWalletAccount, waitForClientInitialized };
 //# sourceMappingURL=index.esm.js.map