@dynamic-labs-sdk/client 1.3.0 → 1.5.0

package/dist/{InvalidParamError-Za4cvW7K.esm.js → InvalidParamError-DWjMfOZ5.esm.js}

@@ -1,12 +1,13 @@
-import { AuthStorageEnum, Configuration, SDKApi, isDeviceNonceSignatureRequiredForUrl } from "@dynamic-labs/sdk-api-core";
+import { AuthStorageEnum, Configuration, JwtVerifiedCredentialFormatEnum, SDKApi, WalletProviderEnum, isDeviceNonceSignatureRequiredForUrl } from "@dynamic-labs/sdk-api-core";
+import * as z from "zod/mini";
 
 //#region package.json
 var name = "@dynamic-labs-sdk/client";
-var version = "1.3.0";
+var version = "1.5.0";
 var dependencies = {
 	"@dynamic-labs-sdk/assert-package-version": "workspace:*",
-	"@dynamic-labs-wallet/browser-wallet-client": "0.0.351",
-	"@dynamic-labs-wallet/forward-mpc-client": "0.9.0",
+	"@dynamic-labs-wallet/browser-wallet-client": "1.0.7",
+	"@dynamic-labs-wallet/forward-mpc-client": "0.10.1",
 	"@dynamic-labs/sdk-api-core": "catalog:",
 	"@simplewebauthn/browser": "13.1.0",
 	"ably": "2.17.1",
@@ -188,19 +189,50 @@ const getUserAgent = () => {
 
 //#endregion
 //#region src/services/instrumentation/constants.ts
+/**
+* Default key-based PII scrubber list, lowercased and matched against the
+* lowercased object key.
+*
+* Two complementary mechanisms cover credential leakage:
+*
+* 1. Explicit keys listed here — matched exactly (case-insensitive). Use this
+*    for keys that don't end in a generic credential suffix (e.g. `mnemonic`,
+*    `seed`, `verificationCode`, `keyShare`).
+* 2. Suffix matching in {@link scrubParameters} for the credential suffixes
+*    enumerated by {@link PII_KEY_SUFFIXES} — catches any field whose name
+*    ends in `token` or `jwt` (e.g. `mfaToken`, `minifiedJwt`, `accessToken`,
+*    `idToken`, `captchaToken`, …) without needing to enumerate them here.
+*/
 const DEFAULT_PII_FIELDS = [
 	"password",
 	"token",
 	"secret",
 	"privateKey",
+	"privateJwk",
 	"mnemonic",
 	"seed",
+	"keyShare",
+	"keyShares",
 	"email",
 	"phone",
 	"ssn",
 	"address",
-	"authorization"
+	"authorization",
+	"verificationCode",
+	"recoveryCodes",
+	"codeVerifier",
+	"pkce",
+	"bearer",
+	"apiKey"
 ];
+/**
+* Lowercased suffixes used by {@link scrubParameters} to match credential-like
+* keys without enumerating every variant (e.g. `mfaToken`, `accessToken`,
+* `refreshToken`, `legacyToken`, `minifiedJwt`). Only suffixes that are
+* unambiguously credentials belong here — `key` (matches `publicKey`) and
+* `code` (matches `countryCode`) are too broad and must not be added.
+*/
+const PII_KEY_SUFFIXES = ["token", "jwt"];
 const REDACTED_VALUE = "[REDACTED]";
 const MAX_STRING_LENGTH = 500;
 const TRUNCATED_SUFFIX = "...[truncated]";
@@ -219,8 +251,23 @@ const CIRCULAR_VALUE = "[Circular]";
 
 //#endregion
 //#region src/services/instrumentation/scrubParameters/scrubParameters.ts
+/**
+* Returns true when `key` should be redacted based on the configured PII
+* field list. A key matches when its lowercased form either equals one of
+* `piiFieldsLower` exactly, or ends in one of the curated credential
+* suffixes in {@link PII_KEY_SUFFIXES} (currently `token` and `jwt`). The
+* suffix check is what catches `mfaToken`, `minifiedJwt`, `accessToken`,
+* etc. without needing every variant enumerated explicitly.
+*/
+const keyMatchesPiiField = ({ keyLower, piiFieldsLower }) => {
+	if (piiFieldsLower.includes(keyLower)) return true;
+	return PII_KEY_SUFFIXES.some((suffix) => keyLower.endsWith(suffix));
+};
 const scrubString = ({ key, piiFieldsLower, redactAll, value }) => {
-	if (piiFieldsLower.includes(key.toLowerCase())) return REDACTED_VALUE;
+	if (keyMatchesPiiField({
+		keyLower: key.toLowerCase(),
+		piiFieldsLower
+	})) return REDACTED_VALUE;
 	if (redactAll) return REDACTED_VALUE;
 	if (value.length > MAX_STRING_LENGTH) return value.slice(0, MAX_STRING_LENGTH) + TRUNCATED_SUFFIX;
 	return value;
@@ -251,7 +298,10 @@ const scrubObject = ({ context, value }) => {
 const scrubValue = ({ context, key, value }) => {
 	if (value === null || value === void 0) return value;
 	if (value instanceof Uint8Array) return `[${BINARY_LABEL}:${value.byteLength} bytes]`;
-	if (context.piiFieldsLower.includes(key.toLowerCase())) return REDACTED_VALUE;
+	if (keyMatchesPiiField({
+		keyLower: key.toLowerCase(),
+		piiFieldsLower: context.piiFieldsLower
+	})) return REDACTED_VALUE;
 	if (typeof value === "string") return scrubString({
 		key,
 		piiFieldsLower: context.piiFieldsLower,
@@ -859,109 +909,186 @@ const createDeviceSignatureHeadersMiddleware = (client) => {
 };
 
 //#endregion
-//#region src/errors/UnauthorizedError.ts
-var UnauthorizedError = class extends BaseError {
-	constructor({ cause }) {
+//#region src/utils/setCookie/setCookie.ts
+/**
+* Sefelly sets the cookie in the browser.
+* @not-instrumented
+*/
+const setCookie = (cookie) => {
+	document.cookie = cookie;
+};
+
+//#endregion
+//#region src/modules/clientEvents/clientEvents.ts
+/**
+* Adds an event listener for Dynamic client events.
+*
+* This function allows you to listen for various events emitted by the Dynamic client,
+* such as authentication state changes, wallet connections, and more.
+*
+* @param params.event - The event name to listen for.
+* @param params.listener - The callback function to execute when the event is fired.
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns A function that can be called to remove the listener.
+* @not-instrumented
+*/
+const onEvent = ({ event, listener }, client = getDefaultClient()) => {
+	const { eventEmitter } = getCore(client);
+	eventEmitter.on(event, listener);
+	return () => {
+		eventEmitter.off(event, listener);
+	};
+};
+/**
+* Removes an event listener from Dynamic client events.
+*
+* This function unsubscribes a previously registered event listener
+* from the specified Dynamic client event.
+*
+* @param params.event - The event name to remove the listener from.
+* @param params.listener - The callback function to remove.
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @not-instrumented
+*/
+const offEvent = ({ event, listener }, client = getDefaultClient()) => {
+	const { eventEmitter } = getCore(client);
+	eventEmitter.off(event, listener);
+};
+/**
+* Adds a one-time event listener for Dynamic client events.
+*
+* This function listens for an event that will automatically remove itself
+* after being triggered once.
+*
+* @param params.event - The event name to listen for.
+* @param params.listener - The callback function to execute when the event is fired.
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns A function that can be called to remove the listener before it fires.
+* @not-instrumented
+*/
+const onceEvent = ({ event, listener }, client = getDefaultClient()) => {
+	const { eventEmitter } = getCore(client);
+	eventEmitter.once(event, listener);
+	return () => {
+		eventEmitter.off(event, listener);
+	};
+};
+/**
+* Emits a Dynamic client event.
+*
+* This function triggers an event that will be received by all registered
+* listeners for the specified event type.
+*
+* @param params.event - The event name to emit.
+* @param params.args - The arguments to pass to event listeners.
+* @param client - The Dynamic client instance.
+* @not-instrumented
+*/
+const emitEvent = ({ event, args }, client) => {
+	const { eventEmitter } = getCore(client);
+	eventEmitter.emit(event, args);
+};
+
+//#endregion
+//#region src/utils/retryOnFail/InvalidRetryOnFailCallError.ts
+/**
+* This error is thrown when the `retryOnFail` function is called with an invalid
+* number of retries (i.e. less than 0).
+*/
+var InvalidRetryOnFailCallError = class extends BaseError {
+	constructor(maxRetries) {
 		super({
-			cause,
-			code: "unauthorized_error",
+			cause: null,
+			code: "invalid_retry_on_fail_call_error",
 			docsUrl: null,
-			name: "UnauthorizedError",
-			shortMessage: "Unauthorized"
+			name: "InvalidRetryOnFailCallError",
+			shortMessage: `Invalid retries parameter for retryOnFail call: ${maxRetries}`
 		});
 	}
 };
 
 //#endregion
-//#region src/modules/apiClient/utils/unauthorizedMiddleware/createUnauthorizedMiddleware.ts
+//#region src/utils/retryOnFail/retryOnFail.ts
 /** @not-instrumented */
-const createUnauthorizedMiddleware = () => ({ post: async (context) => {
-	if (context.response.status === 401) {
-		let cause = null;
-		try {
-			const errorBody = await context.response.clone().json();
-			if (errorBody && "error" in errorBody && typeof errorBody.error === "string") cause = new Error(errorBody.error);
-		} catch {}
-		throw new UnauthorizedError({ cause });
+const retryOnFail = async ({ delay = 0, fn, maxRetries }) => {
+	for (let retry = 0; retry <= maxRetries; retry++) try {
+		return await fn();
+	} catch (error) {
+		if (retry >= maxRetries) throw error;
+		if (delay > 0) await new Promise((resolve) => setTimeout(resolve, delay));
 	}
-	return context.response;
-} });
+	/**
+	* Reaching this point should never happen and this
+	* error is thrown to help us debug the issue.
+	*/
+	throw new InvalidRetryOnFailCallError(maxRetries);
+};
 
 //#endregion
-//#region src/modules/apiClient/createApiClient.ts
-/**
-* Returns a new instance of the SDK API client.
-*
-* This is not meant for storing, as it is very light we can create it whenever needed.
-* @not-instrumented
-*/
-const createApiClient = (options = {}, client) => {
-	const core = getCore(client);
-	const coreState = core.state.get();
-	const settings = {
-		basePath: core.apiBaseUrl,
-		headers: {
-			"Content-Type": "application/json",
-			[DYNAMIC_API_VERSION_HEADER]: `API/${DYNAMIC_SDK_API_VERSION}`,
-			[DYNAMIC_REQUEST_ID_HEADER]: randomString({ length: 50 }),
-			[DYNAMIC_SDK_SESSION_ID_HEADER]: core.sdkSessionId,
-			[DYNAMIC_SDK_VERSION_HEADER]: `${CLIENT_SDK_NAME}/${version}`,
-			...core.getApiHeaders(),
-			...options.headers
-		}
-	};
-	if (core.metadata?.universalLink) settings.headers["Origin"] = core.metadata.universalLink;
-	if (client.token) settings.headers.Authorization = `Bearer ${client.token}`;
-	if (client.projectSettings && isCookieEnabled(client)) settings.credentials = "include";
-	if (options.includeMfaToken && coreState.mfaToken) settings.headers[MFA_TOKEN_HEADER] = coreState.mfaToken;
-	if (options.elevatedAccessTokenScope) {
-		const elevatedToken = __getElevatedAccessToken_wrapped({ scope: options.elevatedAccessTokenScope }, client);
-		if (elevatedToken) settings.headers[ELEVATED_ACCESS_TOKEN_HEADER] = elevatedToken;
+//#region src/errors/InvalidWalletProviderKeyError.ts
+var InvalidWalletProviderKeyError = class extends BaseError {
+	constructor(value) {
+		super({
+			cause: null,
+			code: "invalid_wallet_provider_key",
+			docsUrl: null,
+			name: "InvalidWalletProviderKeyError",
+			shortMessage: `Invalid wallet provider key: ${value}. Key must be in the format of <normalizedWalletNameWithChain>:<walletProviderType>[:<suffix>]`
+		});
 	}
-	const sessionPublicKey = getSessionKeys(client)?.publicKey;
-	const isSessionPublicKeyHeaderPresent = settings.headers[SESSION_PUBLIC_KEY_HEADER] !== void 0;
-	if (sessionPublicKey && !isSessionPublicKeyHeaderPresent) settings.headers[SESSION_PUBLIC_KEY_HEADER] = sessionPublicKey;
-	return new SDKApi(new Configuration({
-		...settings,
-		fetchApi: core.fetch,
-		middleware: [
-			createDeviceSignatureHeadersMiddleware(client),
-			createConvertToApiErrorMiddleware({ errorMappers: [...options.errorMappers || [], clientErrorMapper] }),
-			createUnauthorizedMiddleware()
-		]
-	}));
 };
 
 //#endregion
-//#region src/utils/getNonce/fetchAndStoreNonces/fetchAndStoreNonces.ts
-/**
-* Fetches a batch of nonces from the API.
-*
-* Prefetching is critical for iOS deep link wallet providers (e.g. Phantom
-* redirect). On iOS, a network request (like fetching a nonce) between a user
-* action and a deeplink call will break the gesture chain, causing iOS to
-* silently ignore the deeplink. By prefetching nonces ahead of time,
-* `getNonce` can return synchronously from cache and the deeplink fires
-* without an interrupting network round-trip.
-*
-* New nonces are **appended** to the existing pool so that unconsumed entries
-* are not discarded by a background refetch.
-* @not-instrumented
-*/
-const fetchAndStoreNonces = async (client) => {
-	const core = getCore(client);
-	const { environmentId } = core;
-	const { nonces } = await createApiClient({}, client).getNonces({
-		count: NONCE_POOL_SIZE,
-		environmentId
-	});
-	const existing = core.state.get().prefetchedNonces;
-	core.state.set({
-		prefetchedNonces: [...existing, ...nonces],
-		prefetchedNoncesExpiration: Date.now() + NONCE_POOL_EXPIRATION_TIME
-	});
+//#region src/modules/wallets/walletProvider/splitWalletProviderKey/splitWalletProviderKey.ts
+/** @not-instrumented */
+const splitWalletProviderKey = (walletProviderKey) => {
+	const [normalizedWalletNameWithChain, walletProviderType, suffix, ...rest] = walletProviderKey.split(":");
+	if (!normalizedWalletNameWithChain || !Object.values(WalletProviderEnum).includes(walletProviderType) || rest.length > 0) throw new InvalidWalletProviderKeyError(walletProviderKey);
+	return {
+		normalizedWalletNameWithChain,
+		suffix,
+		walletProviderType
+	};
 };
 
+//#endregion
+//#region src/modules/wallets/utils/normalizeAddress/normalizeAddress.ts
+/** @not-instrumented */
+const normalizeAddress = ({ address, chain }) => {
+	let normalizedAddress = address;
+	if (normalizedAddress?.startsWith("0x")) normalizedAddress = normalizedAddress.slice(2);
+	normalizedAddress = ["EVM", "FLOW"].includes(chain) ? normalizedAddress?.toLowerCase() : normalizedAddress;
+	return normalizedAddress;
+};
+
+//#endregion
+//#region src/modules/wallets/utils/formatWalletAccountId/formatWalletAccountId.ts
+/** @not-instrumented */
+const formatWalletAccountId = ({ address, chain, walletProviderKey }) => {
+	const { normalizedWalletNameWithChain } = splitWalletProviderKey(walletProviderKey);
+	return `${normalizedWalletNameWithChain}:${normalizeAddress({
+		address,
+		chain
+	})}`;
+};
+
+//#endregion
+//#region src/modules/wallets/utils/convertUnverifiedWalletAccountToWalletAccount/convertUnverifiedWalletAccountToWalletAccount.ts
+/** @not-instrumented */
+const convertUnverifiedWalletAccountToWalletAccount = ({ unverifiedWalletAccount }) => ({
+	address: unverifiedWalletAccount.address,
+	addressesWithTypes: unverifiedWalletAccount.addressesWithTypes,
+	chain: unverifiedWalletAccount.chain,
+	id: formatWalletAccountId({
+		address: unverifiedWalletAccount.address,
+		chain: unverifiedWalletAccount.chain,
+		walletProviderKey: unverifiedWalletAccount.walletProviderKey
+	}),
+	lastSelectedAt: unverifiedWalletAccount.lastSelectedAt,
+	verifiedCredentialId: null,
+	walletProviderKey: unverifiedWalletAccount.walletProviderKey
+});
+
 //#endregion
 //#region src/modules/wallets/constants.ts
 const CHAINS_INFO_MAP = {
@@ -983,6 +1110,7 @@ const CHAINS_INFO_MAP = {
 	BTC: {
 		apiChainName: "bitcoin",
 		blockchainName: "Bitcoin",
+		legacyWalletBookAliases: ["btc"],
 		verifiedCredentialChainName: "bip122"
 	},
 	COSMOS: {
@@ -1013,6 +1141,7 @@ const CHAINS_INFO_MAP = {
 	SOL: {
 		apiChainName: "solana",
 		blockchainName: "Solana",
+		legacyWalletBookAliases: ["sol"],
 		verifiedCredentialChainName: "solana",
 		waasChainNameOverride: "SVM"
 	},
@@ -1024,6 +1153,7 @@ const CHAINS_INFO_MAP = {
 	STARK: {
 		apiChainName: "starknet",
 		blockchainName: "Starknet",
+		legacyWalletBookAliases: ["stark"],
 		verifiedCredentialChainName: "starknet"
 	},
 	STELLAR: {
@@ -1062,6 +1192,633 @@ const getChainFromVerifiedCredentialChain = (verifiedCredentialChain) => {
 	return chain;
 };
 
+//#endregion
+//#region src/modules/wallets/utils/normalizeWalletNameWithChain/normalizeWalletNameWithChain.ts
+/**
+* Format the raw wallet name and chain to get the value we can use for
+* verified credentials' `walletName` field.
+* @not-instrumented
+*/
+const normalizeWalletNameWithChain = ({ displayName, chain }) => {
+	const sanitizedWalletName = displayName.replace(/[^a-zA-Z0-9]/g, "").toLowerCase();
+	const chainLowered = chain.toLocaleLowerCase();
+	if (sanitizedWalletName.endsWith(chainLowered)) return sanitizedWalletName;
+	return `${sanitizedWalletName}${chainLowered}`;
+};
+
+//#endregion
+//#region src/modules/wallets/utils/formatWalletProviderKey/formatWalletProviderKey.ts
+/**
+* Assembles the wallet provider key from the wallet name, chain, and wallet provider type.
+*
+* The suffix is optional and can be used to add a uniquely identifying string to the key, which
+* might be necessary for some wallet providers (like Wallet Connect).
+*
+* IMPORTANT: Do NOT add a suffix unless absolutely necessary, as it will cause the wallet account
+* to not be able to find its wallet provider when connecting to a new device (it won't be possible
+* to determine the full key just from the Verified Credential data).
+* @not-instrumented
+*/
+const formatWalletProviderKey = ({ suffix, chain, displayName, walletProviderType }) => {
+	return `${normalizeWalletNameWithChain({
+		chain,
+		displayName
+	})}:${walletProviderType}${suffix ? `:${suffix}` : ""}`;
+};
+
+//#endregion
+//#region src/modules/wallets/walletProvider/walletProviderKeyMap/getWalletProviderKeyFromVerifiedCredential/getWalletProviderKeyFromVerifiedCredential.ts
+/** @not-instrumented */
+const getWalletProviderKeyFromVerifiedCredential = ({ verifiedCredential }, client) => {
+	const { walletProviderKeyMap } = getCore(client).state.get();
+	const storedWalletProviderKey = walletProviderKeyMap[verifiedCredential.id];
+	if (storedWalletProviderKey) return { walletProviderKey: storedWalletProviderKey };
+	/**
+	* We fallback to comprising the wallet provider key from walletName and walletProvider.
+	*
+	* Some wallet provider types (like Wallet Connect) also use a special suffix for their wallet provider
+	* keys, so this won't be enough for them.
+	* Therefore, for those specific wallet providers, the wallet account will remain without a wallet provider
+	* and will require reconnection.
+	* Read walletProvider.types.ts for more info.
+	*/
+	assertDefined(verifiedCredential.walletName, `Failed to get wallet provider for verified credential with ID ${verifiedCredential.id}: missing walletName`);
+	assertDefined(verifiedCredential.walletProvider, `Failed to get wallet provider for verified credential with ID ${verifiedCredential.id}: missing walletProvider`);
+	assertDefined(verifiedCredential.chain, `Failed to get wallet provider for verified credential with ID ${verifiedCredential.id}: missing chain`);
+	return { walletProviderKey: formatWalletProviderKey({
+		chain: getChainFromVerifiedCredentialChain(verifiedCredential.chain),
+		displayName: verifiedCredential.walletName,
+		walletProviderType: verifiedCredential.walletProvider
+	}) };
+};
+
+//#endregion
+//#region src/modules/wallets/utils/convertVerifiedCredentialToWalletAccount/convertVerifiedCredentialToWalletAccount.ts
+/** @not-instrumented */
+const convertVerifiedCredentialToWalletAccount = ({ verifiedCredential }, client) => {
+	assertDefined(verifiedCredential.address, "Missing address in verified credential");
+	assertDefined(verifiedCredential.chain, "Missing chain in verified credential");
+	const chain = getChainFromVerifiedCredentialChain(verifiedCredential.chain);
+	const { walletProviderKey } = getWalletProviderKeyFromVerifiedCredential({ verifiedCredential }, client);
+	const walletAccountId = formatWalletAccountId({
+		address: verifiedCredential.address,
+		chain,
+		walletProviderKey
+	});
+	return {
+		address: verifiedCredential.address,
+		addressesWithTypes: verifiedCredential.walletAdditionalAddresses,
+		chain,
+		hardwareWalletVendor: verifiedCredential.walletProperties?.hardwareWallet,
+		id: walletAccountId,
+		lastSelectedAt: verifiedCredential.lastSelectedAt ?? null,
+		verifiedCredentialId: verifiedCredential.id,
+		walletProviderKey
+	};
+};
+
+//#endregion
+//#region src/modules/wallets/getWalletAccounts/getWalletAccountsFromState/getWalletAccountsFromState.ts
+/** @not-instrumented */
+const getWalletAccountsFromState = ({ unverifiedWalletAccounts, user }, client) => {
+	const walletAccountsMap = /* @__PURE__ */ new Map();
+	/**
+	* Handle the unverified wallet accounts before the user verified credentials
+	* so the later verified wallet accounts can override the unverified wallet accounts
+	*/
+	unverifiedWalletAccounts.forEach((unverifiedWalletAccount) => {
+		const walletAccount = convertUnverifiedWalletAccountToWalletAccount({ unverifiedWalletAccount });
+		walletAccountsMap.set(walletAccount.id, walletAccount);
+	});
+	(user?.verifiedCredentials ?? []).filter((verified) => verified.format === JwtVerifiedCredentialFormatEnum.Blockchain).forEach((verifiedWalletAccount) => {
+		const walletAccount = convertVerifiedCredentialToWalletAccount({ verifiedCredential: verifiedWalletAccount }, client);
+		walletAccountsMap.set(walletAccount.id, walletAccount);
+	});
+	return Array.from(walletAccountsMap.values());
+};
+
+//#endregion
+//#region src/modules/wallets/getWalletAccounts/getWalletAccounts.ts
+/**
+* Retrieves all wallet accounts associated with the current session.
+*
+* This function returns both verified and unverified wallet accounts,
+* combining data from user credentials and local unverified accounts.
+* You can differentiate between verified and unverified wallet accounts by
+* checking the `verifiedCredentialId` property.
+*
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns An array of wallet accounts associated with the session.
+* @not-instrumented
+*/
+const getWalletAccounts = (client = getDefaultClient()) => {
+	const { unverifiedWalletAccounts, user } = getCore(client).state.get();
+	return getWalletAccountsFromState({
+		unverifiedWalletAccounts,
+		user
+	}, client);
+};
+
+//#endregion
+//#region src/modules/auth/isSignedIn/isSignedIn.ts
+/**
+* Checks if the user is currently signed in to the Dynamic client.
+*
+* The client is considered to be in a signed in state if a user has
+* authenticated or if the client has at least one wallet connected.
+*
+* @deprecated What counts as "signed in" is your app's business logic, not the
+* SDK's. This helper bakes in one opinion (a user OR any connected wallet),
+* which rarely matches every app and forces a dependency on us for every
+* variation. Compose your own check from the underlying primitives instead —
+* e.g. `Boolean(client.user) || isAnyWalletAccountConnected(client)` — and
+* layer in whatever your app requires (device registration, completed
+* onboarding, satisfied MFA, a required embedded wallet, …). See the
+* "Check if signed in" guide:
+* https://www.dynamic.xyz/docs/javascript/user-session-management
+*
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns True if the user is signed in, false otherwise.
+* @not-instrumented
+*/
+const isSignedIn = (client = getDefaultClient()) => Boolean(client.user || getWalletAccounts(client).length > 0);
+
+//#endregion
+//#region src/services/storage/createStorageKeySchema/createStorageKeySchema.ts
+/** @not-instrumented */
+const createStorageKeySchema = (params) => {
+	return params;
+};
+
+//#endregion
+//#region src/modules/projectSettings/fetchProjectSettings/projectSettingsExpirationScheme.ts
+/**
+* The schema to track the expiration time of the project settings.
+*/
+const projectSettingsExpirationStorageKeySchema = createStorageKeySchema({
+	key: "projectSettingsExpiration",
+	schema: z.number()
+});
+
+//#endregion
+//#region src/modules/projectSettings/fetchProjectSettings/fetchProjectSettings.ts
+/**
+* Expiration time of the project settings in milliseconds.
+*/
+const PROJECT_SETTINGS_EXPIRATION_TIME = 1e3 * 60 * 5;
+/**
+* Fetches and updates the project settings from the API.
+*
+* This function retrieves the latest project configuration settings
+* from Dynamic's servers, including authentication options, enabled chains,
+* and security configurations. The settings are cached for performance.
+*
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns A promise that resolves to the updated project settings.
+* @not-instrumented
+*/
+const fetchProjectSettings = async (client = getDefaultClient()) => {
+	const core = getCore(client);
+	const currentExpiration = await core.storage.getItem(projectSettingsExpirationStorageKeySchema);
+	if (Boolean(client.projectSettings) && !(currentExpiration && currentExpiration < Date.now()) && isSignedIn(client)) return client.projectSettings;
+	const apiClient = createApiClient({}, client);
+	core.logger.debug("[fetchProjectSettings] Fetching project settings...");
+	const doFetch = async () => apiClient.getEnvironmentSettings({
+		environmentId: core.environmentId,
+		sdkVersion: `${CLIENT_SDK_NAME}/${core.version}`
+	}, { credentials: "omit" });
+	const projectSettings = await retryOnFail({
+		fn: doFetch,
+		maxRetries: 2
+	});
+	core.state.set({ projectSettings: projectSettings ?? null });
+	await core.storage.setItem(projectSettingsExpirationStorageKeySchema, Date.now() + PROJECT_SETTINGS_EXPIRATION_TIME);
+	return projectSettings;
+};
+
+//#endregion
+//#region src/modules/sessionKeys/generateSessionKeys/generateSessionKeys.ts
+/** @not-instrumented */
+const generateSessionKeys = async (client) => {
+	const core = getCore(client);
+	await core.keychain.removeKey("session");
+	const publicKey = await core.keychain.generateKey("session");
+	assertDefined(publicKey, "Public key not found");
+	core.state.set({ sessionKeys: publicKey });
+	return { publicKey };
+};
+
+//#endregion
+//#region src/errors/NoWalletProviderFoundError.ts
+var NoWalletProviderFoundError = class extends BaseError {
+	constructor({ walletProviderKey }) {
+		super({
+			cause: null,
+			code: "no_wallet_provider_found_error",
+			docsUrl: null,
+			name: "NoWalletProviderFoundError",
+			shortMessage: `No wallet provider found with key: ${walletProviderKey}`
+		});
+	}
+};
+
+//#endregion
+//#region src/services/runtimeServices/createRuntimeServiceAccessKey/createRuntimeServiceAccessKey.ts
+/**
+* Creates a service accessor function that manages service instantiation and caching.
+* The returned function will either retrieve an existing service from the registry or
+* create a new one using the provided builder function.
+*
+* @template - The type of service to be created/accessed
+* @param key - Unique identifier for the service in the registry
+* @param builder - Function that creates the service instance when called with a DynamicClient
+* @not-instrumented
+*/
+const createRuntimeServiceAccessKey = (key, builder) => (client) => {
+	const { runtimeServices } = getCore(client);
+	const currentService = runtimeServices.getByKey(key);
+	if (currentService) return currentService;
+	const service = builder(client);
+	runtimeServices.register(key, service);
+	return service;
+};
+
+//#endregion
+//#region src/modules/wallets/walletProviderRegistry/createWalletProviderRegistry/createWalletProviderRegistry.ts
+/**
+* Creates a new wallet provider registry that manages wallet providers with priority-based registration.
+*
+* @returns The wallet provider registry instance
+*
+* @example
+* ```typescript
+* const registry = createWalletProviderRegistry();
+*
+* registry.register({
+*   priority: WalletProviderPriority.WALLET_SDK,
+*   walletProvider: myWalletProvider
+* });
+*
+* const provider = registry.getByKey('my-wallet-key');
+* const providers = registry.listProviders();
+* ```
+* @not-instrumented
+*/
+const createWalletProviderRegistry = (client) => {
+	const registry = /* @__PURE__ */ new Map();
+	return {
+		getByKey: (key) => registry.get(key)?.walletProvider,
+		listProviderEntries: () => Array.from(registry.values()),
+		listProviders: () => Array.from(registry.values()).map((v) => v.walletProvider),
+		register: (args) => {
+			const existingEntry = registry.get(args.walletProvider.key);
+			if (existingEntry) {
+				if (existingEntry.priority < args.priority) {
+					registry.set(args.walletProvider.key, args);
+					emitEvent({
+						args: { walletProviderKey: args.walletProvider.key },
+						event: "walletProviderChanged"
+					}, client);
+				}
+			} else {
+				registry.set(args.walletProvider.key, args);
+				emitEvent({
+					args: { walletProvider: args.walletProvider },
+					event: "walletProviderRegistered"
+				}, client);
+				emitEvent({
+					args: { walletProviderKey: args.walletProvider.key },
+					event: "walletProviderChanged"
+				}, client);
+			}
+		},
+		unregister: (key) => {
+			registry.delete(key);
+			emitEvent({
+				args: { walletProviderKey: key },
+				event: "walletProviderUnregistered"
+			}, client);
+		}
+	};
+};
+
+//#endregion
+//#region src/modules/wallets/walletProviderRegistry/getWalletProviderRegistry/getWalletProviderRegistry.ts
+/**
+* This function provides access to a shared instance of the wallet provider registry.
+*
+* It ensures that the same registry instance is used throughout the client to maintaining
+* consistency of registered wallet providers across different parts of the codebase.
+*
+* @returns The wallet provider registry instance
+*
+* @example
+* ```typescript
+* // Get the registry instance
+* const registry = getWalletProviderRegistry();
+*
+* // Register a wallet provider
+* registry.register({
+*   priority: WalletProviderPriority.WALLET_SDK,
+*   walletProvider: myWalletProvider
+* });
+*
+* // Retrieve a specific provider
+* const provider = registry.getByKey('metamaskevm');
+* ```
+*/
+const getWalletProviderRegistry = createRuntimeServiceAccessKey("walletProviderRegistry", (client) => createWalletProviderRegistry(client));
+
+//#endregion
+//#region src/modules/wallets/walletProviderRegistry/walletProviderRegistry.types.ts
+let WalletProviderPriority = /* @__PURE__ */ function(WalletProviderPriority$1) {
+	/**
+	* Highest priority should be used by wallet providers that implement
+	* the most reliable wallet integration.
+	* example: The SDK provided by the wallet provider.
+	*/
+	WalletProviderPriority$1[WalletProviderPriority$1["WALLET_SDK"] = 100] = "WALLET_SDK";
+	/**
+	* Medium priority should be used by wallet providers that implement
+	* a wallet integration via some reliable standard.
+	* example: A wallet provider that uses EIP6963 announcement.
+	*/
+	WalletProviderPriority$1[WalletProviderPriority$1["WALLET_SELF_ANNOUNCEMENT_STANDARD"] = 50] = "WALLET_SELF_ANNOUNCEMENT_STANDARD";
+	/**
+	* Low priority should be used by wallet providers that implement
+	* a wallet integration on a less reliable standard.
+	* example: A wallet provider that uses window.ethereum, where the
+	* window key can be overridden by other extensions.
+	*/
+	WalletProviderPriority$1[WalletProviderPriority$1["WINDOW_INJECT"] = 20] = "WINDOW_INJECT";
+	return WalletProviderPriority$1;
+}({});
+
+//#endregion
+//#region src/modules/wallets/utils/getWalletProviderFromWalletAccount/getWalletProviderFromWalletAccount.ts
+/** @not-instrumented */
+const getWalletProviderFromWalletAccount = ({ walletAccount }, client) => {
+	const walletProvider = getWalletProviderRegistry(client).getByKey(walletAccount.walletProviderKey);
+	if (!walletProvider) throw new NoWalletProviderFoundError({ walletProviderKey: walletAccount.walletProviderKey });
+	return walletProvider;
+};
+
+//#endregion
+//#region src/modules/wallets/utils/getAvailableWalletProvidersFromWalletAccounts/getAvailableWalletProvidersFromWalletAccounts.ts
+/** @not-instrumented */
+const getAvailableWalletProvidersFromWalletAccounts = (client) => {
+	const core = getCore(client);
+	const walletProvidersMap = /* @__PURE__ */ new Map();
+	getWalletAccounts(client).forEach((walletAccount) => {
+		if (walletProvidersMap.has(walletAccount.walletProviderKey)) return;
+		try {
+			const walletProvider = getWalletProviderFromWalletAccount({ walletAccount }, client);
+			walletProvidersMap.set(walletAccount.walletProviderKey, walletProvider);
+		} catch (error) {
+			core.logger.debug("Wallet provider not found for wallet account", {
+				error,
+				walletAccount: walletAccount.address
+			});
+		}
+	});
+	return Array.from(walletProvidersMap.values());
+};
+
+//#endregion
+//#region src/modules/wallets/destroyWalletProviders/destroyWalletProviders.ts
+/**
+* Tear down every wallet provider on the client.
+*
+* Each provider's `destroy` is responsible for its own local + remote
+* cleanup. We swallow errors so a failing destroy on one provider does not
+* block teardown of the others (e.g. during logout).
+*
+* @not-instrumented
+*/
+const destroyWalletProviders = async ({ reason }, client) => {
+	const core = getCore(client);
+	const walletProviders = getAvailableWalletProvidersFromWalletAccounts(client);
+	await Promise.all(walletProviders.map(async (walletProvider) => {
+		if (!walletProvider.destroy) return;
+		try {
+			await walletProvider.destroy({ reason });
+		} catch (err) {
+			core.logger.error(`Error destroying wallet provider ${walletProvider.key}`, err);
+		}
+	}));
+};
+
+//#endregion
+//#region src/modules/auth/consts.ts
+const DYNAMIC_AUTH_COOKIE_NAME = "DYNAMIC_JWT_TOKEN";
+
+//#endregion
+//#region src/modules/auth/logoutWithReason/logoutWithReason.ts
+/**
+* Logs the user out with an explicit reason.
+*
+* Revokes the session, clears auth state, terminates wallet providers, and
+* emits the `logout` client event with the given reason. The reason is also
+* captured as an argument on the function-instrumentation event, which is
+* how Datadog distinguishes between different logout causes.
+*
+* Use this instead of the public `logout` when triggering a logout from
+* internal or extension code — the caller owns the reason string, so the
+* telemetry correctly attributes *why* the logout happened.
+*
+* @param params - The logout params.
+* @param params.reason - Why the logout is being triggered. Extension authors
+*   needing a reason outside the SDK catalog can cast with `as LogoutReason`.
+* @param client - The Dynamic client instance.
+* @instrumented
+*/
+const logoutWithReason = async ({ reason }, client) => {
+	const core = getCore(client);
+	core.logger.debug("[logoutWithReason] Logging out...", { reason });
+	await destroyWalletProviders({ reason }, client);
+	if (client.user !== null) {
+		const apiClient = createApiClient({ skipSessionExpiryLogout: true }, client);
+		try {
+			await apiClient.revokeSession({ environmentId: core.environmentId });
+		} catch (error) {
+			core.logger.error("Failed to revoke session", error);
+		}
+		/**
+		* This deletes the auth cookie if it exists.
+		* If the cookie doesn't exist, this sets a new cookie that expires immediately.
+		*/
+		if (isCookieEnabled(client)) setCookie(`${DYNAMIC_AUTH_COOKIE_NAME}=; Max-Age=-99999999; path=/; SameSite=Lax`);
+	}
+	await core.keychain.removeKey("session");
+	core.state.set({
+		captchaToken: null,
+		elevatedAccessTokens: [],
+		legacyToken: null,
+		mfaToken: null,
+		sessionExpiresAt: null,
+		sessionKeys: null,
+		token: null,
+		unverifiedWalletAccounts: [],
+		user: null
+	});
+	emitEvent({
+		args: { reason },
+		event: "logout"
+	}, client);
+	fetchProjectSettings(client);
+	generateSessionKeys(client);
+};
+const __logoutWithReason_impl = logoutWithReason;
+const __logoutWithReason_wrapped = instrumentFunction({
+	fn: __logoutWithReason_impl,
+	functionName: "logoutWithReason",
+	getCore: () => {
+		try {
+			return getCore(getDefaultClient());
+		} catch {
+			return;
+		}
+	}
+});
+
+//#endregion
+//#region src/modules/apiClient/utils/sessionExpiryLogoutMiddleware/createSessionExpiryLogoutMiddleware.ts
+const UNAUTHORIZED_STATUS = 401;
+/**
+* Creates middleware that ends the local session when an *authenticated*
+* request is rejected with a 401.
+*
+* A 401 on a request that carried an authenticated session means the backend
+* rejected our credentials, so the local session is stale and must be cleared.
+* The check is purely local (`client.user`) — we deliberately do not
+* re-validate over the network, because the 401 itself is the rejection signal
+* and re-validating would route back through this same middleware.
+*
+* Requests made without an authenticated session (e.g. pre-auth probes) are
+* ignored — there is no session to invalidate. Endpoints that legitimately
+* return 401 for non-session reasons opt out of this behavior by omitting the
+* middleware (see `skipSessionExpiryLogout` on `createApiClient`).
+*
+* This middleware runs before the error-conversion middleware so it observes
+* every 401 regardless of response body. The logout is fired as a side effect
+* and the response is returned unchanged, so the downstream error middleware
+* still throws the typed error to the caller.
+*
+* @param client - The Dynamic client instance.
+* @not-instrumented
+*/
+const createSessionExpiryLogoutMiddleware = (client) => ({ post: async (context) => {
+	if (context.response.status === UNAUTHORIZED_STATUS && client.user !== null) __logoutWithReason_wrapped({ reason: "session-revoked" }, client).catch((error) => {
+		getCore(client).logger.error("Failed to log out after unauthorized response", error);
+	});
+	return context.response;
+} });
+
+//#endregion
+//#region src/errors/UnauthorizedError.ts
+var UnauthorizedError = class extends BaseError {
+	constructor({ cause }) {
+		super({
+			cause,
+			code: "unauthorized_error",
+			docsUrl: null,
+			name: "UnauthorizedError",
+			shortMessage: "Unauthorized"
+		});
+	}
+};
+
+//#endregion
+//#region src/modules/apiClient/utils/unauthorizedMiddleware/createUnauthorizedMiddleware.ts
+/** @not-instrumented */
+const createUnauthorizedMiddleware = () => ({ post: async (context) => {
+	if (context.response.status === 401) {
+		let cause = null;
+		try {
+			const errorBody = await context.response.clone().json();
+			if (errorBody && "error" in errorBody && typeof errorBody.error === "string") cause = new Error(errorBody.error);
+		} catch {}
+		throw new UnauthorizedError({ cause });
+	}
+	return context.response;
+} });
+
+//#endregion
+//#region src/modules/apiClient/createApiClient.ts
+/**
+* Returns a new instance of the SDK API client.
+*
+* This is not meant for storing, as it is very light we can create it whenever needed.
+* @not-instrumented
+*/
+const createApiClient = (options = {}, client) => {
+	const core = getCore(client);
+	const coreState = core.state.get();
+	const settings = {
+		basePath: core.apiBaseUrl,
+		headers: {
+			"Content-Type": "application/json",
+			[DYNAMIC_API_VERSION_HEADER]: `API/${DYNAMIC_SDK_API_VERSION}`,
+			[DYNAMIC_REQUEST_ID_HEADER]: randomString({ length: 50 }),
+			[DYNAMIC_SDK_SESSION_ID_HEADER]: core.sdkSessionId,
+			[DYNAMIC_SDK_VERSION_HEADER]: `${CLIENT_SDK_NAME}/${version}`,
+			...core.getApiHeaders(),
+			...options.headers
+		}
+	};
+	if (core.metadata?.universalLink) settings.headers["Origin"] = core.metadata.universalLink;
+	if (client.token) settings.headers.Authorization = `Bearer ${client.token}`;
+	if (client.projectSettings && isCookieEnabled(client)) settings.credentials = "include";
+	if (options.includeMfaToken && coreState.mfaToken) settings.headers[MFA_TOKEN_HEADER] = coreState.mfaToken;
+	if (options.elevatedAccessTokenScope) {
+		const elevatedToken = __getElevatedAccessToken_wrapped({ scope: options.elevatedAccessTokenScope }, client);
+		if (elevatedToken) settings.headers[ELEVATED_ACCESS_TOKEN_HEADER] = elevatedToken;
+	}
+	const sessionPublicKey = getSessionKeys(client)?.publicKey;
+	const isSessionPublicKeyHeaderPresent = settings.headers[SESSION_PUBLIC_KEY_HEADER] !== void 0;
+	if (sessionPublicKey && !isSessionPublicKeyHeaderPresent) settings.headers[SESSION_PUBLIC_KEY_HEADER] = sessionPublicKey;
+	return new SDKApi(new Configuration({
+		...settings,
+		fetchApi: core.fetch,
+		middleware: [
+			createDeviceSignatureHeadersMiddleware(client),
+			...options.skipSessionExpiryLogout ? [] : [createSessionExpiryLogoutMiddleware(client)],
+			createConvertToApiErrorMiddleware({ errorMappers: [...options.errorMappers || [], clientErrorMapper] }),
+			createUnauthorizedMiddleware()
+		]
+	}));
+};
+
+//#endregion
+//#region src/utils/getNonce/fetchAndStoreNonces/fetchAndStoreNonces.ts
+/**
+* Fetches a batch of nonces from the API.
+*
+* Prefetching is critical for iOS deep link wallet providers (e.g. Phantom
+* redirect). On iOS, a network request (like fetching a nonce) between a user
+* action and a deeplink call will break the gesture chain, causing iOS to
+* silently ignore the deeplink. By prefetching nonces ahead of time,
+* `getNonce` can return synchronously from cache and the deeplink fires
+* without an interrupting network round-trip.
+*
+* New nonces are **appended** to the existing pool so that unconsumed entries
+* are not discarded by a background refetch.
+* @not-instrumented
+*/
+const fetchAndStoreNonces = async (client) => {
+	const core = getCore(client);
+	const { environmentId } = core;
+	const { nonces } = await createApiClient({}, client).getNonces({
+		count: NONCE_POOL_SIZE,
+		environmentId
+	});
+	const existing = core.state.get().prefetchedNonces;
+	core.state.set({
+		prefetchedNonces: [...existing, ...nonces],
+		prefetchedNoncesExpiration: Date.now() + NONCE_POOL_EXPIRATION_TIME
+	});
+};
+
 //#endregion
 //#region src/constants.ts
 const SDK_API_CORE_VERSION = dependencies["@dynamic-labs/sdk-api-core"];
@@ -1092,5 +1849,5 @@ var InvalidParamError = class extends BaseError {
 };
 
 //#endregion
-export { extractSessionId as A, name as B, isCookieEnabled as C, instrumentFunction as D, __getElevatedAccessToken_wrapped as E, getDefaultClient as F, setDefaultClient as I, ClientNotFoundError as L, CLIENT_SDK_NAME as M, DYNAMIC_SDK_API_VERSION as N, DEFAULT_PII_FIELDS as O, NONCE_POOL_SIZE as P, BaseError as R, getSessionKeys as S, ValueMustBeDefinedError as T, version as V, MfaRateLimitedError as _, DYNAMIC_ICONIC_SPRITE_URL as a, InvalidExternalAuthError as b, CHAINS_INFO_MAP as c, UnauthorizedError as d, createDeviceSignatureHeadersMiddleware as f, SandboxMaximumThresholdReachedError as g, getNonce as h, DYNAMIC_WAAS_METADATA as i, randomString as j, getUserAgent as k, fetchAndStoreNonces as l, getDeviceSigner as m, DEFAULT_WAAS_BASE_API_URL as n, SDK_API_CORE_VERSION as o, getHeadersForNonceSignedByDeviceSigners as p, DEFAULT_WAAS_BASE_MPC_RELAY_API_URL as r, getChainFromVerifiedCredentialChain as s, InvalidParamError as t, createApiClient as u, MfaInvalidOtpError as v, assertDefined as w, APIError as x, LinkCredentialError as y, getCore as z };
-//# sourceMappingURL=InvalidParamError-Za4cvW7K.esm.js.map
+export { scrubParameters as $, InvalidWalletProviderKeyError as A, getNonce as B, formatWalletProviderKey as C, formatWalletAccountId as D, CHAINS_INFO_MAP as E, onceEvent as F, InvalidExternalAuthError as G, MfaRateLimitedError as H, setCookie as I, isCookieEnabled as J, APIError as K, createDeviceSignatureHeadersMiddleware as L, emitEvent as M, offEvent as N, normalizeAddress as O, onEvent as P, instrumentFunction as Q, getHeadersForNonceSignedByDeviceSigners as R, getWalletAccountsFromState as S, getChainFromVerifiedCredentialChain as T, MfaInvalidOtpError as U, SandboxMaximumThresholdReachedError as V, LinkCredentialError as W, ValueMustBeDefinedError as X, assertDefined as Y, __getElevatedAccessToken_wrapped as Z, generateSessionKeys as _, DYNAMIC_ICONIC_SPRITE_URL as a, DYNAMIC_SDK_API_VERSION as at, isSignedIn as b, createApiClient as c, setDefaultClient as ct, DYNAMIC_AUTH_COOKIE_NAME as d, getCore as dt, DEFAULT_PII_FIELDS as et, getWalletProviderFromWalletAccount as f, name as ft, NoWalletProviderFoundError as g, createRuntimeServiceAccessKey as h, DYNAMIC_WAAS_METADATA as i, CLIENT_SDK_NAME as it, retryOnFail as j, splitWalletProviderKey as k, UnauthorizedError as l, ClientNotFoundError as lt, getWalletProviderRegistry as m, DEFAULT_WAAS_BASE_API_URL as n, extractSessionId as nt, SDK_API_CORE_VERSION as o, NONCE_POOL_SIZE as ot, WalletProviderPriority as p, version as pt, getSessionKeys as q, DEFAULT_WAAS_BASE_MPC_RELAY_API_URL as r, randomString as rt, fetchAndStoreNonces as s, getDefaultClient as st, InvalidParamError as t, getUserAgent as tt, __logoutWithReason_wrapped as u, BaseError as ut, fetchProjectSettings as v, normalizeWalletNameWithChain as w, getWalletAccounts as x, createStorageKeySchema as y, getDeviceSigner as z };
+//# sourceMappingURL=InvalidParamError-DWjMfOZ5.esm.js.map