@dynamic-labs-sdk/client 1.30.2 → 1.31.0

package/dist/{updateAuthFromVerifyResponse-CTvWpZLa.native.esm.js → apiClient-DpzKqY39.native.esm.js}

@@ -1,4 +1,4 @@
-import { AuthStorageEnum, Configuration, JwtVerifiedCredentialFormatEnum, SDKApi, WalletProviderEnum, isDeviceNonceSignatureRequiredForUrl } from "@dynamic-labs/sdk-api-core";
+import { AuthStorageEnum, Configuration, JwtVerifiedCredentialFormatEnum, SDKApi, TokenScope, WalletProviderEnum, isDeviceNonceSignatureRequiredForUrl } from "@dynamic-labs/sdk-api-core";
 import * as z from "zod/mini";
 import AsyncStorage from "@react-native-async-storage/async-storage";
 import { getGenericPassword, resetGenericPassword, setGenericPassword } from "react-native-keychain";
@@ -6,14 +6,18 @@ import { Platform } from "react-native";
 
 //#region package.json
 var name = "@dynamic-labs-sdk/client";
-var version = "1.30.2";
+var version = "1.31.0";
 
 //#endregion
-//#region src/client/core/getCore/getCore.ts
-/** @notInstrumented */
-const getCore = (client) => {
-	return client.__core;
-};
+//#region src/modules/auth/consts.ts
+const DYNAMIC_AUTH_COOKIE_NAME = "DYNAMIC_JWT_TOKEN";
+/**
+* Lists the scopes accepted by authentication and step-up APIs.
+*
+* @see authenticateTotpMfaDevice
+* @see checkStepUpAuth
+*/
+const TokenScope$1 = TokenScope;
 
 //#endregion
 //#region src/errors/base/BaseError.ts
@@ -78,6 +82,13 @@ var BaseError = class BaseError extends Error {
 	}
 };
 
+//#endregion
+//#region src/client/core/getCore/getCore.ts
+/** @notInstrumented */
+const getCore = (client) => {
+	return client.__core;
+};
+
 //#endregion
 //#region src/errors/ClientNotFoundError.ts
 var ClientNotFoundError = class extends BaseError {
@@ -125,11 +136,6 @@ const setDefaultClient = (client) => {
 	numOfInitializedClients++;
 };
 
-//#endregion
-//#region src/utils/getNonce/constants.ts
-const NONCE_POOL_EXPIRATION_TIME = 6e4 * 60 * 24;
-const NONCE_POOL_SIZE = 5;
-
 //#endregion
 //#region src/utils/getPlatform/getPlatform.native.ts
 /**
@@ -258,7 +264,7 @@ const getSessionKeys = (client) => {
 
 //#endregion
 //#region src/generated/dependencyCatalog.ts
-const dependencyCatalog = { "@dynamic-labs/sdk-api-core": "0.12.0" };
+const dependencyCatalog = { "@dynamic-labs/sdk-api-core": "0.25.0" };
 
 //#endregion
 //#region src/constants.ts
@@ -537,6 +543,11 @@ const createBaseApiClient = ({ middleware = [], options = {} }, client) => {
 	}));
 };
 
+//#endregion
+//#region src/utils/getNonce/constants.ts
+const NONCE_POOL_EXPIRATION_TIME = 6e4 * 60 * 24;
+const NONCE_POOL_SIZE = 5;
+
 //#endregion
 //#region src/services/storage/createLocalStorageAdapter/createLocalStorageAdapter.native.ts
 const NAMESPACE = "dynamic";
@@ -665,38 +676,6 @@ const fetchAndStoreNonces = async (client) => {
 	return fetchPromise;
 };
 
-//#endregion
-//#region src/utils/getSecureCookieAttribute/getSecureCookieAttribute.ts
-/**
-* Returns the cookie `Secure` attribute suffix (`'; Secure'`) when the current
-* document is running in a secure context, or an empty string otherwise.
-*
-* The `Secure` attribute prevents the browser from ever transmitting the cookie
-* over an unencrypted `http://` connection, which mitigates cleartext token
-* capture (CWE-614). It is intentionally omitted on insecure/localhost dev,
-* because browsers reject `Secure` cookies set over `http://` and that would
-* silently break local testing.
-*
-* Used when building the Dynamic auth JWT cookie string so the attribute is
-* applied consistently on both the write (sign-in/refresh) and clear (logout)
-* paths.
-*
-* @notInstrumented
-*/
-const getSecureCookieAttribute = () => {
-	return Boolean(globalThis.window?.isSecureContext) || globalThis.location?.protocol === "https:" ? "; Secure" : "";
-};
-
-//#endregion
-//#region src/utils/setCookie/setCookie.ts
-/**
-* Sefelly sets the cookie in the browser.
-* @notInstrumented
-*/
-const setCookie = (cookie) => {
-	document.cookie = cookie;
-};
-
 //#endregion
 //#region src/utils/getNonce/getNonce.ts
 /**
@@ -800,125 +779,54 @@ const createDeviceSignatureHeadersMiddleware = (client) => {
 };
 
 //#endregion
-//#region src/modules/apiClient/createApiClient.ts
-/**
-* Returns a new instance of the SDK API client.
-*
-* This is not meant for storing, as it is very light we can create it whenever needed.
-* @notInstrumented
-*/
-const createApiClient = (options = {}, client) => {
-	return createBaseApiClient({
-		middleware: [createDeviceSignatureHeadersMiddleware(client)],
-		options
-	}, client);
-};
-
-//#endregion
-//#region src/modules/clientEvents/clientEvents.ts
+//#region src/utils/getSecureCookieAttribute/getSecureCookieAttribute.ts
 /**
-* Adds an event listener for Dynamic client events.
-*
-* This function allows you to listen for various events emitted by the Dynamic client,
-* such as authentication state changes, wallet connections, and more.
+* Returns the cookie `Secure` attribute suffix (`'; Secure'`) when the current
+* document is running in a secure context, or an empty string otherwise.
 *
-* @example
-* ```ts
-* const unsubscribe = onEvent({
-*   event: 'walletAdded',
-*   listener: ({ walletAccount }) => {
-*     console.log('Wallet added:', walletAccount.address);
-*   },
-* });
+* The `Secure` attribute prevents the browser from ever transmitting the cookie
+* over an unencrypted `http://` connection, which mitigates cleartext token
+* capture (CWE-614). It is intentionally omitted on insecure/localhost dev,
+* because browsers reject `Secure` cookies set over `http://` and that would
+* silently break local testing.
 *
-* // Later: clean up
-* unsubscribe();
-* ```
+* Used when building the Dynamic auth JWT cookie string so the attribute is
+* applied consistently on both the write (sign-in/refresh) and clear (logout)
+* paths.
 *
-* @param params.event - The event name to listen for.
-* @param params.listener - The callback function to execute when the event is fired.
-* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
-* @returns A function that can be called to remove the listener.
-* @see offEvent
-* @see onceEvent
 * @notInstrumented
-* @hook Event listeners are error-prone to wire up by hand with useEffect.
 */
-const onEvent = ({ event, listener }, client = getDefaultClient()) => {
-	const { eventEmitter } = getCore(client);
-	eventEmitter.on(event, listener);
-	return () => {
-		eventEmitter.off(event, listener);
-	};
+const getSecureCookieAttribute = () => {
+	return Boolean(globalThis.window?.isSecureContext) || globalThis.location?.protocol === "https:" ? "; Secure" : "";
 };
+
+//#endregion
+//#region src/utils/setCookie/setCookie.ts
 /**
-* Removes an event listener from Dynamic client events.
-*
-* This function unsubscribes a previously registered event listener
-* from the specified Dynamic client event.
-*
-* @example
-* ```ts
-* offEvent({ event: 'walletAdded', listener: myListener });
-* ```
-*
-* @param params.event - The event name to remove the listener from.
-* @param params.listener - The callback function to remove.
-* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
-* @see onEvent
-* @see onceEvent
+* Sefelly sets the cookie in the browser.
 * @notInstrumented
 */
-const offEvent = ({ event, listener }, client = getDefaultClient()) => {
-	const { eventEmitter } = getCore(client);
-	eventEmitter.off(event, listener);
+const setCookie = (cookie) => {
+	document.cookie = cookie;
 };
+
+//#endregion
+//#region src/modules/mfa/isUserMissingMfaAuth/isUserMissingMfaAuth.ts
 /**
-* Adds a one-time event listener for Dynamic client events.
-*
-* This function listens for an event that will automatically remove itself
-* after being triggered once.
+* Checks if the user requires additional MFA authentication.
 *
-* @example
-* ```ts
-* onceEvent({
-*   event: 'logout',
-*   listener: () => {
-*     console.log('User logged out');
-*   },
-* });
-* ```
+* This function determines if the current user session requires
+* additional multi-factor authentication to access certain features.
 *
-* @param params.event - The event name to listen for.
-* @param params.listener - The callback function to execute when the event is fired.
 * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
-* @returns A function that can be called to remove the listener before it fires.
-* @see onEvent
-* @see offEvent
-* @notInstrumented
-* @hook Event listeners are error-prone to wire up by hand with useEffect.
-*/
-const onceEvent = ({ event, listener }, client = getDefaultClient()) => {
-	const { eventEmitter } = getCore(client);
-	eventEmitter.once(event, listener);
-	return () => {
-		eventEmitter.off(event, listener);
-	};
-};
-/**
-* Emits a Dynamic client event.
-*
-* This function triggers an event that will be received by all registered
-* listeners for the specified event type.
-*
-* @param params.event - The event name to emit.
-* @param params.args - The arguments to pass to event listeners.
-* @param client - The Dynamic client instance.
+* @returns True if the user needs additional MFA authentication, false otherwise.
 * @notInstrumented
+* @hook Exposed as a hook so consumers reactively know when MFA is still required, updated when the user changes.
 */
-const emitEvent = ({ event, args }, client) => {
-	const { eventEmitter } = getCore(client);
-	eventEmitter.emit(event, args);
+const isUserMissingMfaAuth = (client = getDefaultClient()) => {
+	const user = client.user;
+	assertDefined(user, "User not logged in");
+	return Boolean(user.scope?.includes("requiresAdditionalAuth"));
 };
 
 //#endregion
@@ -1263,20 +1171,6 @@ const getWalletAccounts = (client = getDefaultClient()) => {
 	}, client);
 };
 
-//#endregion
-//#region src/errors/NoWalletProviderFoundError.ts
-var NoWalletProviderFoundError = class extends BaseError {
-	constructor({ walletProviderKey }) {
-		super({
-			cause: null,
-			code: "no_wallet_provider_found_error",
-			docsUrl: null,
-			name: "NoWalletProviderFoundError",
-			shortMessage: `No wallet provider found with key: ${walletProviderKey}`
-		});
-	}
-};
-
 //#endregion
 //#region src/services/runtimeServices/createRuntimeServiceAccessKey/createRuntimeServiceAccessKey.ts
 /**
@@ -1299,46 +1193,153 @@ const createRuntimeServiceAccessKey = (key, builder) => (client) => {
 };
 
 //#endregion
-//#region src/modules/wallets/walletProviderRegistry/createWalletProviderRegistry/createWalletProviderRegistry.ts
+//#region src/modules/clientEvents/clientEvents.ts
 /**
-* Creates a new wallet provider registry that manages wallet providers with priority-based registration.
+* Adds an event listener for Dynamic client events.
 *
-* @returns The wallet provider registry instance
+* This function allows you to listen for various events emitted by the Dynamic client,
+* such as authentication state changes, wallet connections, and more.
 *
 * @example
-* ```typescript
-* const registry = createWalletProviderRegistry();
-*
-* registry.register({
-*   priority: WalletProviderPriority.WALLET_SDK,
-*   walletProvider: myWalletProvider
+* ```ts
+* const unsubscribe = onEvent({
+*   event: 'walletAdded',
+*   listener: ({ walletAccount }) => {
+*     console.log('Wallet added:', walletAccount.address);
+*   },
 * });
 *
-* const provider = registry.getByKey('my-wallet-key');
-* const providers = registry.listProviders();
+* // Later: clean up
+* unsubscribe();
 * ```
+*
+* @param params.event - The event name to listen for.
+* @param params.listener - The callback function to execute when the event is fired.
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns A function that can be called to remove the listener.
+* @see offEvent
+* @see onceEvent
 * @notInstrumented
+* @hook Event listeners are error-prone to wire up by hand with useEffect.
 */
-const createWalletProviderRegistry = (client) => {
-	const registry = /* @__PURE__ */ new Map();
-	return {
-		getByKey: (key) => registry.get(key)?.walletProvider,
-		listProviderEntries: () => Array.from(registry.values()),
-		listProviders: () => Array.from(registry.values()).map((v) => v.walletProvider),
-		register: (args) => {
-			const existingEntry = registry.get(args.walletProvider.key);
-			if (existingEntry) {
-				if (existingEntry.priority < args.priority) {
-					registry.set(args.walletProvider.key, args);
-					emitEvent({
-						args: { walletProviderKey: args.walletProvider.key },
-						event: "walletProviderChanged"
-					}, client);
-				}
-			} else {
-				registry.set(args.walletProvider.key, args);
-				emitEvent({
-					args: { walletProvider: args.walletProvider },
+const onEvent = ({ event, listener }, client = getDefaultClient()) => {
+	const { eventEmitter } = getCore(client);
+	eventEmitter.on(event, listener);
+	return () => {
+		eventEmitter.off(event, listener);
+	};
+};
+/**
+* Removes an event listener from Dynamic client events.
+*
+* This function unsubscribes a previously registered event listener
+* from the specified Dynamic client event.
+*
+* @example
+* ```ts
+* offEvent({ event: 'walletAdded', listener: myListener });
+* ```
+*
+* @param params.event - The event name to remove the listener from.
+* @param params.listener - The callback function to remove.
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @see onEvent
+* @see onceEvent
+* @notInstrumented
+*/
+const offEvent = ({ event, listener }, client = getDefaultClient()) => {
+	const { eventEmitter } = getCore(client);
+	eventEmitter.off(event, listener);
+};
+/**
+* Adds a one-time event listener for Dynamic client events.
+*
+* This function listens for an event that will automatically remove itself
+* after being triggered once.
+*
+* @example
+* ```ts
+* onceEvent({
+*   event: 'logout',
+*   listener: () => {
+*     console.log('User logged out');
+*   },
+* });
+* ```
+*
+* @param params.event - The event name to listen for.
+* @param params.listener - The callback function to execute when the event is fired.
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns A function that can be called to remove the listener before it fires.
+* @see onEvent
+* @see offEvent
+* @notInstrumented
+* @hook Event listeners are error-prone to wire up by hand with useEffect.
+*/
+const onceEvent = ({ event, listener }, client = getDefaultClient()) => {
+	const { eventEmitter } = getCore(client);
+	eventEmitter.once(event, listener);
+	return () => {
+		eventEmitter.off(event, listener);
+	};
+};
+/**
+* Emits a Dynamic client event.
+*
+* This function triggers an event that will be received by all registered
+* listeners for the specified event type.
+*
+* @param params.event - The event name to emit.
+* @param params.args - The arguments to pass to event listeners.
+* @param client - The Dynamic client instance.
+* @notInstrumented
+*/
+const emitEvent = ({ event, args }, client) => {
+	const { eventEmitter } = getCore(client);
+	eventEmitter.emit(event, args);
+};
+
+//#endregion
+//#region src/modules/wallets/walletProviderRegistry/createWalletProviderRegistry/createWalletProviderRegistry.ts
+/**
+* Creates a new wallet provider registry that manages wallet providers with priority-based registration.
+*
+* @returns The wallet provider registry instance
+*
+* @example
+* ```typescript
+* const registry = createWalletProviderRegistry();
+*
+* registry.register({
+*   priority: WalletProviderPriority.WALLET_SDK,
+*   walletProvider: myWalletProvider
+* });
+*
+* const provider = registry.getByKey('my-wallet-key');
+* const providers = registry.listProviders();
+* ```
+* @notInstrumented
+*/
+const createWalletProviderRegistry = (client) => {
+	const registry = /* @__PURE__ */ new Map();
+	return {
+		getByKey: (key) => registry.get(key)?.walletProvider,
+		listProviderEntries: () => Array.from(registry.values()),
+		listProviders: () => Array.from(registry.values()).map((v) => v.walletProvider),
+		register: (args) => {
+			const existingEntry = registry.get(args.walletProvider.key);
+			if (existingEntry) {
+				if (existingEntry.priority < args.priority) {
+					registry.set(args.walletProvider.key, args);
+					emitEvent({
+						args: { walletProviderKey: args.walletProvider.key },
+						event: "walletProviderChanged"
+					}, client);
+				}
+			} else {
+				registry.set(args.walletProvider.key, args);
+				emitEvent({
+					args: { walletProvider: args.walletProvider },
 					event: "walletProviderRegistered"
 				}, client);
 				emitEvent({
@@ -1404,17 +1405,93 @@ const WalletProviderPriority = {
 };
 
 //#endregion
-//#region src/modules/wallets/utils/getWalletProviderFromWalletAccount/getWalletProviderFromWalletAccount.ts
+//#region src/modules/wallets/getWalletProviders/getWalletProviders.ts
+/**
+* Get all available wallet providers to interact with internally.
+* @notInstrumented
+*/
+const getWalletProviders = (client) => {
+	return getWalletProviderRegistry(client).listProviders();
+};
+
+//#endregion
+//#region src/modules/waas/constants.ts
+const DEFAULT_WAAS_BASE_API_URL = "https://app.dynamicauth.com";
+const DEFAULT_WAAS_BASE_MPC_RELAY_API_URL = "https://relay.dynamicauth.com";
+const DYNAMIC_WAAS_METADATA = {
+	displayName: "Dynamic WaaS",
+	icon: `${DYNAMIC_ICONIC_SPRITE_URL}#dynamicwaas`,
+	normalizedWalletName: "dynamicwaas"
+};
+
+//#endregion
+//#region src/modules/waas/isWaasWalletProvider/isWaasWalletProvider.ts
 /** @notInstrumented */
-const getWalletProviderFromWalletAccount = ({ walletAccount }, client) => {
-	const walletProvider = getWalletProviderRegistry(client).getByKey(walletAccount.walletProviderKey);
-	if (!walletProvider) throw new NoWalletProviderFoundError({ walletProviderKey: walletAccount.walletProviderKey });
-	return walletProvider;
+const isWaasWalletProvider = (walletProvider) => {
+	return walletProvider.key.includes(DYNAMIC_WAAS_METADATA.normalizedWalletName);
 };
 
 //#endregion
-//#region src/modules/auth/consts.ts
-const DYNAMIC_AUTH_COOKIE_NAME = "DYNAMIC_JWT_TOKEN";
+//#region src/modules/waas/findWaasWalletProviderByChain/findWaasWalletProviderByChain.ts
+/** @notInstrumented */
+const findWaasWalletProviderByChain = ({ chain }, client) => {
+	const providers = getWalletProviders(client);
+	const waasProviderKey = formatWalletProviderKey({
+		chain,
+		displayName: DYNAMIC_WAAS_METADATA.displayName,
+		walletProviderType: WalletProviderEnum.EmbeddedWallet
+	});
+	const waasProvider = providers.find((provider) => provider.key === waasProviderKey && provider.chain === chain);
+	if (!waasProvider || !isWaasWalletProvider(waasProvider)) return null;
+	return waasProvider;
+};
+
+//#endregion
+//#region src/modules/waas/isWaasWalletAccount/isWaasWalletAccount.ts
+/**
+* This function determines whether the provided wallet account is a Dynamic
+* WaaS wallet account.
+*
+* @param params.walletAccount - The wallet account to check.
+* @returns True if the wallet account is a WaaS wallet account, false otherwise.
+* @notInstrumented
+*/
+const isWaasWalletAccount = ({ walletAccount }) => {
+	return walletAccount.walletProviderKey.includes(DYNAMIC_WAAS_METADATA.normalizedWalletName);
+};
+
+//#endregion
+//#region src/modules/waas/initializeWaasClientsForEagerRecovery/initializeWaasClientsForEagerRecovery.ts
+/**
+* On login, boots the WaaS client once per chain so the SDK eagerly recovers
+* key shares itself (the `eagerlyRecoverKeyShares` capability) instead of the
+* host looping per wallet. Booting calls `initialize()`, which sends the auth
+* token the iframe needs to self-recover.
+*
+* @notInstrumented
+*/
+const initializeWaasClientsForEagerRecovery = async (client) => {
+	/**
+	* Booting triggers recovery, which fails if the user is missing the MFA auth.
+	* This early return avoids attempting a call we know will fail and just adds
+	* noise to the logs.
+	*/
+	if (isUserMissingMfaAuth(client)) return;
+	const waasChains = new Set(getWalletAccounts(client).filter((walletAccount) => isWaasWalletAccount({ walletAccount })).map((walletAccount) => walletAccount.chain));
+	await Promise.all([...waasChains].map(async (chain) => {
+		const provider = findWaasWalletProviderByChain({ chain }, client);
+		/**
+		* The environment might not have the embedded wallet extensions installed.
+		* In that case there is no provider for the chain and nothing to boot.
+		*/
+		if (!provider) return;
+		try {
+			await provider.getWaasClient();
+		} catch (error) {
+			getCore(client).logger.warn("[initializeWaasClientsForEagerRecovery] failed to boot waas client", error);
+		}
+	}));
+};
 
 //#endregion
 //#region src/modules/wallets/emitWalletAccountsChangedEvent/emitWalletAccountsChangedEvent.ts
@@ -1439,47 +1516,201 @@ const checkAndRaiseWalletAccountsChangedEvent = ({ previousState }, client) => {
 const getWalletAccountsHash = (state, client) => getWalletAccountsFromState(state, client).map((walletAccount) => JSON.stringify(walletAccount)).sort().join("-");
 
 //#endregion
-//#region src/modules/auth/extractSessionId/extractSessionId.ts
-/**
-* Extracts the session ID (`sid` claim) from a JWT token string.
-*
-* Decodes the base64url-encoded payload segment of the token and reads the
-* `sid` field. This is used to correlate instrumentation events with the
-* authenticated session, without ever forwarding the full token.
-*
-* Returns `null` when no token is present, when the token is malformed, or
-* when the payload does not contain a `sid` claim.
-* @notInstrumented
-*/
-const extractSessionId = (token) => {
-	try {
-		const payload = token.split(".")[1];
-		return JSON.parse(atob(payload)).sid ?? null;
-	} catch {
-		return null;
+//#region src/errors/InvalidParamError.ts
+var InvalidParamError = class extends BaseError {
+	constructor(message) {
+		super({
+			cause: null,
+			code: "invalid_param_error",
+			docsUrl: null,
+			name: "InvalidParamError",
+			shortMessage: message
+		});
 	}
 };
 
 //#endregion
-//#region src/utils/getOperatingSystem/getOperatingSystem.native.ts
+//#region src/modules/auth/decodeJwt/decodeJwt.ts
 /**
-* Returns the operating system for React Native environments via `Platform.OS`.
+* Decodes a JWT token and returns the full payload.
 *
-* This file is the React Native variant — the bundler (Metro) resolves
-* `.native.ts` files over the plain `.ts` counterpart, so this implementation
-* is used exclusively in RN environments.
+* This function extracts and returns the complete JWT payload including scopes,
+* expiration time, and other claims.
 *
-* `Platform.OS` can return `'web'` or `'native'` in edge cases (e.g. Expo Go
-* web preview); these are normalised to `'unknown'` since they indicate an
-* unexpected runtime rather than a real OS.
-* @notInstrumented
-*/
-const getOperatingSystem = () => {
-	const os = Platform.OS;
-	if (os === "ios" || os === "android" || os === "windows" || os === "macos") return os;
-	return "unknown";
-};
-
+* @param jwt - The JWT token string.
+* @returns The decoded JWT payload object.
+* @throws InvalidParamError if the token is invalid or cannot be decoded.
+*
+* @example
+* ```typescript
+* const payload = decodeJwt(jwt);
+* // Returns: { scopes: ['wallet:export'], exp: 1234567890, ... }
+* ```
+* @notInstrumented
+*/
+const decodeJwt = (jwt) => {
+	try {
+		const parts = jwt.split(".");
+		if (parts.length !== 3) throw new InvalidParamError("Invalid JWT format");
+		const base64Payload = parts[1].replaceAll("-", "+").replaceAll("_", "/");
+		const paddedPayload = base64Payload + "=".repeat((4 - base64Payload.length % 4) % 4);
+		const decodedPayload = atob(paddedPayload);
+		return JSON.parse(decodedPayload);
+	} catch (error) {
+		if (error instanceof InvalidParamError) throw error;
+		throw new InvalidParamError(`Failed to decode JWT: ${error instanceof Error ? error.message : String(error)}`);
+	}
+};
+
+//#endregion
+//#region src/modules/auth/updateAuthFromVerifyResponse/elevatedAccessTokens/normalizeScopes/normalizeScopes.ts
+/**
+* Normalizes scopes by deduplicating and sorting them.
+* This creates a canonical representation for comparison.
+*
+* @param scopes - Array of scope strings (may contain duplicates)
+* @returns Normalized, sorted array of unique scopes
+* @notInstrumented
+*/
+const normalizeScopes = (scopes) => {
+	return [...new Set(scopes)].sort((a, b) => a.localeCompare(b));
+};
+
+//#endregion
+//#region src/modules/auth/updateAuthFromVerifyResponse/elevatedAccessTokens/parseElevatedAccessToken/parseElevatedAccessToken.ts
+/**
+* Validates and parses an elevated access token from a JWT string.
+* Extracts scopes, expiration, and validates the token structure.
+*
+* Policy decisions:
+* - Tokens without scopes are rejected (returns null)
+* - Tokens with empty scopes array are rejected (returns null)
+* - Tokens without exp field are rejected (returns null)
+* - Expired tokens are rejected (returns null)
+*
+* @returns Parsed token data or null if token is invalid/expired
+* @notInstrumented
+*/
+const parseElevatedAccessToken = ({ token }) => {
+	const payload = decodeJwt(token);
+	const filteredScopes = ((payload?.scope)?.split(" ") ?? []).filter((s) => s.length > 0);
+	const singleUse = payload.singleUse ?? false;
+	if (!filteredScopes || filteredScopes.length === 0) return null;
+	if (!payload.exp) return null;
+	const expiresAt = /* @__PURE__ */ new Date(payload.exp * 1e3);
+	if (expiresAt <= /* @__PURE__ */ new Date()) return null;
+	return {
+		expiresAt,
+		normalizedScopes: normalizeScopes(filteredScopes),
+		scopes: filteredScopes,
+		singleUse,
+		token
+	};
+};
+
+//#endregion
+//#region src/modules/auth/updateAuthFromVerifyResponse/elevatedAccessTokens/upsertElevatedAccessToken/upsertElevatedAccessToken.ts
+/**
+* Upserts an elevated access token into the current tokens array.
+*
+* Policy: Only one token per normalized scope-set is allowed.
+* If a token with the same normalized scopes exists, it is replaced.
+* This ensures we don't accumulate multiple tokens for the same scope combination.
+*
+* @param currentTokens - Current array of elevated access tokens
+* @param newToken - New token to upsert
+* @returns Updated array of tokens with the new token upserted
+* @notInstrumented
+*/
+const upsertElevatedAccessToken = ({ currentTokens, newToken }) => {
+	const newScopeKey = normalizeScopes(newToken.scopes).join(" ");
+	return [...currentTokens.filter((existingToken) => {
+		return normalizeScopes(existingToken.scopes).join(" ") !== newScopeKey;
+	}), {
+		expiresAt: newToken.expiresAt,
+		scopes: newToken.scopes,
+		singleUse: newToken.singleUse,
+		token: newToken.token
+	}];
+};
+
+//#endregion
+//#region src/modules/auth/updateAuthFromVerifyResponse/updateAuthFromVerifyResponse.ts
+/** @notInstrumented */
+const updateAuthFromVerifyResponse = ({ response }, client) => {
+	const core = getCore(client);
+	const previousState = { ...core.state.get() };
+	const { user, minifiedJwt, jwt, expiresAt, mfaToken, elevatedAccessToken } = response;
+	const sessionExpiresAt = /* @__PURE__ */ new Date(expiresAt * 1e3);
+	const newState = {
+		legacyToken: jwt ?? null,
+		sessionExpiresAt,
+		token: minifiedJwt ?? null,
+		user
+	};
+	if (mfaToken) newState.mfaToken = mfaToken;
+	const currentTokens = core.state.get().elevatedAccessTokens || [];
+	newState.elevatedAccessTokens = currentTokens;
+	if (elevatedAccessToken) {
+		const parsedToken = parseElevatedAccessToken({ token: elevatedAccessToken });
+		if (parsedToken) newState.elevatedAccessTokens = upsertElevatedAccessToken({
+			currentTokens,
+			newToken: parsedToken
+		});
+	}
+	core.state.set(newState);
+	/**
+	* For customers using a sandbox environment with cookies enabled, we need to set the cookie
+	* programmatically because Redcoast won't set the cookie via headers. We set the cookie programmatically
+	* so customers can access the cookie from document.cookie consistently between sandbox and live environments.
+	*/
+	if (minifiedJwt && isCookieEnabled(client)) setCookie(`${DYNAMIC_AUTH_COOKIE_NAME}=${minifiedJwt}; expires=${sessionExpiresAt.toUTCString()}; path=/; SameSite=Lax${getSecureCookieAttribute()}`);
+	checkAndRaiseWalletAccountsChangedEvent({ previousState }, client);
+	if (!previousState.user && Boolean(newState.user)) initializeWaasClientsForEagerRecovery(client);
+};
+
+//#endregion
+//#region src/modules/auth/extractSessionId/extractSessionId.ts
+/**
+* Extracts the session ID (`sid` claim) from a JWT token string.
+*
+* Decodes the base64url-encoded payload segment of the token and reads the
+* `sid` field. This is used to correlate instrumentation events with the
+* authenticated session, without ever forwarding the full token.
+*
+* Returns `null` when no token is present, when the token is malformed, or
+* when the payload does not contain a `sid` claim.
+* @notInstrumented
+*/
+const extractSessionId = (token) => {
+	try {
+		const payload = token.split(".")[1];
+		return JSON.parse(atob(payload)).sid ?? null;
+	} catch {
+		return null;
+	}
+};
+
+//#endregion
+//#region src/utils/getOperatingSystem/getOperatingSystem.native.ts
+/**
+* Returns the operating system for React Native environments via `Platform.OS`.
+*
+* This file is the React Native variant — the bundler (Metro) resolves
+* `.native.ts` files over the plain `.ts` counterpart, so this implementation
+* is used exclusively in RN environments.
+*
+* `Platform.OS` can return `'web'` or `'native'` in edge cases (e.g. Expo Go
+* web preview); these are normalised to `'unknown'` since they indicate an
+* unexpected runtime rather than a real OS.
+* @notInstrumented
+*/
+const getOperatingSystem = () => {
+	const os = Platform.OS;
+	if (os === "ios" || os === "android" || os === "windows" || os === "macos") return os;
+	return "unknown";
+};
+
 //#endregion
 //#region src/utils/getUserAgent/getUserAgent.ts
 /**
@@ -1841,267 +2072,128 @@ const instrumentFunction = ({ fn, functionName, getCore: getCore$1, selectors })
 };
 
 //#endregion
-//#region src/modules/mfa/isUserMissingMfaAuth/isUserMissingMfaAuth.ts
+//#region src/modules/user/refreshAuth/refreshAuth.ts
 /**
-* Checks if the user requires additional MFA authentication.
+* Refreshes the current session's authentication from the server.
 *
-* This function determines if the current user session requires
-* additional multi-factor authentication to access certain features.
+* This rotates the auth token via a full verify call and updates both the
+* token and the user state from the response, returning the raw
+* `VerifyResponse` (which includes the new token). Reach for this when you
+* need a fresh JWT — e.g. before a call that requires a non-expired token.
 *
-* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
-* @returns True if the user needs additional MFA authentication, false otherwise.
-* @notInstrumented
-* @hook Exposed as a hook so consumers reactively know when MFA is still required, updated when the user changes.
-*/
-const isUserMissingMfaAuth = (client = getDefaultClient()) => {
-	const user = client.user;
-	assertDefined(user, "User not logged in");
-	return Boolean(user.scope?.includes("requiresAdditionalAuth"));
-};
-
-//#endregion
-//#region src/modules/wallets/getWalletProviders/getWalletProviders.ts
-/**
-* Get all available wallet providers to interact with internally.
-* @notInstrumented
-*/
-const getWalletProviders = (client) => {
-	return getWalletProviderRegistry(client).listProviders();
-};
-
-//#endregion
-//#region src/modules/waas/constants.ts
-const DEFAULT_WAAS_BASE_API_URL = "https://app.dynamicauth.com";
-const DEFAULT_WAAS_BASE_MPC_RELAY_API_URL = "https://relay.dynamicauth.com";
-const DYNAMIC_WAAS_METADATA = {
-	displayName: "Dynamic WaaS",
-	icon: `${DYNAMIC_ICONIC_SPRITE_URL}#dynamicwaas`,
-	normalizedWalletName: "dynamicwaas"
-};
-
-//#endregion
-//#region src/modules/waas/isWaasWalletProvider/isWaasWalletProvider.ts
-/** @notInstrumented */
-const isWaasWalletProvider = (walletProvider) => {
-	return walletProvider.key.includes(DYNAMIC_WAAS_METADATA.normalizedWalletName);
-};
-
-//#endregion
-//#region src/modules/waas/findWaasWalletProviderByChain/findWaasWalletProviderByChain.ts
-/** @notInstrumented */
-const findWaasWalletProviderByChain = ({ chain }, client) => {
-	const providers = getWalletProviders(client);
-	const waasProviderKey = formatWalletProviderKey({
-		chain,
-		displayName: DYNAMIC_WAAS_METADATA.displayName,
-		walletProviderType: WalletProviderEnum.EmbeddedWallet
-	});
-	const waasProvider = providers.find((provider) => provider.key === waasProviderKey && provider.chain === chain);
-	if (!waasProvider || !isWaasWalletProvider(waasProvider)) return null;
-	return waasProvider;
-};
-
-//#endregion
-//#region src/modules/waas/isWaasWalletAccount/isWaasWalletAccount.ts
-/**
-* This function determines whether the provided wallet account is a Dynamic
-* WaaS wallet account.
+* Prefer `refreshUser` when you only need the latest user profile and do not
+* care about rotating the token: it hits the authenticated-user endpoint,
+* touches only the user state, and returns the `User` directly.
 *
-* @param params.walletAccount - The wallet account to check.
-* @returns True if the wallet account is a WaaS wallet account, false otherwise.
-* @notInstrumented
-*/
-const isWaasWalletAccount = ({ walletAccount }) => {
-	return walletAccount.walletProviderKey.includes(DYNAMIC_WAAS_METADATA.normalizedWalletName);
-};
-
-//#endregion
-//#region src/modules/waas/initializeWaasClientsForEagerRecovery/initializeWaasClientsForEagerRecovery.ts
-/**
-* On login, boots the WaaS client once per chain so the SDK eagerly recovers
-* key shares itself (the `eagerlyRecoverKeyShares` capability) instead of the
-* host looping per wallet. Booting calls `initialize()`, which sends the auth
-* token the iframe needs to self-recover.
+* @example
+* ```ts
+* const response = await refreshAuth();
+* console.log('Token refreshed:', response.token);
+* ```
 *
-* @notInstrumented
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns A promise that resolves to the verify response.
+* @see logout
+* @see refreshUser
+* @instrumented
 */
-const initializeWaasClientsForEagerRecovery = async (client) => {
-	/**
-	* Booting triggers recovery, which fails if the user is missing the MFA auth.
-	* This early return avoids attempting a call we know will fail and just adds
-	* noise to the logs.
-	*/
-	if (isUserMissingMfaAuth(client)) return;
-	const waasChains = new Set(getWalletAccounts(client).filter((walletAccount) => isWaasWalletAccount({ walletAccount })).map((walletAccount) => walletAccount.chain));
-	await Promise.all([...waasChains].map(async (chain) => {
-		const provider = findWaasWalletProviderByChain({ chain }, client);
-		/**
-		* The environment might not have the embedded wallet extensions installed.
-		* In that case there is no provider for the chain and nothing to boot.
-		*/
-		if (!provider) return;
+const refreshAuth = async (client = getDefaultClient()) => {
+	const core = getCore(client);
+	const response = await createBaseApiClient({ middleware: [createDeviceSignatureHeadersMiddleware(client)] }, client).refreshAuth({ environmentId: core.environmentId });
+	updateAuthFromVerifyResponse({ response }, client);
+	return response;
+};
+const __refreshAuth_impl = refreshAuth;
+const __refreshAuth_wrapped = instrumentFunction({
+	fn: __refreshAuth_impl,
+	functionName: "refreshAuth",
+	getCore: () => {
 		try {
-			await provider.getWaasClient();
-		} catch (error) {
-			getCore(client).logger.warn("[initializeWaasClientsForEagerRecovery] failed to boot waas client", error);
+			return getCore(getDefaultClient());
+		} catch {
+			return;
 		}
-	}));
-};
-
-//#endregion
-//#region src/errors/InvalidParamError.ts
-var InvalidParamError = class extends BaseError {
-	constructor(message) {
-		super({
-			cause: null,
-			code: "invalid_param_error",
-			docsUrl: null,
-			name: "InvalidParamError",
-			shortMessage: message
-		});
 	}
-};
+});
 
 //#endregion
-//#region src/modules/auth/decodeJwt/decodeJwt.ts
+//#region src/modules/apiClient/utils/rbacStaleMiddleware/createRbacStaleMiddleware.ts
+const RBAC_STALE_CODE = "rbac_stale";
+const RBAC_STALE_RETRY_HEADER = "x-dyn-rbac-retry";
 /**
-* Decodes a JWT token and returns the full payload.
-*
-* This function extracts and returns the complete JWT payload including scopes,
-* expiration time, and other claims.
-*
-* @param jwt - The JWT token string.
-* @returns The decoded JWT payload object.
-* @throws InvalidParamError if the token is invalid or cannot be decoded.
-*
-* @example
-* ```typescript
-* const payload = decodeJwt(jwt);
-* // Returns: { scopes: ['wallet:export'], exp: 1234567890, ... }
-* ```
+* Detects 403 { code: 'rbac_stale' } responses, refreshes the auth token, and
+* retries the request once with the new token. This lets business account role
+* changes take effect without revoking the user's session.
 * @notInstrumented
 */
-const decodeJwt = (jwt) => {
+const createRbacStaleMiddleware = (client) => ({ post: async (context) => {
+	if (context.response.status !== 403) return context.response;
+	if (context.init.headers && typeof context.init.headers === "object" && RBAC_STALE_RETRY_HEADER in context.init.headers) return context.response;
+	let errorBody;
 	try {
-		const parts = jwt.split(".");
-		if (parts.length !== 3) throw new InvalidParamError("Invalid JWT format");
-		const base64Payload = parts[1].replaceAll("-", "+").replaceAll("_", "/");
-		const paddedPayload = base64Payload + "=".repeat((4 - base64Payload.length % 4) % 4);
-		const decodedPayload = atob(paddedPayload);
-		return JSON.parse(decodedPayload);
-	} catch (error) {
-		if (error instanceof InvalidParamError) throw error;
-		throw new InvalidParamError(`Failed to decode JWT: ${error instanceof Error ? error.message : String(error)}`);
+		errorBody = await context.response.clone().json();
+	} catch {
+		return context.response;
 	}
-};
-
-//#endregion
-//#region src/modules/auth/updateAuthFromVerifyResponse/elevatedAccessTokens/normalizeScopes/normalizeScopes.ts
-/**
-* Normalizes scopes by deduplicating and sorting them.
-* This creates a canonical representation for comparison.
-*
-* @param scopes - Array of scope strings (may contain duplicates)
-* @returns Normalized, sorted array of unique scopes
-* @notInstrumented
-*/
-const normalizeScopes = (scopes) => {
-	return [...new Set(scopes)].sort((a, b) => a.localeCompare(b));
-};
+	if (!(typeof errorBody === "object" && errorBody !== null && "code" in errorBody && errorBody.code === RBAC_STALE_CODE)) return context.response;
+	try {
+		await __refreshAuth_wrapped(client);
+	} catch {
+		return context.response;
+	}
+	if (!client.token) return context.response;
+	const headers = { ...context.init.headers };
+	delete headers[RBAC_STALE_RETRY_HEADER];
+	delete headers[MFA_TOKEN_HEADER];
+	delete headers[ELEVATED_ACCESS_TOKEN_HEADER];
+	headers.Authorization = `Bearer ${client.token}`;
+	return context.fetch(context.url, {
+		...context.init,
+		headers: {
+			...headers,
+			[RBAC_STALE_RETRY_HEADER]: "1"
+		}
+	});
+} });
 
 //#endregion
-//#region src/modules/auth/updateAuthFromVerifyResponse/elevatedAccessTokens/parseElevatedAccessToken/parseElevatedAccessToken.ts
+//#region src/modules/apiClient/createApiClient.ts
 /**
-* Validates and parses an elevated access token from a JWT string.
-* Extracts scopes, expiration, and validates the token structure.
-*
-* Policy decisions:
-* - Tokens without scopes are rejected (returns null)
-* - Tokens with empty scopes array are rejected (returns null)
-* - Tokens without exp field are rejected (returns null)
-* - Expired tokens are rejected (returns null)
+* Returns a new instance of the SDK API client.
 *
-* @returns Parsed token data or null if token is invalid/expired
+* This is not meant for storing, as it is very light we can create it whenever needed.
 * @notInstrumented
 */
-const parseElevatedAccessToken = ({ token }) => {
-	const payload = decodeJwt(token);
-	const filteredScopes = ((payload?.scope)?.split(" ") ?? []).filter((s) => s.length > 0);
-	const singleUse = payload.singleUse ?? false;
-	if (!filteredScopes || filteredScopes.length === 0) return null;
-	if (!payload.exp) return null;
-	const expiresAt = /* @__PURE__ */ new Date(payload.exp * 1e3);
-	if (expiresAt <= /* @__PURE__ */ new Date()) return null;
-	return {
-		expiresAt,
-		normalizedScopes: normalizeScopes(filteredScopes),
-		scopes: filteredScopes,
-		singleUse,
-		token
-	};
+const createApiClient = (options = {}, client) => {
+	return createBaseApiClient({
+		middleware: [createDeviceSignatureHeadersMiddleware(client), createRbacStaleMiddleware(client)],
+		options
+	}, client);
 };
 
 //#endregion
-//#region src/modules/auth/updateAuthFromVerifyResponse/elevatedAccessTokens/upsertElevatedAccessToken/upsertElevatedAccessToken.ts
-/**
-* Upserts an elevated access token into the current tokens array.
-*
-* Policy: Only one token per normalized scope-set is allowed.
-* If a token with the same normalized scopes exists, it is replaced.
-* This ensures we don't accumulate multiple tokens for the same scope combination.
-*
-* @param currentTokens - Current array of elevated access tokens
-* @param newToken - New token to upsert
-* @returns Updated array of tokens with the new token upserted
-* @notInstrumented
-*/
-const upsertElevatedAccessToken = ({ currentTokens, newToken }) => {
-	const newScopeKey = normalizeScopes(newToken.scopes).join(" ");
-	return [...currentTokens.filter((existingToken) => {
-		return normalizeScopes(existingToken.scopes).join(" ") !== newScopeKey;
-	}), {
-		expiresAt: newToken.expiresAt,
-		scopes: newToken.scopes,
-		singleUse: newToken.singleUse,
-		token: newToken.token
-	}];
+//#region src/errors/NoWalletProviderFoundError.ts
+var NoWalletProviderFoundError = class extends BaseError {
+	constructor({ walletProviderKey }) {
+		super({
+			cause: null,
+			code: "no_wallet_provider_found_error",
+			docsUrl: null,
+			name: "NoWalletProviderFoundError",
+			shortMessage: `No wallet provider found with key: ${walletProviderKey}`
+		});
+	}
 };
 
 //#endregion
-//#region src/modules/auth/updateAuthFromVerifyResponse/updateAuthFromVerifyResponse.ts
+//#region src/modules/wallets/utils/getWalletProviderFromWalletAccount/getWalletProviderFromWalletAccount.ts
 /** @notInstrumented */
-const updateAuthFromVerifyResponse = ({ response }, client) => {
-	const core = getCore(client);
-	const previousState = { ...core.state.get() };
-	const { user, minifiedJwt, jwt, expiresAt, mfaToken, elevatedAccessToken } = response;
-	const sessionExpiresAt = /* @__PURE__ */ new Date(expiresAt * 1e3);
-	const newState = {
-		legacyToken: jwt ?? null,
-		sessionExpiresAt,
-		token: minifiedJwt ?? null,
-		user
-	};
-	if (mfaToken) newState.mfaToken = mfaToken;
-	const currentTokens = core.state.get().elevatedAccessTokens || [];
-	newState.elevatedAccessTokens = currentTokens;
-	if (elevatedAccessToken) {
-		const parsedToken = parseElevatedAccessToken({ token: elevatedAccessToken });
-		if (parsedToken) newState.elevatedAccessTokens = upsertElevatedAccessToken({
-			currentTokens,
-			newToken: parsedToken
-		});
-	}
-	core.state.set(newState);
-	/**
-	* For customers using a sandbox environment with cookies enabled, we need to set the cookie
-	* programmatically because Redcoast won't set the cookie via headers. We set the cookie programmatically
-	* so customers can access the cookie from document.cookie consistently between sandbox and live environments.
-	*/
-	if (minifiedJwt && isCookieEnabled(client)) setCookie(`${DYNAMIC_AUTH_COOKIE_NAME}=${minifiedJwt}; expires=${sessionExpiresAt.toUTCString()}; path=/; SameSite=Lax${getSecureCookieAttribute()}`);
-	checkAndRaiseWalletAccountsChangedEvent({ previousState }, client);
-	if (!previousState.user && Boolean(newState.user)) initializeWaasClientsForEagerRecovery(client);
+const getWalletProviderFromWalletAccount = ({ walletAccount }, client) => {
+	const walletProvider = getWalletProviderRegistry(client).getByKey(walletAccount.walletProviderKey);
+	if (!walletProvider) throw new NoWalletProviderFoundError({ walletProviderKey: walletAccount.walletProviderKey });
+	return walletProvider;
 };
 
 //#endregion
-export { UnauthorizedError as $, formatWalletProviderKey as A, onEvent as B, DYNAMIC_AUTH_COOKIE_NAME as C, name as Ct, createRuntimeServiceAccessKey as D, getWalletProviderRegistry as E, normalizeAddress as F, getDeviceSigner as G, createApiClient as H, splitWalletProviderKey as I, getSecureCookieAttribute as J, getNonce as K, InvalidWalletProviderKeyError as L, getChainFromVerifiedCredentialChain as M, CHAINS_INFO_MAP as N, NoWalletProviderFoundError as O, formatWalletAccountId as P, createLocalStorageAdapter as Q, emitEvent as R, emitWalletAccountsChangedEvent as S, getCore as St, WalletProviderPriority as T, createDeviceSignatureHeadersMiddleware as U, onceEvent as V, getHeadersForNonceSignedByDeviceSigners as W, updateNoncePoolStorage as X, fetchAndStoreNonces as Y, createStorageKeySchema as Z, DEFAULT_PII_FIELDS as _, NONCE_POOL_SIZE as _t, InvalidParamError as a, APIError as at, extractSessionId as b, ClientNotFoundError as bt, findWaasWalletProviderByChain as c, DYNAMIC_ICONIC_SPRITE_URL as ct, DEFAULT_WAAS_BASE_MPC_RELAY_API_URL as d, isCookieEnabled as dt, SandboxMaximumThresholdReachedError as et, DYNAMIC_WAAS_METADATA as f, assertDefined as ft, scrubParameters as g, getPlatform as gt, instrumentFunction as h, randomString as ht, decodeJwt as i, InvalidExternalAuthError as it, normalizeWalletNameWithChain as j, getWalletAccounts as k, isWaasWalletProvider as l, SDK_API_CORE_VERSION as lt, isUserMissingMfaAuth as m, getElevatedAccessToken as mt, upsertElevatedAccessToken as n, MfaInvalidOtpError as nt, initializeWaasClientsForEagerRecovery as o, CLIENT_SDK_NAME as ot, getWalletProviders as p, ValueMustBeDefinedError as pt, setCookie as q, parseElevatedAccessToken as r, LinkCredentialError as rt, isWaasWalletAccount as s, DYNAMIC_LOGOUT_REASON_HEADER as st, updateAuthFromVerifyResponse as t, MfaRateLimitedError as tt, DEFAULT_WAAS_BASE_API_URL as u, getSessionKeys as ut, getUserAgent as v, getDefaultClient as vt, getWalletProviderFromWalletAccount as w, version as wt, checkAndRaiseWalletAccountsChangedEvent as x, BaseError as xt, getOperatingSystem as y, setDefaultClient as yt, offEvent as z };
-//# sourceMappingURL=updateAuthFromVerifyResponse-CTvWpZLa.native.esm.js.map
+export { NONCE_POOL_SIZE as $, onEvent as A, splitWalletProviderKey as B, DEFAULT_WAAS_BASE_MPC_RELAY_API_URL as C, DYNAMIC_AUTH_COOKIE_NAME as Ct, getWalletProviderRegistry as D, WalletProviderPriority as E, version as Et, normalizeWalletNameWithChain as F, createDeviceSignatureHeadersMiddleware as G, isUserMissingMfaAuth as H, getChainFromVerifiedCredentialChain as I, getNonce as J, getHeadersForNonceSignedByDeviceSigners as K, CHAINS_INFO_MAP as L, createRuntimeServiceAccessKey as M, getWalletAccounts as N, emitEvent as O, formatWalletProviderKey as P, createLocalStorageAdapter as Q, formatWalletAccountId as R, DEFAULT_WAAS_BASE_API_URL as S, BaseError as St, getWalletProviders as T, name as Tt, setCookie as U, InvalidWalletProviderKeyError as V, getSecureCookieAttribute as W, updateNoncePoolStorage as X, fetchAndStoreNonces as Y, createStorageKeySchema as Z, emitWalletAccountsChangedEvent as _, getPlatform as _t, instrumentFunction as a, InvalidExternalAuthError as at, findWaasWalletProviderByChain as b, ClientNotFoundError as bt, getUserAgent as c, DYNAMIC_LOGOUT_REASON_HEADER as ct, updateAuthFromVerifyResponse as d, getSessionKeys as dt, UnauthorizedError as et, upsertElevatedAccessToken as f, isCookieEnabled as ft, checkAndRaiseWalletAccountsChangedEvent as g, randomString as gt, InvalidParamError as h, getElevatedAccessToken as ht, __refreshAuth_wrapped as i, LinkCredentialError as it, onceEvent as j, offEvent as k, getOperatingSystem as l, DYNAMIC_ICONIC_SPRITE_URL as lt, decodeJwt as m, ValueMustBeDefinedError as mt, NoWalletProviderFoundError as n, MfaRateLimitedError as nt, scrubParameters as o, APIError as ot, parseElevatedAccessToken as p, assertDefined as pt, getDeviceSigner as q, createApiClient as r, MfaInvalidOtpError as rt, DEFAULT_PII_FIELDS as s, CLIENT_SDK_NAME as st, getWalletProviderFromWalletAccount as t, SandboxMaximumThresholdReachedError as tt, extractSessionId as u, SDK_API_CORE_VERSION as ut, initializeWaasClientsForEagerRecovery as v, getDefaultClient as vt, DYNAMIC_WAAS_METADATA as w, TokenScope$1 as wt, isWaasWalletProvider as x, getCore as xt, isWaasWalletAccount as y, setDefaultClient as yt, normalizeAddress as z };
+//# sourceMappingURL=apiClient-DpzKqY39.native.esm.js.map