@dynamic-labs-sdk/client 1.30.2 → 1.31.0

package/dist/{updateAuthFromVerifyResponse-BLgNMqwN.esm.js → logoutWithReason-DV89zJmJ.esm.js}

@@ -1,16 +1,20 @@
-import { AuthStorageEnum, Configuration, JwtVerifiedCredentialFormatEnum, SDKApi, WalletProviderEnum, isDeviceNonceSignatureRequiredForUrl } from "@dynamic-labs/sdk-api-core";
+import { AuthStorageEnum, Configuration, JwtVerifiedCredentialFormatEnum, SDKApi, TokenScope, WalletProviderEnum, isDeviceNonceSignatureRequiredForUrl } from "@dynamic-labs/sdk-api-core";
 import * as z from "zod/mini";
 
 //#region package.json
 var name = "@dynamic-labs-sdk/client";
-var version = "1.30.2";
+var version = "1.31.0";
 
 //#endregion
-//#region src/client/core/getCore/getCore.ts
-/** @notInstrumented */
-const getCore = (client) => {
-	return client.__core;
-};
+//#region src/modules/auth/consts.ts
+const DYNAMIC_AUTH_COOKIE_NAME = "DYNAMIC_JWT_TOKEN";
+/**
+* Lists the scopes accepted by authentication and step-up APIs.
+*
+* @see authenticateTotpMfaDevice
+* @see checkStepUpAuth
+*/
+const TokenScope$1 = TokenScope;
 
 //#endregion
 //#region src/errors/base/BaseError.ts
@@ -75,6 +79,13 @@ var BaseError = class BaseError extends Error {
 	}
 };
 
+//#endregion
+//#region src/client/core/getCore/getCore.ts
+/** @notInstrumented */
+const getCore = (client) => {
+	return client.__core;
+};
+
 //#endregion
 //#region src/errors/ClientNotFoundError.ts
 var ClientNotFoundError = class extends BaseError {
@@ -122,11 +133,6 @@ const setDefaultClient = (client) => {
 	numOfInitializedClients++;
 };
 
-//#endregion
-//#region src/utils/getNonce/constants.ts
-const NONCE_POOL_EXPIRATION_TIME = 6e4 * 60 * 24;
-const NONCE_POOL_SIZE = 5;
-
 //#endregion
 //#region src/utils/getPlatform/getPlatform.ts
 /**
@@ -255,7 +261,7 @@ const getSessionKeys = (client) => {
 
 //#endregion
 //#region src/generated/dependencyCatalog.ts
-const dependencyCatalog = { "@dynamic-labs/sdk-api-core": "0.12.0" };
+const dependencyCatalog = { "@dynamic-labs/sdk-api-core": "0.25.0" };
 
 //#endregion
 //#region src/constants.ts
@@ -534,6 +540,11 @@ const createBaseApiClient = ({ middleware = [], options = {} }, client) => {
 	}));
 };
 
+//#endregion
+//#region src/utils/getNonce/constants.ts
+const NONCE_POOL_EXPIRATION_TIME = 6e4 * 60 * 24;
+const NONCE_POOL_SIZE = 5;
+
 //#endregion
 //#region src/services/storage/createStorageKeySchema/createStorageKeySchema.ts
 /** @notInstrumented */
@@ -631,38 +642,6 @@ const fetchAndStoreNonces = async (client) => {
 	return fetchPromise;
 };
 
-//#endregion
-//#region src/utils/getSecureCookieAttribute/getSecureCookieAttribute.ts
-/**
-* Returns the cookie `Secure` attribute suffix (`'; Secure'`) when the current
-* document is running in a secure context, or an empty string otherwise.
-*
-* The `Secure` attribute prevents the browser from ever transmitting the cookie
-* over an unencrypted `http://` connection, which mitigates cleartext token
-* capture (CWE-614). It is intentionally omitted on insecure/localhost dev,
-* because browsers reject `Secure` cookies set over `http://` and that would
-* silently break local testing.
-*
-* Used when building the Dynamic auth JWT cookie string so the attribute is
-* applied consistently on both the write (sign-in/refresh) and clear (logout)
-* paths.
-*
-* @notInstrumented
-*/
-const getSecureCookieAttribute = () => {
-	return Boolean(globalThis.window?.isSecureContext) || globalThis.location?.protocol === "https:" ? "; Secure" : "";
-};
-
-//#endregion
-//#region src/utils/setCookie/setCookie.ts
-/**
-* Sefelly sets the cookie in the browser.
-* @notInstrumented
-*/
-const setCookie = (cookie) => {
-	document.cookie = cookie;
-};
-
 //#endregion
 //#region src/utils/getNonce/getNonce.ts
 /**
@@ -766,160 +745,54 @@ const createDeviceSignatureHeadersMiddleware = (client) => {
 };
 
 //#endregion
-//#region src/modules/apiClient/createApiClient.ts
-/**
-* Returns a new instance of the SDK API client.
-*
-* This is not meant for storing, as it is very light we can create it whenever needed.
-* @notInstrumented
-*/
-const createApiClient = (options = {}, client) => {
-	return createBaseApiClient({
-		middleware: [createDeviceSignatureHeadersMiddleware(client)],
-		options
-	}, client);
-};
-
-//#endregion
-//#region src/modules/clientEvents/clientEvents.ts
+//#region src/utils/getSecureCookieAttribute/getSecureCookieAttribute.ts
 /**
-* Adds an event listener for Dynamic client events.
-*
-* This function allows you to listen for various events emitted by the Dynamic client,
-* such as authentication state changes, wallet connections, and more.
+* Returns the cookie `Secure` attribute suffix (`'; Secure'`) when the current
+* document is running in a secure context, or an empty string otherwise.
 *
-* @example
-* ```ts
-* const unsubscribe = onEvent({
-*   event: 'walletAdded',
-*   listener: ({ walletAccount }) => {
-*     console.log('Wallet added:', walletAccount.address);
-*   },
-* });
+* The `Secure` attribute prevents the browser from ever transmitting the cookie
+* over an unencrypted `http://` connection, which mitigates cleartext token
+* capture (CWE-614). It is intentionally omitted on insecure/localhost dev,
+* because browsers reject `Secure` cookies set over `http://` and that would
+* silently break local testing.
 *
-* // Later: clean up
-* unsubscribe();
-* ```
+* Used when building the Dynamic auth JWT cookie string so the attribute is
+* applied consistently on both the write (sign-in/refresh) and clear (logout)
+* paths.
 *
-* @param params.event - The event name to listen for.
-* @param params.listener - The callback function to execute when the event is fired.
-* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
-* @returns A function that can be called to remove the listener.
-* @see offEvent
-* @see onceEvent
 * @notInstrumented
-* @hook Event listeners are error-prone to wire up by hand with useEffect.
 */
-const onEvent = ({ event, listener }, client = getDefaultClient()) => {
-	const { eventEmitter } = getCore(client);
-	eventEmitter.on(event, listener);
-	return () => {
-		eventEmitter.off(event, listener);
-	};
+const getSecureCookieAttribute = () => {
+	return Boolean(globalThis.window?.isSecureContext) || globalThis.location?.protocol === "https:" ? "; Secure" : "";
 };
+
+//#endregion
+//#region src/utils/setCookie/setCookie.ts
 /**
-* Removes an event listener from Dynamic client events.
-*
-* This function unsubscribes a previously registered event listener
-* from the specified Dynamic client event.
-*
-* @example
-* ```ts
-* offEvent({ event: 'walletAdded', listener: myListener });
-* ```
-*
-* @param params.event - The event name to remove the listener from.
-* @param params.listener - The callback function to remove.
-* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
-* @see onEvent
-* @see onceEvent
+* Sefelly sets the cookie in the browser.
 * @notInstrumented
 */
-const offEvent = ({ event, listener }, client = getDefaultClient()) => {
-	const { eventEmitter } = getCore(client);
-	eventEmitter.off(event, listener);
+const setCookie = (cookie) => {
+	document.cookie = cookie;
 };
+
+//#endregion
+//#region src/modules/mfa/isUserMissingMfaAuth/isUserMissingMfaAuth.ts
 /**
-* Adds a one-time event listener for Dynamic client events.
-*
-* This function listens for an event that will automatically remove itself
-* after being triggered once.
+* Checks if the user requires additional MFA authentication.
 *
-* @example
-* ```ts
-* onceEvent({
-*   event: 'logout',
-*   listener: () => {
-*     console.log('User logged out');
-*   },
-* });
-* ```
+* This function determines if the current user session requires
+* additional multi-factor authentication to access certain features.
 *
-* @param params.event - The event name to listen for.
-* @param params.listener - The callback function to execute when the event is fired.
 * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
-* @returns A function that can be called to remove the listener before it fires.
-* @see onEvent
-* @see offEvent
-* @notInstrumented
-* @hook Event listeners are error-prone to wire up by hand with useEffect.
-*/
-const onceEvent = ({ event, listener }, client = getDefaultClient()) => {
-	const { eventEmitter } = getCore(client);
-	eventEmitter.once(event, listener);
-	return () => {
-		eventEmitter.off(event, listener);
-	};
-};
-/**
-* Emits a Dynamic client event.
-*
-* This function triggers an event that will be received by all registered
-* listeners for the specified event type.
-*
-* @param params.event - The event name to emit.
-* @param params.args - The arguments to pass to event listeners.
-* @param client - The Dynamic client instance.
+* @returns True if the user needs additional MFA authentication, false otherwise.
 * @notInstrumented
+* @hook Exposed as a hook so consumers reactively know when MFA is still required, updated when the user changes.
 */
-const emitEvent = ({ event, args }, client) => {
-	const { eventEmitter } = getCore(client);
-	eventEmitter.emit(event, args);
-};
-
-//#endregion
-//#region src/utils/retryOnFail/InvalidRetryOnFailCallError.ts
-/**
-* This error is thrown when the `retryOnFail` function is called with an invalid
-* number of retries (i.e. less than 0).
-*/
-var InvalidRetryOnFailCallError = class extends BaseError {
-	constructor(maxRetries) {
-		super({
-			cause: null,
-			code: "invalid_retry_on_fail_call_error",
-			docsUrl: null,
-			name: "InvalidRetryOnFailCallError",
-			shortMessage: `Invalid retries parameter for retryOnFail call: ${maxRetries}`
-		});
-	}
-};
-
-//#endregion
-//#region src/utils/retryOnFail/retryOnFail.ts
-/** @notInstrumented */
-const retryOnFail = async ({ delay = 0, fn, maxRetries }) => {
-	for (let retry = 0; retry <= maxRetries; retry++) try {
-		return await fn();
-	} catch (error) {
-		if (retry >= maxRetries) throw error;
-		if (delay > 0) await new Promise((resolve) => setTimeout(resolve, delay));
-	}
-	/**
-	* Reaching this point should never happen and this
-	* error is thrown to help us debug the issue.
-	*/
-	throw new InvalidRetryOnFailCallError(maxRetries);
+const isUserMissingMfaAuth = (client = getDefaultClient()) => {
+	const user = client.user;
+	assertDefined(user, "User not logged in");
+	return Boolean(user.scope?.includes("requiresAdditionalAuth"));
 };
 
 //#endregion
@@ -1265,147 +1138,131 @@ const getWalletAccounts = (client = getDefaultClient()) => {
 };
 
 //#endregion
-//#region src/modules/auth/isSignedIn/isSignedIn.ts
+//#region src/services/runtimeServices/createRuntimeServiceAccessKey/createRuntimeServiceAccessKey.ts
 /**
-* Checks if the user is currently signed in to the Dynamic client.
+* Creates a service accessor function that manages service instantiation and caching.
+* The returned function will either retrieve an existing service from the registry or
+* create a new one using the provided builder function.
 *
-* The client is considered to be in a signed in state if a user has
-* authenticated or if the client has at least one wallet connected.
+* @template - The type of service to be created/accessed
+* @param key - Unique identifier for the service in the registry
+* @param builder - Function that creates the service instance when called with a DynamicClient
+* @notInstrumented
+*/
+const createRuntimeServiceAccessKey = (key, builder) => (client) => {
+	const { runtimeServices } = getCore(client);
+	const currentService = runtimeServices.getByKey(key);
+	if (currentService) return currentService;
+	const service = builder(client);
+	runtimeServices.register(key, service);
+	return service;
+};
+
+//#endregion
+//#region src/modules/clientEvents/clientEvents.ts
+/**
+* Adds an event listener for Dynamic client events.
 *
-* @deprecated What counts as "signed in" is your app's business logic, not the
-* SDK's. This helper bakes in one opinion (a user OR any connected wallet),
-* which rarely matches every app and forces a dependency on us for every
-* variation. Compose your own check from the underlying primitives instead —
-* e.g. `Boolean(client.user) || isAnyWalletAccountConnected(client)` — and
-* layer in whatever your app requires (device registration, completed
-* onboarding, satisfied MFA, a required embedded wallet, …). See the
-* "Check if signed in" guide:
-* https://www.dynamic.xyz/docs/javascript/user-session-management
+* This function allows you to listen for various events emitted by the Dynamic client,
+* such as authentication state changes, wallet connections, and more.
 *
 * @example
 * ```ts
-* if (isSignedIn()) {
-*   console.log('User is authenticated or has a wallet connected');
-* }
+* const unsubscribe = onEvent({
+*   event: 'walletAdded',
+*   listener: ({ walletAccount }) => {
+*     console.log('Wallet added:', walletAccount.address);
+*   },
+* });
+*
+* // Later: clean up
+* unsubscribe();
 * ```
 *
+* @param params.event - The event name to listen for.
+* @param params.listener - The callback function to execute when the event is fired.
 * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
-* @returns True if the user is signed in, false otherwise.
-* @see logout
-* @see isAnyWalletAccountConnected
+* @returns A function that can be called to remove the listener.
+* @see offEvent
+* @see onceEvent
 * @notInstrumented
+* @hook Event listeners are error-prone to wire up by hand with useEffect.
 */
-const isSignedIn = (client = getDefaultClient()) => Boolean(client.user || getWalletAccounts(client).length > 0);
-
-//#endregion
-//#region src/modules/projectSettings/fetchProjectSettings/projectSettingsExpirationScheme.ts
-/**
-* The schema to track the expiration time of the project settings.
-*/
-const projectSettingsExpirationStorageKeySchema = createStorageKeySchema({
-	key: "projectSettingsExpiration",
-	schema: z.number()
-});
-
-//#endregion
-//#region src/modules/projectSettings/fetchProjectSettings/fetchProjectSettings.ts
+const onEvent = ({ event, listener }, client = getDefaultClient()) => {
+	const { eventEmitter } = getCore(client);
+	eventEmitter.on(event, listener);
+	return () => {
+		eventEmitter.off(event, listener);
+	};
+};
 /**
-* Expiration time of the project settings in milliseconds.
+* Removes an event listener from Dynamic client events.
+*
+* This function unsubscribes a previously registered event listener
+* from the specified Dynamic client event.
+*
+* @example
+* ```ts
+* offEvent({ event: 'walletAdded', listener: myListener });
+* ```
+*
+* @param params.event - The event name to remove the listener from.
+* @param params.listener - The callback function to remove.
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @see onEvent
+* @see onceEvent
+* @notInstrumented
 */
-const PROJECT_SETTINGS_EXPIRATION_TIME = 1e3 * 60 * 5;
+const offEvent = ({ event, listener }, client = getDefaultClient()) => {
+	const { eventEmitter } = getCore(client);
+	eventEmitter.off(event, listener);
+};
 /**
-* Fetches and updates the project settings from the API.
+* Adds a one-time event listener for Dynamic client events.
 *
-* This function retrieves the latest project configuration settings
-* from Dynamic's servers, including authentication options, enabled chains,
-* and security configurations. The settings are cached for performance.
+* This function listens for an event that will automatically remove itself
+* after being triggered once.
 *
 * @example
 * ```ts
-* const settings = await fetchProjectSettings();
-* console.log('Enabled chains:', settings.chains);
+* onceEvent({
+*   event: 'logout',
+*   listener: () => {
+*     console.log('User logged out');
+*   },
+* });
 * ```
 *
+* @param params.event - The event name to listen for.
+* @param params.listener - The callback function to execute when the event is fired.
 * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
-* @returns A promise that resolves to the updated project settings.
-* @see createDynamicClient
-* @see initializeClient
+* @returns A function that can be called to remove the listener before it fires.
+* @see onEvent
+* @see offEvent
 * @notInstrumented
-* @noHook Internal settings fetch that is not part of the public hook surface.
+* @hook Event listeners are error-prone to wire up by hand with useEffect.
 */
-const fetchProjectSettings = async (client = getDefaultClient()) => {
-	const core = getCore(client);
-	const currentExpiration = await core.storage.getItem(projectSettingsExpirationStorageKeySchema);
-	if (Boolean(client.projectSettings) && !(currentExpiration && currentExpiration < Date.now()) && isSignedIn(client)) return client.projectSettings;
-	const apiClient = createApiClient({}, client);
-	core.logger.debug("[fetchProjectSettings] Fetching project settings...");
-	const doFetch = async () => apiClient.getEnvironmentSettings({
-		environmentId: core.environmentId,
-		sdkVersion: `${CLIENT_SDK_NAME}/${core.version}`
-	}, { credentials: "omit" });
-	const projectSettings = await retryOnFail({
-		fn: doFetch,
-		maxRetries: 2
-	});
-	core.state.set({ projectSettings: projectSettings ?? null });
-	await core.storage.setItem(projectSettingsExpirationStorageKeySchema, Date.now() + PROJECT_SETTINGS_EXPIRATION_TIME);
-	return projectSettings;
-};
-
-//#endregion
-//#region src/modules/sessionKeys/generateSessionKeys/generateSessionKeys.ts
-/** @notInstrumented */
-const generateSessionKeys = async (client) => {
-	const core = getCore(client);
-	const currentState = core.state.get();
-	const isRotation = Boolean(currentState.sessionKeys);
-	const logContext = {
-		environmentId: core.environmentId,
-		operation: isRotation ? "rotate" : "create",
-		userId: currentState.user?.id ?? null
+const onceEvent = ({ event, listener }, client = getDefaultClient()) => {
+	const { eventEmitter } = getCore(client);
+	eventEmitter.once(event, listener);
+	return () => {
+		eventEmitter.off(event, listener);
 	};
-	core.logger.info(isRotation ? "[generateSessionKeys] Rotating session key..." : "[generateSessionKeys] Creating session key...", logContext);
-	await core.keychain.removeKey("session");
-	const publicKey = await core.keychain.generateKey("session");
-	assertDefined(publicKey, "Public key not found");
-	core.state.set({ sessionKeys: publicKey });
-	core.logger.info(isRotation ? "[generateSessionKeys] Session key rotated" : "[generateSessionKeys] Session key created", logContext);
-	return { publicKey };
-};
-
-//#endregion
-//#region src/errors/NoWalletProviderFoundError.ts
-var NoWalletProviderFoundError = class extends BaseError {
-	constructor({ walletProviderKey }) {
-		super({
-			cause: null,
-			code: "no_wallet_provider_found_error",
-			docsUrl: null,
-			name: "NoWalletProviderFoundError",
-			shortMessage: `No wallet provider found with key: ${walletProviderKey}`
-		});
-	}
 };
-
-//#endregion
-//#region src/services/runtimeServices/createRuntimeServiceAccessKey/createRuntimeServiceAccessKey.ts
 /**
-* Creates a service accessor function that manages service instantiation and caching.
-* The returned function will either retrieve an existing service from the registry or
-* create a new one using the provided builder function.
+* Emits a Dynamic client event.
 *
-* @template - The type of service to be created/accessed
-* @param key - Unique identifier for the service in the registry
-* @param builder - Function that creates the service instance when called with a DynamicClient
+* This function triggers an event that will be received by all registered
+* listeners for the specified event type.
+*
+* @param params.event - The event name to emit.
+* @param params.args - The arguments to pass to event listeners.
+* @param client - The Dynamic client instance.
 * @notInstrumented
 */
-const createRuntimeServiceAccessKey = (key, builder) => (client) => {
-	const { runtimeServices } = getCore(client);
-	const currentService = runtimeServices.getByKey(key);
-	if (currentService) return currentService;
-	const service = builder(client);
-	runtimeServices.register(key, service);
-	return service;
+const emitEvent = ({ event, args }, client) => {
+	const { eventEmitter } = getCore(client);
+	eventEmitter.emit(event, args);
 };
 
 //#endregion
@@ -1514,62 +1371,93 @@ const WalletProviderPriority = {
 };
 
 //#endregion
-//#region src/modules/wallets/utils/getWalletProviderFromWalletAccount/getWalletProviderFromWalletAccount.ts
+//#region src/modules/wallets/getWalletProviders/getWalletProviders.ts
+/**
+* Get all available wallet providers to interact with internally.
+* @notInstrumented
+*/
+const getWalletProviders = (client) => {
+	return getWalletProviderRegistry(client).listProviders();
+};
+
+//#endregion
+//#region src/modules/waas/constants.ts
+const DEFAULT_WAAS_BASE_API_URL = "https://app.dynamicauth.com";
+const DEFAULT_WAAS_BASE_MPC_RELAY_API_URL = "https://relay.dynamicauth.com";
+const DYNAMIC_WAAS_METADATA = {
+	displayName: "Dynamic WaaS",
+	icon: `${DYNAMIC_ICONIC_SPRITE_URL}#dynamicwaas`,
+	normalizedWalletName: "dynamicwaas"
+};
+
+//#endregion
+//#region src/modules/waas/isWaasWalletProvider/isWaasWalletProvider.ts
 /** @notInstrumented */
-const getWalletProviderFromWalletAccount = ({ walletAccount }, client) => {
-	const walletProvider = getWalletProviderRegistry(client).getByKey(walletAccount.walletProviderKey);
-	if (!walletProvider) throw new NoWalletProviderFoundError({ walletProviderKey: walletAccount.walletProviderKey });
-	return walletProvider;
+const isWaasWalletProvider = (walletProvider) => {
+	return walletProvider.key.includes(DYNAMIC_WAAS_METADATA.normalizedWalletName);
 };
 
 //#endregion
-//#region src/modules/wallets/utils/getAvailableWalletProvidersFromWalletAccounts/getAvailableWalletProvidersFromWalletAccounts.ts
+//#region src/modules/waas/findWaasWalletProviderByChain/findWaasWalletProviderByChain.ts
 /** @notInstrumented */
-const getAvailableWalletProvidersFromWalletAccounts = (client) => {
-	const core = getCore(client);
-	const walletProvidersMap = /* @__PURE__ */ new Map();
-	getWalletAccounts(client).forEach((walletAccount) => {
-		if (walletProvidersMap.has(walletAccount.walletProviderKey)) return;
-		try {
-			const walletProvider = getWalletProviderFromWalletAccount({ walletAccount }, client);
-			walletProvidersMap.set(walletAccount.walletProviderKey, walletProvider);
-		} catch (error) {
-			core.logger.debug("Wallet provider not found for wallet account", {
-				error,
-				walletAccount: walletAccount.address
-			});
-		}
+const findWaasWalletProviderByChain = ({ chain }, client) => {
+	const providers = getWalletProviders(client);
+	const waasProviderKey = formatWalletProviderKey({
+		chain,
+		displayName: DYNAMIC_WAAS_METADATA.displayName,
+		walletProviderType: WalletProviderEnum.EmbeddedWallet
 	});
-	return Array.from(walletProvidersMap.values());
+	const waasProvider = providers.find((provider) => provider.key === waasProviderKey && provider.chain === chain);
+	if (!waasProvider || !isWaasWalletProvider(waasProvider)) return null;
+	return waasProvider;
 };
 
 //#endregion
-//#region src/modules/wallets/destroyWalletProviders/destroyWalletProviders.ts
+//#region src/modules/waas/isWaasWalletAccount/isWaasWalletAccount.ts
 /**
-* Tear down every wallet provider on the client.
-*
-* Each provider's `destroy` is responsible for its own local + remote
-* cleanup. We swallow errors so a failing destroy on one provider does not
-* block teardown of the others (e.g. during logout).
+* This function determines whether the provided wallet account is a Dynamic
+* WaaS wallet account.
 *
+* @param params.walletAccount - The wallet account to check.
+* @returns True if the wallet account is a WaaS wallet account, false otherwise.
 * @notInstrumented
 */
-const destroyWalletProviders = async ({ reason }, client) => {
-	const core = getCore(client);
-	const walletProviders = getAvailableWalletProvidersFromWalletAccounts(client);
-	await Promise.all(walletProviders.map(async (walletProvider) => {
-		if (!walletProvider.destroy) return;
-		try {
-			await walletProvider.destroy({ reason });
-		} catch (err) {
-			core.logger.error(`Error destroying wallet provider ${walletProvider.key}`, err);
-		}
-	}));
+const isWaasWalletAccount = ({ walletAccount }) => {
+	return walletAccount.walletProviderKey.includes(DYNAMIC_WAAS_METADATA.normalizedWalletName);
 };
 
 //#endregion
-//#region src/modules/auth/consts.ts
-const DYNAMIC_AUTH_COOKIE_NAME = "DYNAMIC_JWT_TOKEN";
+//#region src/modules/waas/initializeWaasClientsForEagerRecovery/initializeWaasClientsForEagerRecovery.ts
+/**
+* On login, boots the WaaS client once per chain so the SDK eagerly recovers
+* key shares itself (the `eagerlyRecoverKeyShares` capability) instead of the
+* host looping per wallet. Booting calls `initialize()`, which sends the auth
+* token the iframe needs to self-recover.
+*
+* @notInstrumented
+*/
+const initializeWaasClientsForEagerRecovery = async (client) => {
+	/**
+	* Booting triggers recovery, which fails if the user is missing the MFA auth.
+	* This early return avoids attempting a call we know will fail and just adds
+	* noise to the logs.
+	*/
+	if (isUserMissingMfaAuth(client)) return;
+	const waasChains = new Set(getWalletAccounts(client).filter((walletAccount) => isWaasWalletAccount({ walletAccount })).map((walletAccount) => walletAccount.chain));
+	await Promise.all([...waasChains].map(async (chain) => {
+		const provider = findWaasWalletProviderByChain({ chain }, client);
+		/**
+		* The environment might not have the embedded wallet extensions installed.
+		* In that case there is no provider for the chain and nothing to boot.
+		*/
+		if (!provider) return;
+		try {
+			await provider.getWaasClient();
+		} catch (error) {
+			getCore(client).logger.warn("[initializeWaasClientsForEagerRecovery] failed to boot waas client", error);
+		}
+	}));
+};
 
 //#endregion
 //#region src/modules/wallets/emitWalletAccountsChangedEvent/emitWalletAccountsChangedEvent.ts
@@ -1593,6 +1481,160 @@ const checkAndRaiseWalletAccountsChangedEvent = ({ previousState }, client) => {
 };
 const getWalletAccountsHash = (state, client) => getWalletAccountsFromState(state, client).map((walletAccount) => JSON.stringify(walletAccount)).sort().join("-");
 
+//#endregion
+//#region src/errors/InvalidParamError.ts
+var InvalidParamError = class extends BaseError {
+	constructor(message) {
+		super({
+			cause: null,
+			code: "invalid_param_error",
+			docsUrl: null,
+			name: "InvalidParamError",
+			shortMessage: message
+		});
+	}
+};
+
+//#endregion
+//#region src/modules/auth/decodeJwt/decodeJwt.ts
+/**
+* Decodes a JWT token and returns the full payload.
+*
+* This function extracts and returns the complete JWT payload including scopes,
+* expiration time, and other claims.
+*
+* @param jwt - The JWT token string.
+* @returns The decoded JWT payload object.
+* @throws InvalidParamError if the token is invalid or cannot be decoded.
+*
+* @example
+* ```typescript
+* const payload = decodeJwt(jwt);
+* // Returns: { scopes: ['wallet:export'], exp: 1234567890, ... }
+* ```
+* @notInstrumented
+*/
+const decodeJwt = (jwt) => {
+	try {
+		const parts = jwt.split(".");
+		if (parts.length !== 3) throw new InvalidParamError("Invalid JWT format");
+		const base64Payload = parts[1].replaceAll("-", "+").replaceAll("_", "/");
+		const paddedPayload = base64Payload + "=".repeat((4 - base64Payload.length % 4) % 4);
+		const decodedPayload = atob(paddedPayload);
+		return JSON.parse(decodedPayload);
+	} catch (error) {
+		if (error instanceof InvalidParamError) throw error;
+		throw new InvalidParamError(`Failed to decode JWT: ${error instanceof Error ? error.message : String(error)}`);
+	}
+};
+
+//#endregion
+//#region src/modules/auth/updateAuthFromVerifyResponse/elevatedAccessTokens/normalizeScopes/normalizeScopes.ts
+/**
+* Normalizes scopes by deduplicating and sorting them.
+* This creates a canonical representation for comparison.
+*
+* @param scopes - Array of scope strings (may contain duplicates)
+* @returns Normalized, sorted array of unique scopes
+* @notInstrumented
+*/
+const normalizeScopes = (scopes) => {
+	return [...new Set(scopes)].sort((a, b) => a.localeCompare(b));
+};
+
+//#endregion
+//#region src/modules/auth/updateAuthFromVerifyResponse/elevatedAccessTokens/parseElevatedAccessToken/parseElevatedAccessToken.ts
+/**
+* Validates and parses an elevated access token from a JWT string.
+* Extracts scopes, expiration, and validates the token structure.
+*
+* Policy decisions:
+* - Tokens without scopes are rejected (returns null)
+* - Tokens with empty scopes array are rejected (returns null)
+* - Tokens without exp field are rejected (returns null)
+* - Expired tokens are rejected (returns null)
+*
+* @returns Parsed token data or null if token is invalid/expired
+* @notInstrumented
+*/
+const parseElevatedAccessToken = ({ token }) => {
+	const payload = decodeJwt(token);
+	const filteredScopes = ((payload?.scope)?.split(" ") ?? []).filter((s) => s.length > 0);
+	const singleUse = payload.singleUse ?? false;
+	if (!filteredScopes || filteredScopes.length === 0) return null;
+	if (!payload.exp) return null;
+	const expiresAt = /* @__PURE__ */ new Date(payload.exp * 1e3);
+	if (expiresAt <= /* @__PURE__ */ new Date()) return null;
+	return {
+		expiresAt,
+		normalizedScopes: normalizeScopes(filteredScopes),
+		scopes: filteredScopes,
+		singleUse,
+		token
+	};
+};
+
+//#endregion
+//#region src/modules/auth/updateAuthFromVerifyResponse/elevatedAccessTokens/upsertElevatedAccessToken/upsertElevatedAccessToken.ts
+/**
+* Upserts an elevated access token into the current tokens array.
+*
+* Policy: Only one token per normalized scope-set is allowed.
+* If a token with the same normalized scopes exists, it is replaced.
+* This ensures we don't accumulate multiple tokens for the same scope combination.
+*
+* @param currentTokens - Current array of elevated access tokens
+* @param newToken - New token to upsert
+* @returns Updated array of tokens with the new token upserted
+* @notInstrumented
+*/
+const upsertElevatedAccessToken = ({ currentTokens, newToken }) => {
+	const newScopeKey = normalizeScopes(newToken.scopes).join(" ");
+	return [...currentTokens.filter((existingToken) => {
+		return normalizeScopes(existingToken.scopes).join(" ") !== newScopeKey;
+	}), {
+		expiresAt: newToken.expiresAt,
+		scopes: newToken.scopes,
+		singleUse: newToken.singleUse,
+		token: newToken.token
+	}];
+};
+
+//#endregion
+//#region src/modules/auth/updateAuthFromVerifyResponse/updateAuthFromVerifyResponse.ts
+/** @notInstrumented */
+const updateAuthFromVerifyResponse = ({ response }, client) => {
+	const core = getCore(client);
+	const previousState = { ...core.state.get() };
+	const { user, minifiedJwt, jwt, expiresAt, mfaToken, elevatedAccessToken } = response;
+	const sessionExpiresAt = /* @__PURE__ */ new Date(expiresAt * 1e3);
+	const newState = {
+		legacyToken: jwt ?? null,
+		sessionExpiresAt,
+		token: minifiedJwt ?? null,
+		user
+	};
+	if (mfaToken) newState.mfaToken = mfaToken;
+	const currentTokens = core.state.get().elevatedAccessTokens || [];
+	newState.elevatedAccessTokens = currentTokens;
+	if (elevatedAccessToken) {
+		const parsedToken = parseElevatedAccessToken({ token: elevatedAccessToken });
+		if (parsedToken) newState.elevatedAccessTokens = upsertElevatedAccessToken({
+			currentTokens,
+			newToken: parsedToken
+		});
+	}
+	core.state.set(newState);
+	/**
+	* For customers using a sandbox environment with cookies enabled, we need to set the cookie
+	* programmatically because Redcoast won't set the cookie via headers. We set the cookie programmatically
+	* so customers can access the cookie from document.cookie consistently between sandbox and live environments.
+	*/
+	if (minifiedJwt && isCookieEnabled(client)) setCookie(`${DYNAMIC_AUTH_COOKIE_NAME}=${minifiedJwt}; expires=${sessionExpiresAt.toUTCString()}; path=/; SameSite=Lax${getSecureCookieAttribute()}`);
+	checkAndRaiseWalletAccountsChangedEvent({ previousState }, client);
+	if (!previousState.user && Boolean(newState.user)) initializeWaasClientsForEagerRecovery(client);
+};
+
 //#endregion
 //#region src/modules/auth/extractSessionId/extractSessionId.ts
 /**
@@ -2002,67 +2044,41 @@ const instrumentFunction = ({ fn, functionName, getCore: getCore$1, selectors })
 };
 
 //#endregion
-//#region src/modules/auth/logoutWithReason/logoutWithReason.ts
+//#region src/modules/user/refreshAuth/refreshAuth.ts
 /**
-* Logs the user out with an explicit reason.
+* Refreshes the current session's authentication from the server.
 *
-* Revokes the session, clears auth state, terminates wallet providers, and
-* emits the `logout` client event with the given reason. The reason is also
-* captured as an argument on the function-instrumentation event, which is
-* how Datadog distinguishes between different logout causes.
+* This rotates the auth token via a full verify call and updates both the
+* token and the user state from the response, returning the raw
+* `VerifyResponse` (which includes the new token). Reach for this when you
+* need a fresh JWT — e.g. before a call that requires a non-expired token.
 *
-* Use this instead of the public `logout` when triggering a logout from
-* internal or extension code — the caller owns the reason string, so the
-* telemetry correctly attributes *why* the logout happened.
+* Prefer `refreshUser` when you only need the latest user profile and do not
+* care about rotating the token: it hits the authenticated-user endpoint,
+* touches only the user state, and returns the `User` directly.
 *
-* @param params - The logout params.
-* @param params.reason - Why the logout is being triggered. Extension authors
-*   needing a reason outside the SDK catalog can cast with `as LogoutReason`.
-* @param client - The Dynamic client instance.
+* @example
+* ```ts
+* const response = await refreshAuth();
+* console.log('Token refreshed:', response.token);
+* ```
+*
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns A promise that resolves to the verify response.
+* @see logout
+* @see refreshUser
 * @instrumented
 */
-const logoutWithReason = async ({ reason }, client) => {
+const refreshAuth = async (client = getDefaultClient()) => {
 	const core = getCore(client);
-	core.logger.debug("[logoutWithReason] Logging out...", { reason });
-	await destroyWalletProviders({ reason }, client);
-	if (client.user !== null) {
-		const apiClient = createApiClient({ headers: { [DYNAMIC_LOGOUT_REASON_HEADER]: reason } }, client);
-		try {
-			await apiClient.revokeSession({ environmentId: core.environmentId });
-		} catch (error) {
-			core.logger.error("Failed to revoke session", error);
-		}
-		/**
-		* This deletes the auth cookie if it exists.
-		* If the cookie doesn't exist, this sets a new cookie that expires immediately.
-		*/
-		if (isCookieEnabled(client)) setCookie(`${DYNAMIC_AUTH_COOKIE_NAME}=; Max-Age=-99999999; path=/; SameSite=Lax${getSecureCookieAttribute()}`);
-	}
-	await core.keychain.removeKey("session");
-	const previousState = core.state.get();
-	core.state.set({
-		captchaToken: null,
-		elevatedAccessTokens: [],
-		legacyToken: null,
-		mfaToken: null,
-		sessionExpiresAt: null,
-		sessionKeys: null,
-		token: null,
-		unverifiedWalletAccounts: [],
-		user: null
-	});
-	emitEvent({
-		args: { reason },
-		event: "logout"
-	}, client);
-	checkAndRaiseWalletAccountsChangedEvent({ previousState }, client);
-	fetchProjectSettings(client);
-	generateSessionKeys(client);
-};
-const __logoutWithReason_impl = logoutWithReason;
-const __logoutWithReason_wrapped = instrumentFunction({
-	fn: __logoutWithReason_impl,
-	functionName: "logoutWithReason",
+	const response = await createBaseApiClient({ middleware: [createDeviceSignatureHeadersMiddleware(client)] }, client).refreshAuth({ environmentId: core.environmentId });
+	updateAuthFromVerifyResponse({ response }, client);
+	return response;
+};
+const __refreshAuth_impl = refreshAuth;
+const __refreshAuth_wrapped = instrumentFunction({
+	fn: __refreshAuth_impl,
+	functionName: "refreshAuth",
 	getCore: () => {
 		try {
 			return getCore(getDefaultClient());
@@ -2073,267 +2089,343 @@ const __logoutWithReason_wrapped = instrumentFunction({
 });
 
 //#endregion
-//#region src/modules/mfa/isUserMissingMfaAuth/isUserMissingMfaAuth.ts
+//#region src/modules/apiClient/utils/rbacStaleMiddleware/createRbacStaleMiddleware.ts
+const RBAC_STALE_CODE = "rbac_stale";
+const RBAC_STALE_RETRY_HEADER = "x-dyn-rbac-retry";
 /**
-* Checks if the user requires additional MFA authentication.
-*
-* This function determines if the current user session requires
-* additional multi-factor authentication to access certain features.
-*
-* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
-* @returns True if the user needs additional MFA authentication, false otherwise.
+* Detects 403 { code: 'rbac_stale' } responses, refreshes the auth token, and
+* retries the request once with the new token. This lets business account role
+* changes take effect without revoking the user's session.
 * @notInstrumented
-* @hook Exposed as a hook so consumers reactively know when MFA is still required, updated when the user changes.
 */
-const isUserMissingMfaAuth = (client = getDefaultClient()) => {
-	const user = client.user;
-	assertDefined(user, "User not logged in");
-	return Boolean(user.scope?.includes("requiresAdditionalAuth"));
-};
+const createRbacStaleMiddleware = (client) => ({ post: async (context) => {
+	if (context.response.status !== 403) return context.response;
+	if (context.init.headers && typeof context.init.headers === "object" && RBAC_STALE_RETRY_HEADER in context.init.headers) return context.response;
+	let errorBody;
+	try {
+		errorBody = await context.response.clone().json();
+	} catch {
+		return context.response;
+	}
+	if (!(typeof errorBody === "object" && errorBody !== null && "code" in errorBody && errorBody.code === RBAC_STALE_CODE)) return context.response;
+	try {
+		await __refreshAuth_wrapped(client);
+	} catch {
+		return context.response;
+	}
+	if (!client.token) return context.response;
+	const headers = { ...context.init.headers };
+	delete headers[RBAC_STALE_RETRY_HEADER];
+	delete headers[MFA_TOKEN_HEADER];
+	delete headers[ELEVATED_ACCESS_TOKEN_HEADER];
+	headers.Authorization = `Bearer ${client.token}`;
+	return context.fetch(context.url, {
+		...context.init,
+		headers: {
+			...headers,
+			[RBAC_STALE_RETRY_HEADER]: "1"
+		}
+	});
+} });
 
 //#endregion
-//#region src/modules/wallets/getWalletProviders/getWalletProviders.ts
+//#region src/modules/apiClient/createApiClient.ts
 /**
-* Get all available wallet providers to interact with internally.
+* Returns a new instance of the SDK API client.
+*
+* This is not meant for storing, as it is very light we can create it whenever needed.
 * @notInstrumented
 */
-const getWalletProviders = (client) => {
-	return getWalletProviderRegistry(client).listProviders();
-};
-
-//#endregion
-//#region src/modules/waas/constants.ts
-const DEFAULT_WAAS_BASE_API_URL = "https://app.dynamicauth.com";
-const DEFAULT_WAAS_BASE_MPC_RELAY_API_URL = "https://relay.dynamicauth.com";
-const DYNAMIC_WAAS_METADATA = {
-	displayName: "Dynamic WaaS",
-	icon: `${DYNAMIC_ICONIC_SPRITE_URL}#dynamicwaas`,
-	normalizedWalletName: "dynamicwaas"
+const createApiClient = (options = {}, client) => {
+	return createBaseApiClient({
+		middleware: [createDeviceSignatureHeadersMiddleware(client), createRbacStaleMiddleware(client)],
+		options
+	}, client);
 };
 
 //#endregion
-//#region src/modules/waas/isWaasWalletProvider/isWaasWalletProvider.ts
-/** @notInstrumented */
-const isWaasWalletProvider = (walletProvider) => {
-	return walletProvider.key.includes(DYNAMIC_WAAS_METADATA.normalizedWalletName);
+//#region src/errors/NoWalletProviderFoundError.ts
+var NoWalletProviderFoundError = class extends BaseError {
+	constructor({ walletProviderKey }) {
+		super({
+			cause: null,
+			code: "no_wallet_provider_found_error",
+			docsUrl: null,
+			name: "NoWalletProviderFoundError",
+			shortMessage: `No wallet provider found with key: ${walletProviderKey}`
+		});
+	}
 };
 
 //#endregion
-//#region src/modules/waas/findWaasWalletProviderByChain/findWaasWalletProviderByChain.ts
+//#region src/modules/wallets/utils/getWalletProviderFromWalletAccount/getWalletProviderFromWalletAccount.ts
 /** @notInstrumented */
-const findWaasWalletProviderByChain = ({ chain }, client) => {
-	const providers = getWalletProviders(client);
-	const waasProviderKey = formatWalletProviderKey({
-		chain,
-		displayName: DYNAMIC_WAAS_METADATA.displayName,
-		walletProviderType: WalletProviderEnum.EmbeddedWallet
-	});
-	const waasProvider = providers.find((provider) => provider.key === waasProviderKey && provider.chain === chain);
-	if (!waasProvider || !isWaasWalletProvider(waasProvider)) return null;
-	return waasProvider;
-};
-
-//#endregion
-//#region src/modules/waas/isWaasWalletAccount/isWaasWalletAccount.ts
-/**
-* This function determines whether the provided wallet account is a Dynamic
-* WaaS wallet account.
-*
-* @param params.walletAccount - The wallet account to check.
-* @returns True if the wallet account is a WaaS wallet account, false otherwise.
-* @notInstrumented
-*/
-const isWaasWalletAccount = ({ walletAccount }) => {
-	return walletAccount.walletProviderKey.includes(DYNAMIC_WAAS_METADATA.normalizedWalletName);
+const getWalletProviderFromWalletAccount = ({ walletAccount }, client) => {
+	const walletProvider = getWalletProviderRegistry(client).getByKey(walletAccount.walletProviderKey);
+	if (!walletProvider) throw new NoWalletProviderFoundError({ walletProviderKey: walletAccount.walletProviderKey });
+	return walletProvider;
 };
 
 //#endregion
-//#region src/modules/waas/initializeWaasClientsForEagerRecovery/initializeWaasClientsForEagerRecovery.ts
+//#region src/utils/retryOnFail/InvalidRetryOnFailCallError.ts
 /**
-* On login, boots the WaaS client once per chain so the SDK eagerly recovers
-* key shares itself (the `eagerlyRecoverKeyShares` capability) instead of the
-* host looping per wallet. Booting calls `initialize()`, which sends the auth
-* token the iframe needs to self-recover.
-*
-* @notInstrumented
+* This error is thrown when the `retryOnFail` function is called with an invalid
+* number of retries (i.e. less than 0).
 */
-const initializeWaasClientsForEagerRecovery = async (client) => {
-	/**
-	* Booting triggers recovery, which fails if the user is missing the MFA auth.
-	* This early return avoids attempting a call we know will fail and just adds
-	* noise to the logs.
-	*/
-	if (isUserMissingMfaAuth(client)) return;
-	const waasChains = new Set(getWalletAccounts(client).filter((walletAccount) => isWaasWalletAccount({ walletAccount })).map((walletAccount) => walletAccount.chain));
-	await Promise.all([...waasChains].map(async (chain) => {
-		const provider = findWaasWalletProviderByChain({ chain }, client);
-		/**
-		* The environment might not have the embedded wallet extensions installed.
-		* In that case there is no provider for the chain and nothing to boot.
-		*/
-		if (!provider) return;
-		try {
-			await provider.getWaasClient();
-		} catch (error) {
-			getCore(client).logger.warn("[initializeWaasClientsForEagerRecovery] failed to boot waas client", error);
-		}
-	}));
-};
-
-//#endregion
-//#region src/errors/InvalidParamError.ts
-var InvalidParamError = class extends BaseError {
-	constructor(message) {
+var InvalidRetryOnFailCallError = class extends BaseError {
+	constructor(maxRetries) {
 		super({
 			cause: null,
-			code: "invalid_param_error",
+			code: "invalid_retry_on_fail_call_error",
 			docsUrl: null,
-			name: "InvalidParamError",
-			shortMessage: message
+			name: "InvalidRetryOnFailCallError",
+			shortMessage: `Invalid retries parameter for retryOnFail call: ${maxRetries}`
 		});
 	}
 };
 
 //#endregion
-//#region src/modules/auth/decodeJwt/decodeJwt.ts
+//#region src/utils/retryOnFail/retryOnFail.ts
+/** @notInstrumented */
+const retryOnFail = async ({ delay = 0, fn, maxRetries }) => {
+	for (let retry = 0; retry <= maxRetries; retry++) try {
+		return await fn();
+	} catch (error) {
+		if (retry >= maxRetries) throw error;
+		if (delay > 0) await new Promise((resolve) => setTimeout(resolve, delay));
+	}
+	/**
+	* Reaching this point should never happen and this
+	* error is thrown to help us debug the issue.
+	*/
+	throw new InvalidRetryOnFailCallError(maxRetries);
+};
+
+//#endregion
+//#region src/modules/auth/isSignedIn/isSignedIn.ts
 /**
-* Decodes a JWT token and returns the full payload.
+* Checks if the user is currently signed in to the Dynamic client.
 *
-* This function extracts and returns the complete JWT payload including scopes,
-* expiration time, and other claims.
+* The client is considered to be in a signed in state if a user has
+* authenticated or if the client has at least one wallet connected.
 *
-* @param jwt - The JWT token string.
-* @returns The decoded JWT payload object.
-* @throws InvalidParamError if the token is invalid or cannot be decoded.
+* @deprecated What counts as "signed in" is your app's business logic, not the
+* SDK's. This helper bakes in one opinion (a user OR any connected wallet),
+* which rarely matches every app and forces a dependency on us for every
+* variation. Compose your own check from the underlying primitives instead —
+* e.g. `Boolean(client.user) || isAnyWalletAccountConnected(client)` — and
+* layer in whatever your app requires (device registration, completed
+* onboarding, satisfied MFA, a required embedded wallet, …). See the
+* "Check if signed in" guide:
+* https://www.dynamic.xyz/docs/javascript/user-session-management
 *
 * @example
-* ```typescript
-* const payload = decodeJwt(jwt);
-* // Returns: { scopes: ['wallet:export'], exp: 1234567890, ... }
+* ```ts
+* if (isSignedIn()) {
+*   console.log('User is authenticated or has a wallet connected');
+* }
 * ```
+*
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns True if the user is signed in, false otherwise.
+* @see logout
+* @see isAnyWalletAccountConnected
 * @notInstrumented
 */
-const decodeJwt = (jwt) => {
-	try {
-		const parts = jwt.split(".");
-		if (parts.length !== 3) throw new InvalidParamError("Invalid JWT format");
-		const base64Payload = parts[1].replaceAll("-", "+").replaceAll("_", "/");
-		const paddedPayload = base64Payload + "=".repeat((4 - base64Payload.length % 4) % 4);
-		const decodedPayload = atob(paddedPayload);
-		return JSON.parse(decodedPayload);
-	} catch (error) {
-		if (error instanceof InvalidParamError) throw error;
-		throw new InvalidParamError(`Failed to decode JWT: ${error instanceof Error ? error.message : String(error)}`);
-	}
-};
+const isSignedIn = (client = getDefaultClient()) => Boolean(client.user || getWalletAccounts(client).length > 0);
 
 //#endregion
-//#region src/modules/auth/updateAuthFromVerifyResponse/elevatedAccessTokens/normalizeScopes/normalizeScopes.ts
+//#region src/modules/projectSettings/fetchProjectSettings/projectSettingsExpirationScheme.ts
 /**
-* Normalizes scopes by deduplicating and sorting them.
-* This creates a canonical representation for comparison.
-*
-* @param scopes - Array of scope strings (may contain duplicates)
-* @returns Normalized, sorted array of unique scopes
-* @notInstrumented
+* The schema to track the expiration time of the project settings.
 */
-const normalizeScopes = (scopes) => {
-	return [...new Set(scopes)].sort((a, b) => a.localeCompare(b));
-};
+const projectSettingsExpirationStorageKeySchema = createStorageKeySchema({
+	key: "projectSettingsExpiration",
+	schema: z.number()
+});
 
 //#endregion
-//#region src/modules/auth/updateAuthFromVerifyResponse/elevatedAccessTokens/parseElevatedAccessToken/parseElevatedAccessToken.ts
+//#region src/modules/projectSettings/fetchProjectSettings/fetchProjectSettings.ts
 /**
-* Validates and parses an elevated access token from a JWT string.
-* Extracts scopes, expiration, and validates the token structure.
+* Expiration time of the project settings in milliseconds.
+*/
+const PROJECT_SETTINGS_EXPIRATION_TIME = 1e3 * 60 * 5;
+/**
+* Fetches and updates the project settings from the API.
 *
-* Policy decisions:
-* - Tokens without scopes are rejected (returns null)
-* - Tokens with empty scopes array are rejected (returns null)
-* - Tokens without exp field are rejected (returns null)
-* - Expired tokens are rejected (returns null)
+* This function retrieves the latest project configuration settings
+* from Dynamic's servers, including authentication options, enabled chains,
+* and security configurations. The settings are cached for performance.
 *
-* @returns Parsed token data or null if token is invalid/expired
+* @example
+* ```ts
+* const settings = await fetchProjectSettings();
+* console.log('Enabled chains:', settings.chains);
+* ```
+*
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns A promise that resolves to the updated project settings.
+* @see createDynamicClient
+* @see initializeClient
 * @notInstrumented
+* @noHook Internal settings fetch that is not part of the public hook surface.
 */
-const parseElevatedAccessToken = ({ token }) => {
-	const payload = decodeJwt(token);
-	const filteredScopes = ((payload?.scope)?.split(" ") ?? []).filter((s) => s.length > 0);
-	const singleUse = payload.singleUse ?? false;
-	if (!filteredScopes || filteredScopes.length === 0) return null;
-	if (!payload.exp) return null;
-	const expiresAt = /* @__PURE__ */ new Date(payload.exp * 1e3);
-	if (expiresAt <= /* @__PURE__ */ new Date()) return null;
-	return {
-		expiresAt,
-		normalizedScopes: normalizeScopes(filteredScopes),
-		scopes: filteredScopes,
-		singleUse,
-		token
+const fetchProjectSettings = async (client = getDefaultClient()) => {
+	const core = getCore(client);
+	const currentExpiration = await core.storage.getItem(projectSettingsExpirationStorageKeySchema);
+	if (Boolean(client.projectSettings) && !(currentExpiration && currentExpiration < Date.now()) && isSignedIn(client)) return client.projectSettings;
+	const apiClient = createApiClient({}, client);
+	core.logger.debug("[fetchProjectSettings] Fetching project settings...");
+	const doFetch = async () => apiClient.getEnvironmentSettings({
+		environmentId: core.environmentId,
+		sdkVersion: `${CLIENT_SDK_NAME}/${core.version}`
+	}, { credentials: "omit" });
+	const projectSettings = await retryOnFail({
+		fn: doFetch,
+		maxRetries: 2
+	});
+	core.state.set({ projectSettings: projectSettings ?? null });
+	await core.storage.setItem(projectSettingsExpirationStorageKeySchema, Date.now() + PROJECT_SETTINGS_EXPIRATION_TIME);
+	return projectSettings;
+};
+
+//#endregion
+//#region src/modules/sessionKeys/generateSessionKeys/generateSessionKeys.ts
+/** @notInstrumented */
+const generateSessionKeys = async (client) => {
+	const core = getCore(client);
+	const currentState = core.state.get();
+	const isRotation = Boolean(currentState.sessionKeys);
+	const logContext = {
+		environmentId: core.environmentId,
+		operation: isRotation ? "rotate" : "create",
+		userId: currentState.user?.id ?? null
 	};
+	core.logger.info(isRotation ? "[generateSessionKeys] Rotating session key..." : "[generateSessionKeys] Creating session key...", logContext);
+	await core.keychain.removeKey("session");
+	const publicKey = await core.keychain.generateKey("session");
+	assertDefined(publicKey, "Public key not found");
+	core.state.set({ sessionKeys: publicKey });
+	core.logger.info(isRotation ? "[generateSessionKeys] Session key rotated" : "[generateSessionKeys] Session key created", logContext);
+	return { publicKey };
 };
 
 //#endregion
-//#region src/modules/auth/updateAuthFromVerifyResponse/elevatedAccessTokens/upsertElevatedAccessToken/upsertElevatedAccessToken.ts
+//#region src/modules/wallets/utils/getAvailableWalletProvidersFromWalletAccounts/getAvailableWalletProvidersFromWalletAccounts.ts
+/** @notInstrumented */
+const getAvailableWalletProvidersFromWalletAccounts = (client) => {
+	const core = getCore(client);
+	const walletProvidersMap = /* @__PURE__ */ new Map();
+	getWalletAccounts(client).forEach((walletAccount) => {
+		if (walletProvidersMap.has(walletAccount.walletProviderKey)) return;
+		try {
+			const walletProvider = getWalletProviderFromWalletAccount({ walletAccount }, client);
+			walletProvidersMap.set(walletAccount.walletProviderKey, walletProvider);
+		} catch (error) {
+			core.logger.debug("Wallet provider not found for wallet account", {
+				error,
+				walletAccount: walletAccount.address
+			});
+		}
+	});
+	return Array.from(walletProvidersMap.values());
+};
+
+//#endregion
+//#region src/modules/wallets/destroyWalletProviders/destroyWalletProviders.ts
 /**
-* Upserts an elevated access token into the current tokens array.
+* Tear down every wallet provider on the client.
 *
-* Policy: Only one token per normalized scope-set is allowed.
-* If a token with the same normalized scopes exists, it is replaced.
-* This ensures we don't accumulate multiple tokens for the same scope combination.
+* Each provider's `destroy` is responsible for its own local + remote
+* cleanup. We swallow errors so a failing destroy on one provider does not
+* block teardown of the others (e.g. during logout).
 *
-* @param currentTokens - Current array of elevated access tokens
-* @param newToken - New token to upsert
-* @returns Updated array of tokens with the new token upserted
 * @notInstrumented
 */
-const upsertElevatedAccessToken = ({ currentTokens, newToken }) => {
-	const newScopeKey = normalizeScopes(newToken.scopes).join(" ");
-	return [...currentTokens.filter((existingToken) => {
-		return normalizeScopes(existingToken.scopes).join(" ") !== newScopeKey;
-	}), {
-		expiresAt: newToken.expiresAt,
-		scopes: newToken.scopes,
-		singleUse: newToken.singleUse,
-		token: newToken.token
-	}];
+const destroyWalletProviders = async ({ reason }, client) => {
+	const core = getCore(client);
+	const walletProviders = getAvailableWalletProvidersFromWalletAccounts(client);
+	await Promise.all(walletProviders.map(async (walletProvider) => {
+		if (!walletProvider.destroy) return;
+		try {
+			await walletProvider.destroy({ reason });
+		} catch (err) {
+			core.logger.error(`Error destroying wallet provider ${walletProvider.key}`, err);
+		}
+	}));
 };
 
 //#endregion
-//#region src/modules/auth/updateAuthFromVerifyResponse/updateAuthFromVerifyResponse.ts
-/** @notInstrumented */
-const updateAuthFromVerifyResponse = ({ response }, client) => {
+//#region src/modules/auth/logoutWithReason/logoutWithReason.ts
+/**
+* Logs the user out with an explicit reason.
+*
+* Revokes the session, clears auth state, terminates wallet providers, and
+* emits the `logout` client event with the given reason. The reason is also
+* captured as an argument on the function-instrumentation event, which is
+* how Datadog distinguishes between different logout causes.
+*
+* Use this instead of the public `logout` when triggering a logout from
+* internal or extension code — the caller owns the reason string, so the
+* telemetry correctly attributes *why* the logout happened.
+*
+* @param params - The logout params.
+* @param params.reason - Why the logout is being triggered. Extension authors
+*   needing a reason outside the SDK catalog can cast with `as LogoutReason`.
+* @param client - The Dynamic client instance.
+* @instrumented
+*/
+const logoutWithReason = async ({ reason }, client) => {
 	const core = getCore(client);
-	const previousState = { ...core.state.get() };
-	const { user, minifiedJwt, jwt, expiresAt, mfaToken, elevatedAccessToken } = response;
-	const sessionExpiresAt = /* @__PURE__ */ new Date(expiresAt * 1e3);
-	const newState = {
-		legacyToken: jwt ?? null,
-		sessionExpiresAt,
-		token: minifiedJwt ?? null,
-		user
-	};
-	if (mfaToken) newState.mfaToken = mfaToken;
-	const currentTokens = core.state.get().elevatedAccessTokens || [];
-	newState.elevatedAccessTokens = currentTokens;
-	if (elevatedAccessToken) {
-		const parsedToken = parseElevatedAccessToken({ token: elevatedAccessToken });
-		if (parsedToken) newState.elevatedAccessTokens = upsertElevatedAccessToken({
-			currentTokens,
-			newToken: parsedToken
-		});
+	core.logger.debug("[logoutWithReason] Logging out...", { reason });
+	await destroyWalletProviders({ reason }, client);
+	if (client.user !== null) {
+		const apiClient = createApiClient({ headers: { [DYNAMIC_LOGOUT_REASON_HEADER]: reason } }, client);
+		try {
+			await apiClient.revokeSession({ environmentId: core.environmentId });
+		} catch (error) {
+			core.logger.error("Failed to revoke session", error);
+		}
+		/**
+		* This deletes the auth cookie if it exists.
+		* If the cookie doesn't exist, this sets a new cookie that expires immediately.
+		*/
+		if (isCookieEnabled(client)) setCookie(`${DYNAMIC_AUTH_COOKIE_NAME}=; Max-Age=-99999999; path=/; SameSite=Lax${getSecureCookieAttribute()}`);
 	}
-	core.state.set(newState);
-	/**
-	* For customers using a sandbox environment with cookies enabled, we need to set the cookie
-	* programmatically because Redcoast won't set the cookie via headers. We set the cookie programmatically
-	* so customers can access the cookie from document.cookie consistently between sandbox and live environments.
-	*/
-	if (minifiedJwt && isCookieEnabled(client)) setCookie(`${DYNAMIC_AUTH_COOKIE_NAME}=${minifiedJwt}; expires=${sessionExpiresAt.toUTCString()}; path=/; SameSite=Lax${getSecureCookieAttribute()}`);
+	await core.keychain.removeKey("session");
+	const previousState = core.state.get();
+	core.state.set({
+		captchaToken: null,
+		elevatedAccessTokens: [],
+		legacyToken: null,
+		mfaToken: null,
+		sessionExpiresAt: null,
+		sessionKeys: null,
+		token: null,
+		unverifiedWalletAccounts: [],
+		user: null
+	});
+	emitEvent({
+		args: { reason },
+		event: "logout"
+	}, client);
 	checkAndRaiseWalletAccountsChangedEvent({ previousState }, client);
-	if (!previousState.user && Boolean(newState.user)) initializeWaasClientsForEagerRecovery(client);
+	fetchProjectSettings(client);
+	generateSessionKeys(client);
 };
+const __logoutWithReason_impl = logoutWithReason;
+const __logoutWithReason_wrapped = instrumentFunction({
+	fn: __logoutWithReason_impl,
+	functionName: "logoutWithReason",
+	getCore: () => {
+		try {
+			return getCore(getDefaultClient());
+		} catch {
+			return;
+		}
+	}
+});
 
 //#endregion
-export { createStorageKeySchema as $, fetchProjectSettings as A, InvalidWalletProviderKeyError as B, emitWalletAccountsChangedEvent as C, name as Ct, createRuntimeServiceAccessKey as D, getWalletProviderRegistry as E, getChainFromVerifiedCredentialChain as F, onceEvent as G, emitEvent as H, CHAINS_INFO_MAP as I, getHeadersForNonceSignedByDeviceSigners as J, createApiClient as K, formatWalletAccountId as L, getWalletAccounts as M, formatWalletProviderKey as N, NoWalletProviderFoundError as O, normalizeWalletNameWithChain as P, updateNoncePoolStorage as Q, normalizeAddress as R, checkAndRaiseWalletAccountsChangedEvent as S, getCore as St, WalletProviderPriority as T, offEvent as U, retryOnFail as V, onEvent as W, getNonce as X, getDeviceSigner as Y, fetchAndStoreNonces as Z, scrubParameters as _, NONCE_POOL_SIZE as _t, InvalidParamError as a, InvalidExternalAuthError as at, getOperatingSystem as b, ClientNotFoundError as bt, findWaasWalletProviderByChain as c, DYNAMIC_ICONIC_SPRITE_URL as ct, DEFAULT_WAAS_BASE_MPC_RELAY_API_URL as d, isCookieEnabled as dt, UnauthorizedError as et, DYNAMIC_WAAS_METADATA as f, assertDefined as ft, instrumentFunction as g, getPlatform as gt, __logoutWithReason_wrapped as h, randomString as ht, decodeJwt as i, LinkCredentialError as it, isSignedIn as j, generateSessionKeys as k, isWaasWalletProvider as l, SDK_API_CORE_VERSION as lt, isUserMissingMfaAuth as m, getElevatedAccessToken as mt, upsertElevatedAccessToken as n, MfaRateLimitedError as nt, initializeWaasClientsForEagerRecovery as o, APIError as ot, getWalletProviders as p, ValueMustBeDefinedError as pt, createDeviceSignatureHeadersMiddleware as q, parseElevatedAccessToken as r, MfaInvalidOtpError as rt, isWaasWalletAccount as s, CLIENT_SDK_NAME as st, updateAuthFromVerifyResponse as t, SandboxMaximumThresholdReachedError as tt, DEFAULT_WAAS_BASE_API_URL as u, getSessionKeys as ut, DEFAULT_PII_FIELDS as v, getDefaultClient as vt, getWalletProviderFromWalletAccount as w, version as wt, extractSessionId as x, BaseError as xt, getUserAgent as y, setDefaultClient as yt, splitWalletProviderKey as z };
-//# sourceMappingURL=updateAuthFromVerifyResponse-BLgNMqwN.esm.js.map
+export { updateNoncePoolStorage as $, getWalletProviders as A, normalizeWalletNameWithChain as B, initializeWaasClientsForEagerRecovery as C, BaseError as Ct, DEFAULT_WAAS_BASE_API_URL as D, isWaasWalletProvider as E, version as Et, onEvent as F, splitWalletProviderKey as G, CHAINS_INFO_MAP as H, onceEvent as I, createDeviceSignatureHeadersMiddleware as J, InvalidWalletProviderKeyError as K, createRuntimeServiceAccessKey as L, getWalletProviderRegistry as M, emitEvent as N, DEFAULT_WAAS_BASE_MPC_RELAY_API_URL as O, offEvent as P, fetchAndStoreNonces as Q, getWalletAccounts as R, emitWalletAccountsChangedEvent as S, getCore as St, findWaasWalletProviderByChain as T, name as Tt, formatWalletAccountId as U, getChainFromVerifiedCredentialChain as V, normalizeAddress as W, getDeviceSigner as X, getHeadersForNonceSignedByDeviceSigners as Y, getNonce as Z, upsertElevatedAccessToken as _, randomString as _t, retryOnFail as a, MfaInvalidOtpError as at, InvalidParamError as b, setDefaultClient as bt, createApiClient as c, APIError as ct, scrubParameters as d, SDK_API_CORE_VERSION as dt, createStorageKeySchema as et, DEFAULT_PII_FIELDS as f, getSessionKeys as ft, updateAuthFromVerifyResponse as g, getElevatedAccessToken as gt, extractSessionId as h, ValueMustBeDefinedError as ht, isSignedIn as i, MfaRateLimitedError as it, WalletProviderPriority as j, DYNAMIC_WAAS_METADATA as k, __refreshAuth_wrapped as l, CLIENT_SDK_NAME as lt, getOperatingSystem as m, assertDefined as mt, generateSessionKeys as n, UnauthorizedError as nt, getWalletProviderFromWalletAccount as o, LinkCredentialError as ot, getUserAgent as p, isCookieEnabled as pt, isUserMissingMfaAuth as q, fetchProjectSettings as r, SandboxMaximumThresholdReachedError as rt, NoWalletProviderFoundError as s, InvalidExternalAuthError as st, __logoutWithReason_wrapped as t, NONCE_POOL_SIZE as tt, instrumentFunction as u, DYNAMIC_ICONIC_SPRITE_URL as ut, parseElevatedAccessToken as v, getPlatform as vt, isWaasWalletAccount as w, TokenScope$1 as wt, checkAndRaiseWalletAccountsChangedEvent as x, ClientNotFoundError as xt, decodeJwt as y, getDefaultClient as yt, formatWalletProviderKey as z };
+//# sourceMappingURL=logoutWithReason-DV89zJmJ.esm.js.map