@dynamic-labs-sdk/client 1.30.2 → 1.31.0

package/dist/{updateAuthFromVerifyResponse-Dsw-eAro.cjs → logoutWithReason-DlA15deT.cjs}

@@ -31,14 +31,18 @@ zod_mini = __toESM(zod_mini);
 
 //#region package.json
 var name = "@dynamic-labs-sdk/client";
-var version = "1.30.2";
+var version = "1.31.0";
 
 //#endregion
-//#region src/client/core/getCore/getCore.ts
-/** @notInstrumented */
-const getCore = (client) => {
-	return client.__core;
-};
+//#region src/modules/auth/consts.ts
+const DYNAMIC_AUTH_COOKIE_NAME = "DYNAMIC_JWT_TOKEN";
+/**
+* Lists the scopes accepted by authentication and step-up APIs.
+*
+* @see authenticateTotpMfaDevice
+* @see checkStepUpAuth
+*/
+const TokenScope = _dynamic_labs_sdk_api_core.TokenScope;
 
 //#endregion
 //#region src/errors/base/BaseError.ts
@@ -103,6 +107,13 @@ var BaseError = class BaseError extends Error {
 	}
 };
 
+//#endregion
+//#region src/client/core/getCore/getCore.ts
+/** @notInstrumented */
+const getCore = (client) => {
+	return client.__core;
+};
+
 //#endregion
 //#region src/errors/ClientNotFoundError.ts
 var ClientNotFoundError = class extends BaseError {
@@ -150,11 +161,6 @@ const setDefaultClient = (client) => {
 	numOfInitializedClients++;
 };
 
-//#endregion
-//#region src/utils/getNonce/constants.ts
-const NONCE_POOL_EXPIRATION_TIME = 6e4 * 60 * 24;
-const NONCE_POOL_SIZE = 5;
-
 //#endregion
 //#region src/utils/getPlatform/getPlatform.ts
 /**
@@ -283,7 +289,7 @@ const getSessionKeys = (client) => {
 
 //#endregion
 //#region src/generated/dependencyCatalog.ts
-const dependencyCatalog = { "@dynamic-labs/sdk-api-core": "0.12.0" };
+const dependencyCatalog = { "@dynamic-labs/sdk-api-core": "0.25.0" };
 
 //#endregion
 //#region src/constants.ts
@@ -562,6 +568,11 @@ const createBaseApiClient = ({ middleware = [], options = {} }, client) => {
 	}));
 };
 
+//#endregion
+//#region src/utils/getNonce/constants.ts
+const NONCE_POOL_EXPIRATION_TIME = 6e4 * 60 * 24;
+const NONCE_POOL_SIZE = 5;
+
 //#endregion
 //#region src/services/storage/createStorageKeySchema/createStorageKeySchema.ts
 /** @notInstrumented */
@@ -659,38 +670,6 @@ const fetchAndStoreNonces = async (client) => {
 	return fetchPromise;
 };
 
-//#endregion
-//#region src/utils/getSecureCookieAttribute/getSecureCookieAttribute.ts
-/**
-* Returns the cookie `Secure` attribute suffix (`'; Secure'`) when the current
-* document is running in a secure context, or an empty string otherwise.
-*
-* The `Secure` attribute prevents the browser from ever transmitting the cookie
-* over an unencrypted `http://` connection, which mitigates cleartext token
-* capture (CWE-614). It is intentionally omitted on insecure/localhost dev,
-* because browsers reject `Secure` cookies set over `http://` and that would
-* silently break local testing.
-*
-* Used when building the Dynamic auth JWT cookie string so the attribute is
-* applied consistently on both the write (sign-in/refresh) and clear (logout)
-* paths.
-*
-* @notInstrumented
-*/
-const getSecureCookieAttribute = () => {
-	return Boolean(globalThis.window?.isSecureContext) || globalThis.location?.protocol === "https:" ? "; Secure" : "";
-};
-
-//#endregion
-//#region src/utils/setCookie/setCookie.ts
-/**
-* Sefelly sets the cookie in the browser.
-* @notInstrumented
-*/
-const setCookie = (cookie) => {
-	document.cookie = cookie;
-};
-
 //#endregion
 //#region src/utils/getNonce/getNonce.ts
 /**
@@ -794,160 +773,54 @@ const createDeviceSignatureHeadersMiddleware = (client) => {
 };
 
 //#endregion
-//#region src/modules/apiClient/createApiClient.ts
-/**
-* Returns a new instance of the SDK API client.
-*
-* This is not meant for storing, as it is very light we can create it whenever needed.
-* @notInstrumented
-*/
-const createApiClient = (options = {}, client) => {
-	return createBaseApiClient({
-		middleware: [createDeviceSignatureHeadersMiddleware(client)],
-		options
-	}, client);
-};
-
-//#endregion
-//#region src/modules/clientEvents/clientEvents.ts
+//#region src/utils/getSecureCookieAttribute/getSecureCookieAttribute.ts
 /**
-* Adds an event listener for Dynamic client events.
-*
-* This function allows you to listen for various events emitted by the Dynamic client,
-* such as authentication state changes, wallet connections, and more.
+* Returns the cookie `Secure` attribute suffix (`'; Secure'`) when the current
+* document is running in a secure context, or an empty string otherwise.
 *
-* @example
-* ```ts
-* const unsubscribe = onEvent({
-*   event: 'walletAdded',
-*   listener: ({ walletAccount }) => {
-*     console.log('Wallet added:', walletAccount.address);
-*   },
-* });
+* The `Secure` attribute prevents the browser from ever transmitting the cookie
+* over an unencrypted `http://` connection, which mitigates cleartext token
+* capture (CWE-614). It is intentionally omitted on insecure/localhost dev,
+* because browsers reject `Secure` cookies set over `http://` and that would
+* silently break local testing.
 *
-* // Later: clean up
-* unsubscribe();
-* ```
+* Used when building the Dynamic auth JWT cookie string so the attribute is
+* applied consistently on both the write (sign-in/refresh) and clear (logout)
+* paths.
 *
-* @param params.event - The event name to listen for.
-* @param params.listener - The callback function to execute when the event is fired.
-* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
-* @returns A function that can be called to remove the listener.
-* @see offEvent
-* @see onceEvent
 * @notInstrumented
-* @hook Event listeners are error-prone to wire up by hand with useEffect.
 */
-const onEvent = ({ event, listener }, client = getDefaultClient()) => {
-	const { eventEmitter } = getCore(client);
-	eventEmitter.on(event, listener);
-	return () => {
-		eventEmitter.off(event, listener);
-	};
+const getSecureCookieAttribute = () => {
+	return Boolean(globalThis.window?.isSecureContext) || globalThis.location?.protocol === "https:" ? "; Secure" : "";
 };
+
+//#endregion
+//#region src/utils/setCookie/setCookie.ts
 /**
-* Removes an event listener from Dynamic client events.
-*
-* This function unsubscribes a previously registered event listener
-* from the specified Dynamic client event.
-*
-* @example
-* ```ts
-* offEvent({ event: 'walletAdded', listener: myListener });
-* ```
-*
-* @param params.event - The event name to remove the listener from.
-* @param params.listener - The callback function to remove.
-* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
-* @see onEvent
-* @see onceEvent
+* Sefelly sets the cookie in the browser.
 * @notInstrumented
 */
-const offEvent = ({ event, listener }, client = getDefaultClient()) => {
-	const { eventEmitter } = getCore(client);
-	eventEmitter.off(event, listener);
+const setCookie = (cookie) => {
+	document.cookie = cookie;
 };
+
+//#endregion
+//#region src/modules/mfa/isUserMissingMfaAuth/isUserMissingMfaAuth.ts
 /**
-* Adds a one-time event listener for Dynamic client events.
-*
-* This function listens for an event that will automatically remove itself
-* after being triggered once.
+* Checks if the user requires additional MFA authentication.
 *
-* @example
-* ```ts
-* onceEvent({
-*   event: 'logout',
-*   listener: () => {
-*     console.log('User logged out');
-*   },
-* });
-* ```
+* This function determines if the current user session requires
+* additional multi-factor authentication to access certain features.
 *
-* @param params.event - The event name to listen for.
-* @param params.listener - The callback function to execute when the event is fired.
 * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
-* @returns A function that can be called to remove the listener before it fires.
-* @see onEvent
-* @see offEvent
-* @notInstrumented
-* @hook Event listeners are error-prone to wire up by hand with useEffect.
-*/
-const onceEvent = ({ event, listener }, client = getDefaultClient()) => {
-	const { eventEmitter } = getCore(client);
-	eventEmitter.once(event, listener);
-	return () => {
-		eventEmitter.off(event, listener);
-	};
-};
-/**
-* Emits a Dynamic client event.
-*
-* This function triggers an event that will be received by all registered
-* listeners for the specified event type.
-*
-* @param params.event - The event name to emit.
-* @param params.args - The arguments to pass to event listeners.
-* @param client - The Dynamic client instance.
+* @returns True if the user needs additional MFA authentication, false otherwise.
 * @notInstrumented
+* @hook Exposed as a hook so consumers reactively know when MFA is still required, updated when the user changes.
 */
-const emitEvent = ({ event, args }, client) => {
-	const { eventEmitter } = getCore(client);
-	eventEmitter.emit(event, args);
-};
-
-//#endregion
-//#region src/utils/retryOnFail/InvalidRetryOnFailCallError.ts
-/**
-* This error is thrown when the `retryOnFail` function is called with an invalid
-* number of retries (i.e. less than 0).
-*/
-var InvalidRetryOnFailCallError = class extends BaseError {
-	constructor(maxRetries) {
-		super({
-			cause: null,
-			code: "invalid_retry_on_fail_call_error",
-			docsUrl: null,
-			name: "InvalidRetryOnFailCallError",
-			shortMessage: `Invalid retries parameter for retryOnFail call: ${maxRetries}`
-		});
-	}
-};
-
-//#endregion
-//#region src/utils/retryOnFail/retryOnFail.ts
-/** @notInstrumented */
-const retryOnFail = async ({ delay = 0, fn, maxRetries }) => {
-	for (let retry = 0; retry <= maxRetries; retry++) try {
-		return await fn();
-	} catch (error) {
-		if (retry >= maxRetries) throw error;
-		if (delay > 0) await new Promise((resolve) => setTimeout(resolve, delay));
-	}
-	/**
-	* Reaching this point should never happen and this
-	* error is thrown to help us debug the issue.
-	*/
-	throw new InvalidRetryOnFailCallError(maxRetries);
+const isUserMissingMfaAuth = (client = getDefaultClient()) => {
+	const user = client.user;
+	assertDefined(user, "User not logged in");
+	return Boolean(user.scope?.includes("requiresAdditionalAuth"));
 };
 
 //#endregion
@@ -1293,147 +1166,131 @@ const getWalletAccounts = (client = getDefaultClient()) => {
 };
 
 //#endregion
-//#region src/modules/auth/isSignedIn/isSignedIn.ts
+//#region src/services/runtimeServices/createRuntimeServiceAccessKey/createRuntimeServiceAccessKey.ts
 /**
-* Checks if the user is currently signed in to the Dynamic client.
+* Creates a service accessor function that manages service instantiation and caching.
+* The returned function will either retrieve an existing service from the registry or
+* create a new one using the provided builder function.
 *
-* The client is considered to be in a signed in state if a user has
-* authenticated or if the client has at least one wallet connected.
+* @template - The type of service to be created/accessed
+* @param key - Unique identifier for the service in the registry
+* @param builder - Function that creates the service instance when called with a DynamicClient
+* @notInstrumented
+*/
+const createRuntimeServiceAccessKey = (key, builder) => (client) => {
+	const { runtimeServices } = getCore(client);
+	const currentService = runtimeServices.getByKey(key);
+	if (currentService) return currentService;
+	const service = builder(client);
+	runtimeServices.register(key, service);
+	return service;
+};
+
+//#endregion
+//#region src/modules/clientEvents/clientEvents.ts
+/**
+* Adds an event listener for Dynamic client events.
 *
-* @deprecated What counts as "signed in" is your app's business logic, not the
-* SDK's. This helper bakes in one opinion (a user OR any connected wallet),
-* which rarely matches every app and forces a dependency on us for every
-* variation. Compose your own check from the underlying primitives instead —
-* e.g. `Boolean(client.user) || isAnyWalletAccountConnected(client)` — and
-* layer in whatever your app requires (device registration, completed
-* onboarding, satisfied MFA, a required embedded wallet, …). See the
-* "Check if signed in" guide:
-* https://www.dynamic.xyz/docs/javascript/user-session-management
+* This function allows you to listen for various events emitted by the Dynamic client,
+* such as authentication state changes, wallet connections, and more.
 *
 * @example
 * ```ts
-* if (isSignedIn()) {
-*   console.log('User is authenticated or has a wallet connected');
-* }
+* const unsubscribe = onEvent({
+*   event: 'walletAdded',
+*   listener: ({ walletAccount }) => {
+*     console.log('Wallet added:', walletAccount.address);
+*   },
+* });
+*
+* // Later: clean up
+* unsubscribe();
 * ```
 *
+* @param params.event - The event name to listen for.
+* @param params.listener - The callback function to execute when the event is fired.
 * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
-* @returns True if the user is signed in, false otherwise.
-* @see logout
-* @see isAnyWalletAccountConnected
+* @returns A function that can be called to remove the listener.
+* @see offEvent
+* @see onceEvent
 * @notInstrumented
+* @hook Event listeners are error-prone to wire up by hand with useEffect.
 */
-const isSignedIn = (client = getDefaultClient()) => Boolean(client.user || getWalletAccounts(client).length > 0);
-
-//#endregion
-//#region src/modules/projectSettings/fetchProjectSettings/projectSettingsExpirationScheme.ts
-/**
-* The schema to track the expiration time of the project settings.
-*/
-const projectSettingsExpirationStorageKeySchema = createStorageKeySchema({
-	key: "projectSettingsExpiration",
-	schema: zod_mini.number()
-});
-
-//#endregion
-//#region src/modules/projectSettings/fetchProjectSettings/fetchProjectSettings.ts
+const onEvent = ({ event, listener }, client = getDefaultClient()) => {
+	const { eventEmitter } = getCore(client);
+	eventEmitter.on(event, listener);
+	return () => {
+		eventEmitter.off(event, listener);
+	};
+};
 /**
-* Expiration time of the project settings in milliseconds.
+* Removes an event listener from Dynamic client events.
+*
+* This function unsubscribes a previously registered event listener
+* from the specified Dynamic client event.
+*
+* @example
+* ```ts
+* offEvent({ event: 'walletAdded', listener: myListener });
+* ```
+*
+* @param params.event - The event name to remove the listener from.
+* @param params.listener - The callback function to remove.
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @see onEvent
+* @see onceEvent
+* @notInstrumented
 */
-const PROJECT_SETTINGS_EXPIRATION_TIME = 1e3 * 60 * 5;
+const offEvent = ({ event, listener }, client = getDefaultClient()) => {
+	const { eventEmitter } = getCore(client);
+	eventEmitter.off(event, listener);
+};
 /**
-* Fetches and updates the project settings from the API.
+* Adds a one-time event listener for Dynamic client events.
 *
-* This function retrieves the latest project configuration settings
-* from Dynamic's servers, including authentication options, enabled chains,
-* and security configurations. The settings are cached for performance.
+* This function listens for an event that will automatically remove itself
+* after being triggered once.
 *
 * @example
 * ```ts
-* const settings = await fetchProjectSettings();
-* console.log('Enabled chains:', settings.chains);
+* onceEvent({
+*   event: 'logout',
+*   listener: () => {
+*     console.log('User logged out');
+*   },
+* });
 * ```
 *
+* @param params.event - The event name to listen for.
+* @param params.listener - The callback function to execute when the event is fired.
 * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
-* @returns A promise that resolves to the updated project settings.
-* @see createDynamicClient
-* @see initializeClient
+* @returns A function that can be called to remove the listener before it fires.
+* @see onEvent
+* @see offEvent
 * @notInstrumented
-* @noHook Internal settings fetch that is not part of the public hook surface.
+* @hook Event listeners are error-prone to wire up by hand with useEffect.
 */
-const fetchProjectSettings = async (client = getDefaultClient()) => {
-	const core = getCore(client);
-	const currentExpiration = await core.storage.getItem(projectSettingsExpirationStorageKeySchema);
-	if (Boolean(client.projectSettings) && !(currentExpiration && currentExpiration < Date.now()) && isSignedIn(client)) return client.projectSettings;
-	const apiClient = createApiClient({}, client);
-	core.logger.debug("[fetchProjectSettings] Fetching project settings...");
-	const doFetch = async () => apiClient.getEnvironmentSettings({
-		environmentId: core.environmentId,
-		sdkVersion: `${CLIENT_SDK_NAME}/${core.version}`
-	}, { credentials: "omit" });
-	const projectSettings = await retryOnFail({
-		fn: doFetch,
-		maxRetries: 2
-	});
-	core.state.set({ projectSettings: projectSettings ?? null });
-	await core.storage.setItem(projectSettingsExpirationStorageKeySchema, Date.now() + PROJECT_SETTINGS_EXPIRATION_TIME);
-	return projectSettings;
-};
-
-//#endregion
-//#region src/modules/sessionKeys/generateSessionKeys/generateSessionKeys.ts
-/** @notInstrumented */
-const generateSessionKeys = async (client) => {
-	const core = getCore(client);
-	const currentState = core.state.get();
-	const isRotation = Boolean(currentState.sessionKeys);
-	const logContext = {
-		environmentId: core.environmentId,
-		operation: isRotation ? "rotate" : "create",
-		userId: currentState.user?.id ?? null
+const onceEvent = ({ event, listener }, client = getDefaultClient()) => {
+	const { eventEmitter } = getCore(client);
+	eventEmitter.once(event, listener);
+	return () => {
+		eventEmitter.off(event, listener);
 	};
-	core.logger.info(isRotation ? "[generateSessionKeys] Rotating session key..." : "[generateSessionKeys] Creating session key...", logContext);
-	await core.keychain.removeKey("session");
-	const publicKey = await core.keychain.generateKey("session");
-	assertDefined(publicKey, "Public key not found");
-	core.state.set({ sessionKeys: publicKey });
-	core.logger.info(isRotation ? "[generateSessionKeys] Session key rotated" : "[generateSessionKeys] Session key created", logContext);
-	return { publicKey };
-};
-
-//#endregion
-//#region src/errors/NoWalletProviderFoundError.ts
-var NoWalletProviderFoundError = class extends BaseError {
-	constructor({ walletProviderKey }) {
-		super({
-			cause: null,
-			code: "no_wallet_provider_found_error",
-			docsUrl: null,
-			name: "NoWalletProviderFoundError",
-			shortMessage: `No wallet provider found with key: ${walletProviderKey}`
-		});
-	}
 };
-
-//#endregion
-//#region src/services/runtimeServices/createRuntimeServiceAccessKey/createRuntimeServiceAccessKey.ts
 /**
-* Creates a service accessor function that manages service instantiation and caching.
-* The returned function will either retrieve an existing service from the registry or
-* create a new one using the provided builder function.
+* Emits a Dynamic client event.
 *
-* @template - The type of service to be created/accessed
-* @param key - Unique identifier for the service in the registry
-* @param builder - Function that creates the service instance when called with a DynamicClient
+* This function triggers an event that will be received by all registered
+* listeners for the specified event type.
+*
+* @param params.event - The event name to emit.
+* @param params.args - The arguments to pass to event listeners.
+* @param client - The Dynamic client instance.
 * @notInstrumented
 */
-const createRuntimeServiceAccessKey = (key, builder) => (client) => {
-	const { runtimeServices } = getCore(client);
-	const currentService = runtimeServices.getByKey(key);
-	if (currentService) return currentService;
-	const service = builder(client);
-	runtimeServices.register(key, service);
-	return service;
+const emitEvent = ({ event, args }, client) => {
+	const { eventEmitter } = getCore(client);
+	eventEmitter.emit(event, args);
 };
 
 //#endregion
@@ -1542,62 +1399,93 @@ const WalletProviderPriority = {
 };
 
 //#endregion
-//#region src/modules/wallets/utils/getWalletProviderFromWalletAccount/getWalletProviderFromWalletAccount.ts
+//#region src/modules/wallets/getWalletProviders/getWalletProviders.ts
+/**
+* Get all available wallet providers to interact with internally.
+* @notInstrumented
+*/
+const getWalletProviders = (client) => {
+	return getWalletProviderRegistry(client).listProviders();
+};
+
+//#endregion
+//#region src/modules/waas/constants.ts
+const DEFAULT_WAAS_BASE_API_URL = "https://app.dynamicauth.com";
+const DEFAULT_WAAS_BASE_MPC_RELAY_API_URL = "https://relay.dynamicauth.com";
+const DYNAMIC_WAAS_METADATA = {
+	displayName: "Dynamic WaaS",
+	icon: `${DYNAMIC_ICONIC_SPRITE_URL}#dynamicwaas`,
+	normalizedWalletName: "dynamicwaas"
+};
+
+//#endregion
+//#region src/modules/waas/isWaasWalletProvider/isWaasWalletProvider.ts
 /** @notInstrumented */
-const getWalletProviderFromWalletAccount = ({ walletAccount }, client) => {
-	const walletProvider = getWalletProviderRegistry(client).getByKey(walletAccount.walletProviderKey);
-	if (!walletProvider) throw new NoWalletProviderFoundError({ walletProviderKey: walletAccount.walletProviderKey });
-	return walletProvider;
+const isWaasWalletProvider = (walletProvider) => {
+	return walletProvider.key.includes(DYNAMIC_WAAS_METADATA.normalizedWalletName);
 };
 
 //#endregion
-//#region src/modules/wallets/utils/getAvailableWalletProvidersFromWalletAccounts/getAvailableWalletProvidersFromWalletAccounts.ts
+//#region src/modules/waas/findWaasWalletProviderByChain/findWaasWalletProviderByChain.ts
 /** @notInstrumented */
-const getAvailableWalletProvidersFromWalletAccounts = (client) => {
-	const core = getCore(client);
-	const walletProvidersMap = /* @__PURE__ */ new Map();
-	getWalletAccounts(client).forEach((walletAccount) => {
-		if (walletProvidersMap.has(walletAccount.walletProviderKey)) return;
-		try {
-			const walletProvider = getWalletProviderFromWalletAccount({ walletAccount }, client);
-			walletProvidersMap.set(walletAccount.walletProviderKey, walletProvider);
-		} catch (error) {
-			core.logger.debug("Wallet provider not found for wallet account", {
-				error,
-				walletAccount: walletAccount.address
-			});
-		}
+const findWaasWalletProviderByChain = ({ chain }, client) => {
+	const providers = getWalletProviders(client);
+	const waasProviderKey = formatWalletProviderKey({
+		chain,
+		displayName: DYNAMIC_WAAS_METADATA.displayName,
+		walletProviderType: _dynamic_labs_sdk_api_core.WalletProviderEnum.EmbeddedWallet
 	});
-	return Array.from(walletProvidersMap.values());
+	const waasProvider = providers.find((provider) => provider.key === waasProviderKey && provider.chain === chain);
+	if (!waasProvider || !isWaasWalletProvider(waasProvider)) return null;
+	return waasProvider;
 };
 
 //#endregion
-//#region src/modules/wallets/destroyWalletProviders/destroyWalletProviders.ts
+//#region src/modules/waas/isWaasWalletAccount/isWaasWalletAccount.ts
 /**
-* Tear down every wallet provider on the client.
-*
-* Each provider's `destroy` is responsible for its own local + remote
-* cleanup. We swallow errors so a failing destroy on one provider does not
-* block teardown of the others (e.g. during logout).
+* This function determines whether the provided wallet account is a Dynamic
+* WaaS wallet account.
 *
+* @param params.walletAccount - The wallet account to check.
+* @returns True if the wallet account is a WaaS wallet account, false otherwise.
 * @notInstrumented
 */
-const destroyWalletProviders = async ({ reason }, client) => {
-	const core = getCore(client);
-	const walletProviders = getAvailableWalletProvidersFromWalletAccounts(client);
-	await Promise.all(walletProviders.map(async (walletProvider) => {
-		if (!walletProvider.destroy) return;
-		try {
-			await walletProvider.destroy({ reason });
-		} catch (err) {
-			core.logger.error(`Error destroying wallet provider ${walletProvider.key}`, err);
-		}
-	}));
+const isWaasWalletAccount = ({ walletAccount }) => {
+	return walletAccount.walletProviderKey.includes(DYNAMIC_WAAS_METADATA.normalizedWalletName);
 };
 
 //#endregion
-//#region src/modules/auth/consts.ts
-const DYNAMIC_AUTH_COOKIE_NAME = "DYNAMIC_JWT_TOKEN";
+//#region src/modules/waas/initializeWaasClientsForEagerRecovery/initializeWaasClientsForEagerRecovery.ts
+/**
+* On login, boots the WaaS client once per chain so the SDK eagerly recovers
+* key shares itself (the `eagerlyRecoverKeyShares` capability) instead of the
+* host looping per wallet. Booting calls `initialize()`, which sends the auth
+* token the iframe needs to self-recover.
+*
+* @notInstrumented
+*/
+const initializeWaasClientsForEagerRecovery = async (client) => {
+	/**
+	* Booting triggers recovery, which fails if the user is missing the MFA auth.
+	* This early return avoids attempting a call we know will fail and just adds
+	* noise to the logs.
+	*/
+	if (isUserMissingMfaAuth(client)) return;
+	const waasChains = new Set(getWalletAccounts(client).filter((walletAccount) => isWaasWalletAccount({ walletAccount })).map((walletAccount) => walletAccount.chain));
+	await Promise.all([...waasChains].map(async (chain) => {
+		const provider = findWaasWalletProviderByChain({ chain }, client);
+		/**
+		* The environment might not have the embedded wallet extensions installed.
+		* In that case there is no provider for the chain and nothing to boot.
+		*/
+		if (!provider) return;
+		try {
+			await provider.getWaasClient();
+		} catch (error) {
+			getCore(client).logger.warn("[initializeWaasClientsForEagerRecovery] failed to boot waas client", error);
+		}
+	}));
+};
 
 //#endregion
 //#region src/modules/wallets/emitWalletAccountsChangedEvent/emitWalletAccountsChangedEvent.ts
@@ -1621,6 +1509,160 @@ const checkAndRaiseWalletAccountsChangedEvent = ({ previousState }, client) => {
 };
 const getWalletAccountsHash = (state, client) => getWalletAccountsFromState(state, client).map((walletAccount) => JSON.stringify(walletAccount)).sort().join("-");
 
+//#endregion
+//#region src/errors/InvalidParamError.ts
+var InvalidParamError = class extends BaseError {
+	constructor(message) {
+		super({
+			cause: null,
+			code: "invalid_param_error",
+			docsUrl: null,
+			name: "InvalidParamError",
+			shortMessage: message
+		});
+	}
+};
+
+//#endregion
+//#region src/modules/auth/decodeJwt/decodeJwt.ts
+/**
+* Decodes a JWT token and returns the full payload.
+*
+* This function extracts and returns the complete JWT payload including scopes,
+* expiration time, and other claims.
+*
+* @param jwt - The JWT token string.
+* @returns The decoded JWT payload object.
+* @throws InvalidParamError if the token is invalid or cannot be decoded.
+*
+* @example
+* ```typescript
+* const payload = decodeJwt(jwt);
+* // Returns: { scopes: ['wallet:export'], exp: 1234567890, ... }
+* ```
+* @notInstrumented
+*/
+const decodeJwt = (jwt) => {
+	try {
+		const parts = jwt.split(".");
+		if (parts.length !== 3) throw new InvalidParamError("Invalid JWT format");
+		const base64Payload = parts[1].replaceAll("-", "+").replaceAll("_", "/");
+		const paddedPayload = base64Payload + "=".repeat((4 - base64Payload.length % 4) % 4);
+		const decodedPayload = atob(paddedPayload);
+		return JSON.parse(decodedPayload);
+	} catch (error) {
+		if (error instanceof InvalidParamError) throw error;
+		throw new InvalidParamError(`Failed to decode JWT: ${error instanceof Error ? error.message : String(error)}`);
+	}
+};
+
+//#endregion
+//#region src/modules/auth/updateAuthFromVerifyResponse/elevatedAccessTokens/normalizeScopes/normalizeScopes.ts
+/**
+* Normalizes scopes by deduplicating and sorting them.
+* This creates a canonical representation for comparison.
+*
+* @param scopes - Array of scope strings (may contain duplicates)
+* @returns Normalized, sorted array of unique scopes
+* @notInstrumented
+*/
+const normalizeScopes = (scopes) => {
+	return [...new Set(scopes)].sort((a, b) => a.localeCompare(b));
+};
+
+//#endregion
+//#region src/modules/auth/updateAuthFromVerifyResponse/elevatedAccessTokens/parseElevatedAccessToken/parseElevatedAccessToken.ts
+/**
+* Validates and parses an elevated access token from a JWT string.
+* Extracts scopes, expiration, and validates the token structure.
+*
+* Policy decisions:
+* - Tokens without scopes are rejected (returns null)
+* - Tokens with empty scopes array are rejected (returns null)
+* - Tokens without exp field are rejected (returns null)
+* - Expired tokens are rejected (returns null)
+*
+* @returns Parsed token data or null if token is invalid/expired
+* @notInstrumented
+*/
+const parseElevatedAccessToken = ({ token }) => {
+	const payload = decodeJwt(token);
+	const filteredScopes = ((payload?.scope)?.split(" ") ?? []).filter((s) => s.length > 0);
+	const singleUse = payload.singleUse ?? false;
+	if (!filteredScopes || filteredScopes.length === 0) return null;
+	if (!payload.exp) return null;
+	const expiresAt = /* @__PURE__ */ new Date(payload.exp * 1e3);
+	if (expiresAt <= /* @__PURE__ */ new Date()) return null;
+	return {
+		expiresAt,
+		normalizedScopes: normalizeScopes(filteredScopes),
+		scopes: filteredScopes,
+		singleUse,
+		token
+	};
+};
+
+//#endregion
+//#region src/modules/auth/updateAuthFromVerifyResponse/elevatedAccessTokens/upsertElevatedAccessToken/upsertElevatedAccessToken.ts
+/**
+* Upserts an elevated access token into the current tokens array.
+*
+* Policy: Only one token per normalized scope-set is allowed.
+* If a token with the same normalized scopes exists, it is replaced.
+* This ensures we don't accumulate multiple tokens for the same scope combination.
+*
+* @param currentTokens - Current array of elevated access tokens
+* @param newToken - New token to upsert
+* @returns Updated array of tokens with the new token upserted
+* @notInstrumented
+*/
+const upsertElevatedAccessToken = ({ currentTokens, newToken }) => {
+	const newScopeKey = normalizeScopes(newToken.scopes).join(" ");
+	return [...currentTokens.filter((existingToken) => {
+		return normalizeScopes(existingToken.scopes).join(" ") !== newScopeKey;
+	}), {
+		expiresAt: newToken.expiresAt,
+		scopes: newToken.scopes,
+		singleUse: newToken.singleUse,
+		token: newToken.token
+	}];
+};
+
+//#endregion
+//#region src/modules/auth/updateAuthFromVerifyResponse/updateAuthFromVerifyResponse.ts
+/** @notInstrumented */
+const updateAuthFromVerifyResponse = ({ response }, client) => {
+	const core = getCore(client);
+	const previousState = { ...core.state.get() };
+	const { user, minifiedJwt, jwt, expiresAt, mfaToken, elevatedAccessToken } = response;
+	const sessionExpiresAt = /* @__PURE__ */ new Date(expiresAt * 1e3);
+	const newState = {
+		legacyToken: jwt ?? null,
+		sessionExpiresAt,
+		token: minifiedJwt ?? null,
+		user
+	};
+	if (mfaToken) newState.mfaToken = mfaToken;
+	const currentTokens = core.state.get().elevatedAccessTokens || [];
+	newState.elevatedAccessTokens = currentTokens;
+	if (elevatedAccessToken) {
+		const parsedToken = parseElevatedAccessToken({ token: elevatedAccessToken });
+		if (parsedToken) newState.elevatedAccessTokens = upsertElevatedAccessToken({
+			currentTokens,
+			newToken: parsedToken
+		});
+	}
+	core.state.set(newState);
+	/**
+	* For customers using a sandbox environment with cookies enabled, we need to set the cookie
+	* programmatically because Redcoast won't set the cookie via headers. We set the cookie programmatically
+	* so customers can access the cookie from document.cookie consistently between sandbox and live environments.
+	*/
+	if (minifiedJwt && isCookieEnabled(client)) setCookie(`${DYNAMIC_AUTH_COOKIE_NAME}=${minifiedJwt}; expires=${sessionExpiresAt.toUTCString()}; path=/; SameSite=Lax${getSecureCookieAttribute()}`);
+	checkAndRaiseWalletAccountsChangedEvent({ previousState }, client);
+	if (!previousState.user && Boolean(newState.user)) initializeWaasClientsForEagerRecovery(client);
+};
+
 //#endregion
 //#region src/modules/auth/extractSessionId/extractSessionId.ts
 /**
@@ -2030,67 +2072,41 @@ const instrumentFunction = ({ fn, functionName, getCore: getCore$1, selectors })
 };
 
 //#endregion
-//#region src/modules/auth/logoutWithReason/logoutWithReason.ts
+//#region src/modules/user/refreshAuth/refreshAuth.ts
 /**
-* Logs the user out with an explicit reason.
+* Refreshes the current session's authentication from the server.
 *
-* Revokes the session, clears auth state, terminates wallet providers, and
-* emits the `logout` client event with the given reason. The reason is also
-* captured as an argument on the function-instrumentation event, which is
-* how Datadog distinguishes between different logout causes.
+* This rotates the auth token via a full verify call and updates both the
+* token and the user state from the response, returning the raw
+* `VerifyResponse` (which includes the new token). Reach for this when you
+* need a fresh JWT — e.g. before a call that requires a non-expired token.
 *
-* Use this instead of the public `logout` when triggering a logout from
-* internal or extension code — the caller owns the reason string, so the
-* telemetry correctly attributes *why* the logout happened.
+* Prefer `refreshUser` when you only need the latest user profile and do not
+* care about rotating the token: it hits the authenticated-user endpoint,
+* touches only the user state, and returns the `User` directly.
 *
-* @param params - The logout params.
-* @param params.reason - Why the logout is being triggered. Extension authors
-*   needing a reason outside the SDK catalog can cast with `as LogoutReason`.
-* @param client - The Dynamic client instance.
+* @example
+* ```ts
+* const response = await refreshAuth();
+* console.log('Token refreshed:', response.token);
+* ```
+*
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns A promise that resolves to the verify response.
+* @see logout
+* @see refreshUser
 * @instrumented
 */
-const logoutWithReason = async ({ reason }, client) => {
+const refreshAuth = async (client = getDefaultClient()) => {
 	const core = getCore(client);
-	core.logger.debug("[logoutWithReason] Logging out...", { reason });
-	await destroyWalletProviders({ reason }, client);
-	if (client.user !== null) {
-		const apiClient = createApiClient({ headers: { [DYNAMIC_LOGOUT_REASON_HEADER]: reason } }, client);
-		try {
-			await apiClient.revokeSession({ environmentId: core.environmentId });
-		} catch (error) {
-			core.logger.error("Failed to revoke session", error);
-		}
-		/**
-		* This deletes the auth cookie if it exists.
-		* If the cookie doesn't exist, this sets a new cookie that expires immediately.
-		*/
-		if (isCookieEnabled(client)) setCookie(`${DYNAMIC_AUTH_COOKIE_NAME}=; Max-Age=-99999999; path=/; SameSite=Lax${getSecureCookieAttribute()}`);
-	}
-	await core.keychain.removeKey("session");
-	const previousState = core.state.get();
-	core.state.set({
-		captchaToken: null,
-		elevatedAccessTokens: [],
-		legacyToken: null,
-		mfaToken: null,
-		sessionExpiresAt: null,
-		sessionKeys: null,
-		token: null,
-		unverifiedWalletAccounts: [],
-		user: null
-	});
-	emitEvent({
-		args: { reason },
-		event: "logout"
-	}, client);
-	checkAndRaiseWalletAccountsChangedEvent({ previousState }, client);
-	fetchProjectSettings(client);
-	generateSessionKeys(client);
-};
-const __logoutWithReason_impl = logoutWithReason;
-const __logoutWithReason_wrapped = instrumentFunction({
-	fn: __logoutWithReason_impl,
-	functionName: "logoutWithReason",
+	const response = await createBaseApiClient({ middleware: [createDeviceSignatureHeadersMiddleware(client)] }, client).refreshAuth({ environmentId: core.environmentId });
+	updateAuthFromVerifyResponse({ response }, client);
+	return response;
+};
+const __refreshAuth_impl = refreshAuth;
+const __refreshAuth_wrapped = instrumentFunction({
+	fn: __refreshAuth_impl,
+	functionName: "refreshAuth",
 	getCore: () => {
 		try {
 			return getCore(getDefaultClient());
@@ -2101,266 +2117,342 @@ const __logoutWithReason_wrapped = instrumentFunction({
 });
 
 //#endregion
-//#region src/modules/mfa/isUserMissingMfaAuth/isUserMissingMfaAuth.ts
+//#region src/modules/apiClient/utils/rbacStaleMiddleware/createRbacStaleMiddleware.ts
+const RBAC_STALE_CODE = "rbac_stale";
+const RBAC_STALE_RETRY_HEADER = "x-dyn-rbac-retry";
 /**
-* Checks if the user requires additional MFA authentication.
-*
-* This function determines if the current user session requires
-* additional multi-factor authentication to access certain features.
-*
-* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
-* @returns True if the user needs additional MFA authentication, false otherwise.
+* Detects 403 { code: 'rbac_stale' } responses, refreshes the auth token, and
+* retries the request once with the new token. This lets business account role
+* changes take effect without revoking the user's session.
 * @notInstrumented
-* @hook Exposed as a hook so consumers reactively know when MFA is still required, updated when the user changes.
 */
-const isUserMissingMfaAuth = (client = getDefaultClient()) => {
-	const user = client.user;
-	assertDefined(user, "User not logged in");
-	return Boolean(user.scope?.includes("requiresAdditionalAuth"));
-};
+const createRbacStaleMiddleware = (client) => ({ post: async (context) => {
+	if (context.response.status !== 403) return context.response;
+	if (context.init.headers && typeof context.init.headers === "object" && RBAC_STALE_RETRY_HEADER in context.init.headers) return context.response;
+	let errorBody;
+	try {
+		errorBody = await context.response.clone().json();
+	} catch {
+		return context.response;
+	}
+	if (!(typeof errorBody === "object" && errorBody !== null && "code" in errorBody && errorBody.code === RBAC_STALE_CODE)) return context.response;
+	try {
+		await __refreshAuth_wrapped(client);
+	} catch {
+		return context.response;
+	}
+	if (!client.token) return context.response;
+	const headers = { ...context.init.headers };
+	delete headers[RBAC_STALE_RETRY_HEADER];
+	delete headers[MFA_TOKEN_HEADER];
+	delete headers[ELEVATED_ACCESS_TOKEN_HEADER];
+	headers.Authorization = `Bearer ${client.token}`;
+	return context.fetch(context.url, {
+		...context.init,
+		headers: {
+			...headers,
+			[RBAC_STALE_RETRY_HEADER]: "1"
+		}
+	});
+} });
 
 //#endregion
-//#region src/modules/wallets/getWalletProviders/getWalletProviders.ts
+//#region src/modules/apiClient/createApiClient.ts
 /**
-* Get all available wallet providers to interact with internally.
+* Returns a new instance of the SDK API client.
+*
+* This is not meant for storing, as it is very light we can create it whenever needed.
 * @notInstrumented
 */
-const getWalletProviders = (client) => {
-	return getWalletProviderRegistry(client).listProviders();
-};
-
-//#endregion
-//#region src/modules/waas/constants.ts
-const DEFAULT_WAAS_BASE_API_URL = "https://app.dynamicauth.com";
-const DEFAULT_WAAS_BASE_MPC_RELAY_API_URL = "https://relay.dynamicauth.com";
-const DYNAMIC_WAAS_METADATA = {
-	displayName: "Dynamic WaaS",
-	icon: `${DYNAMIC_ICONIC_SPRITE_URL}#dynamicwaas`,
-	normalizedWalletName: "dynamicwaas"
+const createApiClient = (options = {}, client) => {
+	return createBaseApiClient({
+		middleware: [createDeviceSignatureHeadersMiddleware(client), createRbacStaleMiddleware(client)],
+		options
+	}, client);
 };
 
 //#endregion
-//#region src/modules/waas/isWaasWalletProvider/isWaasWalletProvider.ts
-/** @notInstrumented */
-const isWaasWalletProvider = (walletProvider) => {
-	return walletProvider.key.includes(DYNAMIC_WAAS_METADATA.normalizedWalletName);
+//#region src/errors/NoWalletProviderFoundError.ts
+var NoWalletProviderFoundError = class extends BaseError {
+	constructor({ walletProviderKey }) {
+		super({
+			cause: null,
+			code: "no_wallet_provider_found_error",
+			docsUrl: null,
+			name: "NoWalletProviderFoundError",
+			shortMessage: `No wallet provider found with key: ${walletProviderKey}`
+		});
+	}
 };
 
 //#endregion
-//#region src/modules/waas/findWaasWalletProviderByChain/findWaasWalletProviderByChain.ts
+//#region src/modules/wallets/utils/getWalletProviderFromWalletAccount/getWalletProviderFromWalletAccount.ts
 /** @notInstrumented */
-const findWaasWalletProviderByChain = ({ chain }, client) => {
-	const providers = getWalletProviders(client);
-	const waasProviderKey = formatWalletProviderKey({
-		chain,
-		displayName: DYNAMIC_WAAS_METADATA.displayName,
-		walletProviderType: _dynamic_labs_sdk_api_core.WalletProviderEnum.EmbeddedWallet
-	});
-	const waasProvider = providers.find((provider) => provider.key === waasProviderKey && provider.chain === chain);
-	if (!waasProvider || !isWaasWalletProvider(waasProvider)) return null;
-	return waasProvider;
-};
-
-//#endregion
-//#region src/modules/waas/isWaasWalletAccount/isWaasWalletAccount.ts
-/**
-* This function determines whether the provided wallet account is a Dynamic
-* WaaS wallet account.
-*
-* @param params.walletAccount - The wallet account to check.
-* @returns True if the wallet account is a WaaS wallet account, false otherwise.
-* @notInstrumented
-*/
-const isWaasWalletAccount = ({ walletAccount }) => {
-	return walletAccount.walletProviderKey.includes(DYNAMIC_WAAS_METADATA.normalizedWalletName);
+const getWalletProviderFromWalletAccount = ({ walletAccount }, client) => {
+	const walletProvider = getWalletProviderRegistry(client).getByKey(walletAccount.walletProviderKey);
+	if (!walletProvider) throw new NoWalletProviderFoundError({ walletProviderKey: walletAccount.walletProviderKey });
+	return walletProvider;
 };
 
 //#endregion
-//#region src/modules/waas/initializeWaasClientsForEagerRecovery/initializeWaasClientsForEagerRecovery.ts
+//#region src/utils/retryOnFail/InvalidRetryOnFailCallError.ts
 /**
-* On login, boots the WaaS client once per chain so the SDK eagerly recovers
-* key shares itself (the `eagerlyRecoverKeyShares` capability) instead of the
-* host looping per wallet. Booting calls `initialize()`, which sends the auth
-* token the iframe needs to self-recover.
-*
-* @notInstrumented
+* This error is thrown when the `retryOnFail` function is called with an invalid
+* number of retries (i.e. less than 0).
 */
-const initializeWaasClientsForEagerRecovery = async (client) => {
-	/**
-	* Booting triggers recovery, which fails if the user is missing the MFA auth.
-	* This early return avoids attempting a call we know will fail and just adds
-	* noise to the logs.
-	*/
-	if (isUserMissingMfaAuth(client)) return;
-	const waasChains = new Set(getWalletAccounts(client).filter((walletAccount) => isWaasWalletAccount({ walletAccount })).map((walletAccount) => walletAccount.chain));
-	await Promise.all([...waasChains].map(async (chain) => {
-		const provider = findWaasWalletProviderByChain({ chain }, client);
-		/**
-		* The environment might not have the embedded wallet extensions installed.
-		* In that case there is no provider for the chain and nothing to boot.
-		*/
-		if (!provider) return;
-		try {
-			await provider.getWaasClient();
-		} catch (error) {
-			getCore(client).logger.warn("[initializeWaasClientsForEagerRecovery] failed to boot waas client", error);
-		}
-	}));
-};
-
-//#endregion
-//#region src/errors/InvalidParamError.ts
-var InvalidParamError = class extends BaseError {
-	constructor(message) {
+var InvalidRetryOnFailCallError = class extends BaseError {
+	constructor(maxRetries) {
 		super({
 			cause: null,
-			code: "invalid_param_error",
+			code: "invalid_retry_on_fail_call_error",
 			docsUrl: null,
-			name: "InvalidParamError",
-			shortMessage: message
+			name: "InvalidRetryOnFailCallError",
+			shortMessage: `Invalid retries parameter for retryOnFail call: ${maxRetries}`
 		});
 	}
 };
 
 //#endregion
-//#region src/modules/auth/decodeJwt/decodeJwt.ts
+//#region src/utils/retryOnFail/retryOnFail.ts
+/** @notInstrumented */
+const retryOnFail = async ({ delay = 0, fn, maxRetries }) => {
+	for (let retry = 0; retry <= maxRetries; retry++) try {
+		return await fn();
+	} catch (error) {
+		if (retry >= maxRetries) throw error;
+		if (delay > 0) await new Promise((resolve) => setTimeout(resolve, delay));
+	}
+	/**
+	* Reaching this point should never happen and this
+	* error is thrown to help us debug the issue.
+	*/
+	throw new InvalidRetryOnFailCallError(maxRetries);
+};
+
+//#endregion
+//#region src/modules/auth/isSignedIn/isSignedIn.ts
 /**
-* Decodes a JWT token and returns the full payload.
+* Checks if the user is currently signed in to the Dynamic client.
 *
-* This function extracts and returns the complete JWT payload including scopes,
-* expiration time, and other claims.
+* The client is considered to be in a signed in state if a user has
+* authenticated or if the client has at least one wallet connected.
 *
-* @param jwt - The JWT token string.
-* @returns The decoded JWT payload object.
-* @throws InvalidParamError if the token is invalid or cannot be decoded.
+* @deprecated What counts as "signed in" is your app's business logic, not the
+* SDK's. This helper bakes in one opinion (a user OR any connected wallet),
+* which rarely matches every app and forces a dependency on us for every
+* variation. Compose your own check from the underlying primitives instead —
+* e.g. `Boolean(client.user) || isAnyWalletAccountConnected(client)` — and
+* layer in whatever your app requires (device registration, completed
+* onboarding, satisfied MFA, a required embedded wallet, …). See the
+* "Check if signed in" guide:
+* https://www.dynamic.xyz/docs/javascript/user-session-management
 *
 * @example
-* ```typescript
-* const payload = decodeJwt(jwt);
-* // Returns: { scopes: ['wallet:export'], exp: 1234567890, ... }
+* ```ts
+* if (isSignedIn()) {
+*   console.log('User is authenticated or has a wallet connected');
+* }
 * ```
-* @notInstrumented
-*/
-const decodeJwt = (jwt) => {
-	try {
-		const parts = jwt.split(".");
-		if (parts.length !== 3) throw new InvalidParamError("Invalid JWT format");
-		const base64Payload = parts[1].replaceAll("-", "+").replaceAll("_", "/");
-		const paddedPayload = base64Payload + "=".repeat((4 - base64Payload.length % 4) % 4);
-		const decodedPayload = atob(paddedPayload);
-		return JSON.parse(decodedPayload);
-	} catch (error) {
-		if (error instanceof InvalidParamError) throw error;
-		throw new InvalidParamError(`Failed to decode JWT: ${error instanceof Error ? error.message : String(error)}`);
-	}
-};
+*
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns True if the user is signed in, false otherwise.
+* @see logout
+* @see isAnyWalletAccountConnected
+* @notInstrumented
+*/
+const isSignedIn = (client = getDefaultClient()) => Boolean(client.user || getWalletAccounts(client).length > 0);
 
 //#endregion
-//#region src/modules/auth/updateAuthFromVerifyResponse/elevatedAccessTokens/normalizeScopes/normalizeScopes.ts
+//#region src/modules/projectSettings/fetchProjectSettings/projectSettingsExpirationScheme.ts
 /**
-* Normalizes scopes by deduplicating and sorting them.
-* This creates a canonical representation for comparison.
-*
-* @param scopes - Array of scope strings (may contain duplicates)
-* @returns Normalized, sorted array of unique scopes
-* @notInstrumented
+* The schema to track the expiration time of the project settings.
 */
-const normalizeScopes = (scopes) => {
-	return [...new Set(scopes)].sort((a, b) => a.localeCompare(b));
-};
+const projectSettingsExpirationStorageKeySchema = createStorageKeySchema({
+	key: "projectSettingsExpiration",
+	schema: zod_mini.number()
+});
 
 //#endregion
-//#region src/modules/auth/updateAuthFromVerifyResponse/elevatedAccessTokens/parseElevatedAccessToken/parseElevatedAccessToken.ts
+//#region src/modules/projectSettings/fetchProjectSettings/fetchProjectSettings.ts
 /**
-* Validates and parses an elevated access token from a JWT string.
-* Extracts scopes, expiration, and validates the token structure.
+* Expiration time of the project settings in milliseconds.
+*/
+const PROJECT_SETTINGS_EXPIRATION_TIME = 1e3 * 60 * 5;
+/**
+* Fetches and updates the project settings from the API.
 *
-* Policy decisions:
-* - Tokens without scopes are rejected (returns null)
-* - Tokens with empty scopes array are rejected (returns null)
-* - Tokens without exp field are rejected (returns null)
-* - Expired tokens are rejected (returns null)
+* This function retrieves the latest project configuration settings
+* from Dynamic's servers, including authentication options, enabled chains,
+* and security configurations. The settings are cached for performance.
 *
-* @returns Parsed token data or null if token is invalid/expired
+* @example
+* ```ts
+* const settings = await fetchProjectSettings();
+* console.log('Enabled chains:', settings.chains);
+* ```
+*
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns A promise that resolves to the updated project settings.
+* @see createDynamicClient
+* @see initializeClient
 * @notInstrumented
+* @noHook Internal settings fetch that is not part of the public hook surface.
 */
-const parseElevatedAccessToken = ({ token }) => {
-	const payload = decodeJwt(token);
-	const filteredScopes = ((payload?.scope)?.split(" ") ?? []).filter((s) => s.length > 0);
-	const singleUse = payload.singleUse ?? false;
-	if (!filteredScopes || filteredScopes.length === 0) return null;
-	if (!payload.exp) return null;
-	const expiresAt = /* @__PURE__ */ new Date(payload.exp * 1e3);
-	if (expiresAt <= /* @__PURE__ */ new Date()) return null;
-	return {
-		expiresAt,
-		normalizedScopes: normalizeScopes(filteredScopes),
-		scopes: filteredScopes,
-		singleUse,
-		token
+const fetchProjectSettings = async (client = getDefaultClient()) => {
+	const core = getCore(client);
+	const currentExpiration = await core.storage.getItem(projectSettingsExpirationStorageKeySchema);
+	if (Boolean(client.projectSettings) && !(currentExpiration && currentExpiration < Date.now()) && isSignedIn(client)) return client.projectSettings;
+	const apiClient = createApiClient({}, client);
+	core.logger.debug("[fetchProjectSettings] Fetching project settings...");
+	const doFetch = async () => apiClient.getEnvironmentSettings({
+		environmentId: core.environmentId,
+		sdkVersion: `${CLIENT_SDK_NAME}/${core.version}`
+	}, { credentials: "omit" });
+	const projectSettings = await retryOnFail({
+		fn: doFetch,
+		maxRetries: 2
+	});
+	core.state.set({ projectSettings: projectSettings ?? null });
+	await core.storage.setItem(projectSettingsExpirationStorageKeySchema, Date.now() + PROJECT_SETTINGS_EXPIRATION_TIME);
+	return projectSettings;
+};
+
+//#endregion
+//#region src/modules/sessionKeys/generateSessionKeys/generateSessionKeys.ts
+/** @notInstrumented */
+const generateSessionKeys = async (client) => {
+	const core = getCore(client);
+	const currentState = core.state.get();
+	const isRotation = Boolean(currentState.sessionKeys);
+	const logContext = {
+		environmentId: core.environmentId,
+		operation: isRotation ? "rotate" : "create",
+		userId: currentState.user?.id ?? null
 	};
+	core.logger.info(isRotation ? "[generateSessionKeys] Rotating session key..." : "[generateSessionKeys] Creating session key...", logContext);
+	await core.keychain.removeKey("session");
+	const publicKey = await core.keychain.generateKey("session");
+	assertDefined(publicKey, "Public key not found");
+	core.state.set({ sessionKeys: publicKey });
+	core.logger.info(isRotation ? "[generateSessionKeys] Session key rotated" : "[generateSessionKeys] Session key created", logContext);
+	return { publicKey };
 };
 
 //#endregion
-//#region src/modules/auth/updateAuthFromVerifyResponse/elevatedAccessTokens/upsertElevatedAccessToken/upsertElevatedAccessToken.ts
+//#region src/modules/wallets/utils/getAvailableWalletProvidersFromWalletAccounts/getAvailableWalletProvidersFromWalletAccounts.ts
+/** @notInstrumented */
+const getAvailableWalletProvidersFromWalletAccounts = (client) => {
+	const core = getCore(client);
+	const walletProvidersMap = /* @__PURE__ */ new Map();
+	getWalletAccounts(client).forEach((walletAccount) => {
+		if (walletProvidersMap.has(walletAccount.walletProviderKey)) return;
+		try {
+			const walletProvider = getWalletProviderFromWalletAccount({ walletAccount }, client);
+			walletProvidersMap.set(walletAccount.walletProviderKey, walletProvider);
+		} catch (error) {
+			core.logger.debug("Wallet provider not found for wallet account", {
+				error,
+				walletAccount: walletAccount.address
+			});
+		}
+	});
+	return Array.from(walletProvidersMap.values());
+};
+
+//#endregion
+//#region src/modules/wallets/destroyWalletProviders/destroyWalletProviders.ts
 /**
-* Upserts an elevated access token into the current tokens array.
+* Tear down every wallet provider on the client.
 *
-* Policy: Only one token per normalized scope-set is allowed.
-* If a token with the same normalized scopes exists, it is replaced.
-* This ensures we don't accumulate multiple tokens for the same scope combination.
+* Each provider's `destroy` is responsible for its own local + remote
+* cleanup. We swallow errors so a failing destroy on one provider does not
+* block teardown of the others (e.g. during logout).
 *
-* @param currentTokens - Current array of elevated access tokens
-* @param newToken - New token to upsert
-* @returns Updated array of tokens with the new token upserted
 * @notInstrumented
 */
-const upsertElevatedAccessToken = ({ currentTokens, newToken }) => {
-	const newScopeKey = normalizeScopes(newToken.scopes).join(" ");
-	return [...currentTokens.filter((existingToken) => {
-		return normalizeScopes(existingToken.scopes).join(" ") !== newScopeKey;
-	}), {
-		expiresAt: newToken.expiresAt,
-		scopes: newToken.scopes,
-		singleUse: newToken.singleUse,
-		token: newToken.token
-	}];
+const destroyWalletProviders = async ({ reason }, client) => {
+	const core = getCore(client);
+	const walletProviders = getAvailableWalletProvidersFromWalletAccounts(client);
+	await Promise.all(walletProviders.map(async (walletProvider) => {
+		if (!walletProvider.destroy) return;
+		try {
+			await walletProvider.destroy({ reason });
+		} catch (err) {
+			core.logger.error(`Error destroying wallet provider ${walletProvider.key}`, err);
+		}
+	}));
 };
 
 //#endregion
-//#region src/modules/auth/updateAuthFromVerifyResponse/updateAuthFromVerifyResponse.ts
-/** @notInstrumented */
-const updateAuthFromVerifyResponse = ({ response }, client) => {
+//#region src/modules/auth/logoutWithReason/logoutWithReason.ts
+/**
+* Logs the user out with an explicit reason.
+*
+* Revokes the session, clears auth state, terminates wallet providers, and
+* emits the `logout` client event with the given reason. The reason is also
+* captured as an argument on the function-instrumentation event, which is
+* how Datadog distinguishes between different logout causes.
+*
+* Use this instead of the public `logout` when triggering a logout from
+* internal or extension code — the caller owns the reason string, so the
+* telemetry correctly attributes *why* the logout happened.
+*
+* @param params - The logout params.
+* @param params.reason - Why the logout is being triggered. Extension authors
+*   needing a reason outside the SDK catalog can cast with `as LogoutReason`.
+* @param client - The Dynamic client instance.
+* @instrumented
+*/
+const logoutWithReason = async ({ reason }, client) => {
 	const core = getCore(client);
-	const previousState = { ...core.state.get() };
-	const { user, minifiedJwt, jwt, expiresAt, mfaToken, elevatedAccessToken } = response;
-	const sessionExpiresAt = /* @__PURE__ */ new Date(expiresAt * 1e3);
-	const newState = {
-		legacyToken: jwt ?? null,
-		sessionExpiresAt,
-		token: minifiedJwt ?? null,
-		user
-	};
-	if (mfaToken) newState.mfaToken = mfaToken;
-	const currentTokens = core.state.get().elevatedAccessTokens || [];
-	newState.elevatedAccessTokens = currentTokens;
-	if (elevatedAccessToken) {
-		const parsedToken = parseElevatedAccessToken({ token: elevatedAccessToken });
-		if (parsedToken) newState.elevatedAccessTokens = upsertElevatedAccessToken({
-			currentTokens,
-			newToken: parsedToken
-		});
+	core.logger.debug("[logoutWithReason] Logging out...", { reason });
+	await destroyWalletProviders({ reason }, client);
+	if (client.user !== null) {
+		const apiClient = createApiClient({ headers: { [DYNAMIC_LOGOUT_REASON_HEADER]: reason } }, client);
+		try {
+			await apiClient.revokeSession({ environmentId: core.environmentId });
+		} catch (error) {
+			core.logger.error("Failed to revoke session", error);
+		}
+		/**
+		* This deletes the auth cookie if it exists.
+		* If the cookie doesn't exist, this sets a new cookie that expires immediately.
+		*/
+		if (isCookieEnabled(client)) setCookie(`${DYNAMIC_AUTH_COOKIE_NAME}=; Max-Age=-99999999; path=/; SameSite=Lax${getSecureCookieAttribute()}`);
 	}
-	core.state.set(newState);
-	/**
-	* For customers using a sandbox environment with cookies enabled, we need to set the cookie
-	* programmatically because Redcoast won't set the cookie via headers. We set the cookie programmatically
-	* so customers can access the cookie from document.cookie consistently between sandbox and live environments.
-	*/
-	if (minifiedJwt && isCookieEnabled(client)) setCookie(`${DYNAMIC_AUTH_COOKIE_NAME}=${minifiedJwt}; expires=${sessionExpiresAt.toUTCString()}; path=/; SameSite=Lax${getSecureCookieAttribute()}`);
+	await core.keychain.removeKey("session");
+	const previousState = core.state.get();
+	core.state.set({
+		captchaToken: null,
+		elevatedAccessTokens: [],
+		legacyToken: null,
+		mfaToken: null,
+		sessionExpiresAt: null,
+		sessionKeys: null,
+		token: null,
+		unverifiedWalletAccounts: [],
+		user: null
+	});
+	emitEvent({
+		args: { reason },
+		event: "logout"
+	}, client);
 	checkAndRaiseWalletAccountsChangedEvent({ previousState }, client);
-	if (!previousState.user && Boolean(newState.user)) initializeWaasClientsForEagerRecovery(client);
+	fetchProjectSettings(client);
+	generateSessionKeys(client);
 };
+const __logoutWithReason_impl = logoutWithReason;
+const __logoutWithReason_wrapped = instrumentFunction({
+	fn: __logoutWithReason_impl,
+	functionName: "logoutWithReason",
+	getCore: () => {
+		try {
+			return getCore(getDefaultClient());
+		} catch {
+			return;
+		}
+	}
+});
 
 //#endregion
 Object.defineProperty(exports, 'APIError', {
@@ -2483,6 +2575,12 @@ Object.defineProperty(exports, 'SandboxMaximumThresholdReachedError', {
     return SandboxMaximumThresholdReachedError;
   }
 });
+Object.defineProperty(exports, 'TokenScope', {
+  enumerable: true,
+  get: function () {
+    return TokenScope;
+  }
+});
 Object.defineProperty(exports, 'UnauthorizedError', {
   enumerable: true,
   get: function () {
@@ -2507,6 +2605,12 @@ Object.defineProperty(exports, '__logoutWithReason_wrapped', {
     return __logoutWithReason_wrapped;
   }
 });
+Object.defineProperty(exports, '__refreshAuth_wrapped', {
+  enumerable: true,
+  get: function () {
+    return __refreshAuth_wrapped;
+  }
+});
 Object.defineProperty(exports, '__toESM', {
   enumerable: true,
   get: function () {
@@ -2837,4 +2941,4 @@ Object.defineProperty(exports, 'version', {
     return version;
   }
 });
-//# sourceMappingURL=updateAuthFromVerifyResponse-Dsw-eAro.cjs.map
+//# sourceMappingURL=logoutWithReason-DlA15deT.cjs.map