@dynamic-labs/sdk-react-core 5.2.0 → 5.3.0

package/CHANGELOG.md

@@ -1,4 +1,23 @@
 
+## [5.3.0](https://github.com/dynamic-labs/dynamic-auth/compare/v5.2.0...v5.3.0) (2026-08-12)
+
+
+### Features
+
+* **screening:** add transaction-screening service, types, and connector wiring (DYNT-1663) ([#12160](https://github.com/dynamic-labs/dynamic-auth/issues/12160)) ([d8df6a1](https://github.com/dynamic-labs/dynamic-auth/commit/d8df6a1fccbb6370c140454d9297eabd97699e35)), closes [#12172](https://github.com/dynamic-labs/dynamic-auth/issues/12172) [#12167](https://github.com/dynamic-labs/dynamic-auth/issues/12167) [#12168](https://github.com/dynamic-labs/dynamic-auth/issues/12168) [#12169](https://github.com/dynamic-labs/dynamic-auth/issues/12169)
+* **screening:** screen Bitcoin connected-wallet transactions (DYNT-1663) ([#12169](https://github.com/dynamic-labs/dynamic-auth/issues/12169)) ([f34d1c3](https://github.com/dynamic-labs/dynamic-auth/commit/f34d1c31fe10d0cb02b4f7462dd4900d0256604a))
+* **screening:** screen EVM connected-wallet sends (DYNT-1663) ([#12167](https://github.com/dynamic-labs/dynamic-auth/issues/12167)) ([1b72b24](https://github.com/dynamic-labs/dynamic-auth/commit/1b72b24393a49153d74ce715a44d262e8e48ddc7))
+* **screening:** screen Solana connected-wallet transactions (DYNT-1663) ([#12168](https://github.com/dynamic-labs/dynamic-auth/issues/12168)) ([000eb18](https://github.com/dynamic-labs/dynamic-auth/commit/000eb180aca8349804953ff7738c0ba984a2fa21))
+
+
+### Bug Fixes
+
+* add PhoneNumberAlreadyLinkedError and map duplicate-phone backend code ([#12145](https://github.com/dynamic-labs/dynamic-auth/issues/12145)) ([9d13b5f](https://github.com/dynamic-labs/dynamic-auth/commit/9d13b5f8b22716b4c9ce206ee870aab5bd745b8b))
+* **react-native-extension:** throw clear error when react-native-keychain native module is missing ([#12197](https://github.com/dynamic-labs/dynamic-auth/issues/12197)) ([b9983e1](https://github.com/dynamic-labs/dynamic-auth/commit/b9983e1f1aefa9a9bbdc1435f706a05e64f34f1c))
+* security updates ([#12187](https://github.com/dynamic-labs/dynamic-auth/issues/12187)) ([d3a31e2](https://github.com/dynamic-labs/dynamic-auth/commit/d3a31e23533b6b7739851a3b747d62ba13d318b2))
+* security updates ([#12208](https://github.com/dynamic-labs/dynamic-auth/issues/12208)) ([9e9472a](https://github.com/dynamic-labs/dynamic-auth/commit/9e9472acfbe01f7ac9e160829cc10e53c65f91e7))
+* **sdk-react-core:** avoid spurious WaaS client rebuild on transient user sessionId churn ([#12182](https://github.com/dynamic-labs/dynamic-auth/issues/12182)) ([480b2ec](https://github.com/dynamic-labs/dynamic-auth/commit/480b2ecc87486a852e75e8814a76fb59ffe40c5d))
+
 ## [5.2.0](https://github.com/dynamic-labs/dynamic-auth/compare/v5.1.0...v5.2.0) (2026-08-06)
 
 

package/package.cjs

@@ -3,10 +3,10 @@
 
 Object.defineProperty(exports, '__esModule', { value: true });
 
-var version = "5.2.0";
+var version = "5.3.0";
 var dependencies = {
-	"@dynamic-labs/sdk-api-core": "0.0.1093",
-	"@dynamic-labs-sdk/client": "1.25.0",
+	"@dynamic-labs/sdk-api-core": "0.0.1118",
+	"@dynamic-labs-sdk/client": "1.27.1",
 	"@dynamic-labs-wallet/browser-wallet-client": "1.0.92",
 	"@dynamic-labs-wallet/forward-mpc-client": "1.0.1",
 	"@hcaptcha/react-hcaptcha": "1.4.4",

package/package.js

@@ -1,8 +1,8 @@
 'use client'
-var version = "5.2.0";
+var version = "5.3.0";
 var dependencies = {
-	"@dynamic-labs/sdk-api-core": "0.0.1093",
-	"@dynamic-labs-sdk/client": "1.25.0",
+	"@dynamic-labs/sdk-api-core": "0.0.1118",
+	"@dynamic-labs-sdk/client": "1.27.1",
 	"@dynamic-labs-wallet/browser-wallet-client": "1.0.92",
 	"@dynamic-labs-wallet/forward-mpc-client": "1.0.1",
 	"@hcaptcha/react-hcaptcha": "1.4.4",

package/package.json

@@ -1,9 +1,9 @@
 {
   "name": "@dynamic-labs/sdk-react-core",
-  "version": "5.2.0",
+  "version": "5.3.0",
   "dependencies": {
-    "@dynamic-labs/sdk-api-core": "0.0.1093",
-    "@dynamic-labs-sdk/client": "1.25.0",
+    "@dynamic-labs/sdk-api-core": "0.0.1118",
+    "@dynamic-labs-sdk/client": "1.27.1",
     "@dynamic-labs-wallet/browser-wallet-client": "1.0.92",
     "@dynamic-labs-wallet/forward-mpc-client": "1.0.1",
     "@hcaptcha/react-hcaptcha": "1.4.4",
@@ -18,18 +18,18 @@
     "react-i18next": "13.5.0",
     "react-international-phone": "4.5.0",
     "yup": "0.32.11",
-    "@dynamic-labs/assert-package-version": "5.2.0",
-    "@dynamic-labs/iconic": "5.2.0",
-    "@dynamic-labs/legacy-client": "5.2.0",
-    "@dynamic-labs/locale": "5.2.0",
-    "@dynamic-labs/logger": "5.2.0",
-    "@dynamic-labs/multi-wallet": "5.2.0",
-    "@dynamic-labs/rpc-providers": "5.2.0",
-    "@dynamic-labs/store": "5.2.0",
-    "@dynamic-labs/types": "5.2.0",
-    "@dynamic-labs/utils": "5.2.0",
-    "@dynamic-labs/wallet-book": "5.2.0",
-    "@dynamic-labs/wallet-connector-core": "5.2.0",
+    "@dynamic-labs/assert-package-version": "5.3.0",
+    "@dynamic-labs/iconic": "5.3.0",
+    "@dynamic-labs/legacy-client": "5.3.0",
+    "@dynamic-labs/locale": "5.3.0",
+    "@dynamic-labs/logger": "5.3.0",
+    "@dynamic-labs/multi-wallet": "5.3.0",
+    "@dynamic-labs/rpc-providers": "5.3.0",
+    "@dynamic-labs/store": "5.3.0",
+    "@dynamic-labs/types": "5.3.0",
+    "@dynamic-labs/utils": "5.3.0",
+    "@dynamic-labs/wallet-book": "5.3.0",
+    "@dynamic-labs/wallet-connector-core": "5.3.0",
     "eventemitter3": "5.0.1"
   },
   "devDependencies": {

package/src/index.d.ts

@@ -104,7 +104,7 @@ export { getDefaultColor, getThemeConfig, themesData, } from './lib/context/Them
 export type { 
 /** @deprecated */
 ViewType, } from './lib/context/ViewContext';
-export type { NotSupportedError, SandboxMaximumThresholdReachedError, NoAccessError, ChainalysisError, EmailAlreadyExistsError, UsernameAlreadyExistsError, SocialAccountAlreadyExistsError, WalletNotDeployedError, WalletUsedError, EmailVerificationError, AccountExistsError, InvalidPhoneNumberError, RateLimitError, } from '@dynamic-labs/utils';
+export type { NotSupportedError, SandboxMaximumThresholdReachedError, NoAccessError, ChainalysisError, EmailAlreadyExistsError, UsernameAlreadyExistsError, SocialAccountAlreadyExistsError, WalletNotDeployedError, WalletUsedError, EmailVerificationError, AccountExistsError, InvalidPhoneNumberError, PhoneNumberAlreadyLinkedError, RateLimitError, } from '@dynamic-labs/utils';
 export type { WalletConnector, Chain, } from '@dynamic-labs/wallet-connector-core';
 export type { EvmNetwork, PhoneData, OtpDestination, UserProfile, 
 /** @deprecated use AuthOptions instead */

package/src/lib/client/extension/functions/getSessionIdFromMinToken/getSessionIdFromMinToken.cjs

@@ -0,0 +1,30 @@
+'use client'
+'use strict';
+
+Object.defineProperty(exports, '__esModule', { value: true });
+
+var sdkApiCore = require('@dynamic-labs/sdk-api-core');
+var parseToken = require('../../../../shared/utils/functions/parseToken/parseToken.cjs');
+var getMinAuthToken = require('../getMinAuthToken/getMinAuthToken.cjs');
+
+/**
+ * Reads the session id (`sid` claim) from the current min JWT claims.
+ * Returns `undefined` when no token, decode fails, or the claim is missing.
+ */
+const getSessionIdFromMinToken = () => {
+    const token = getMinAuthToken.getMinAuthToken();
+    if (!token)
+        return undefined;
+    const payload = parseToken.parseToken(token);
+    if (!payload || typeof payload !== 'object')
+        return undefined;
+    try {
+        const minJwt = sdkApiCore.MinifiedDynamicJwtFromJSON(payload);
+        return minJwt.sid;
+    }
+    catch (_a) {
+        return undefined;
+    }
+};
+
+exports.getSessionIdFromMinToken = getSessionIdFromMinToken;

package/src/lib/client/extension/functions/getSessionIdFromMinToken/getSessionIdFromMinToken.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Reads the session id (`sid` claim) from the current min JWT claims.
+ * Returns `undefined` when no token, decode fails, or the claim is missing.
+ */
+export declare const getSessionIdFromMinToken: () => string | undefined;

package/src/lib/client/extension/functions/getSessionIdFromMinToken/getSessionIdFromMinToken.js

@@ -0,0 +1,26 @@
+'use client'
+import { MinifiedDynamicJwtFromJSON } from '@dynamic-labs/sdk-api-core';
+import { parseToken } from '../../../../shared/utils/functions/parseToken/parseToken.js';
+import { getMinAuthToken } from '../getMinAuthToken/getMinAuthToken.js';
+
+/**
+ * Reads the session id (`sid` claim) from the current min JWT claims.
+ * Returns `undefined` when no token, decode fails, or the claim is missing.
+ */
+const getSessionIdFromMinToken = () => {
+    const token = getMinAuthToken();
+    if (!token)
+        return undefined;
+    const payload = parseToken(token);
+    if (!payload || typeof payload !== 'object')
+        return undefined;
+    try {
+        const minJwt = MinifiedDynamicJwtFromJSON(payload);
+        return minJwt.sid;
+    }
+    catch (_a) {
+        return undefined;
+    }
+};
+
+export { getSessionIdFromMinToken };

package/src/lib/client/extension/functions/getSessionIdFromMinToken/index.d.ts

@@ -0,0 +1 @@
+export { getSessionIdFromMinToken } from './getSessionIdFromMinToken';

package/src/lib/client/extension/index.d.ts

@@ -13,6 +13,7 @@ export { useRefetchProjectSettings } from './projectSettings/useRefetchProjectSe
 export { isCookieEnabled } from './functions/isCookieEnabled';
 export { getMinAuthToken } from './functions/getMinAuthToken';
 export { getSignInCredentialIdFromMinToken } from './functions/getSignInCredentialIdFromMinToken';
+export { getSessionIdFromMinToken } from './functions/getSessionIdFromMinToken';
 export { getAuthToken } from './functions/getAuthToken';
 export { getExpiresAt } from './functions/getExpiresAt';
 export { hasElevatedAccessToken } from './functions/hasElevatedAccessToken';

package/src/lib/context/DynamicContext/DynamicContext.cjs

@@ -34,6 +34,7 @@ var nonce = require('../../store/state/nonce/nonce.cjs');
 require('@dynamic-labs-wallet/browser-wallet-client');
 var ApiEndpoint = require('../../config/ApiEndpoint.cjs');
 var settings = require('../../data/api/settings/settings.cjs');
+var screenTransaction = require('../../data/api/transactions/screenTransaction.cjs');
 var dynamicContextProps = require('../../store/state/dynamicContextProps/dynamicContextProps.cjs');
 var primaryWalletId = require('../../store/state/primaryWalletId/primaryWalletId.cjs');
 var connectedWalletsInfo = require('../../store/state/connectedWalletsInfo/connectedWalletsInfo.cjs');
@@ -302,6 +303,7 @@ const InnerDynamicContextProvider = (props) => {
         mobileExperience,
         networkConfigurations: serverNetworkConfigurations,
         projectSettings,
+        transactionScreening: screenTransaction.transactionScreeningService,
         useMetamaskSdk,
         walletBook: walletBook$1,
         walletConnectPreferredChains,

package/src/lib/context/DynamicContext/DynamicContext.js

@@ -30,6 +30,7 @@ import { useFetchNonce, useNonce } from '../../store/state/nonce/nonce.js';
 import '@dynamic-labs-wallet/browser-wallet-client';
 import ApiEndpoint from '../../config/ApiEndpoint.js';
 import { sendDynamicProps } from '../../data/api/settings/settings.js';
+import { transactionScreeningService } from '../../data/api/transactions/screenTransaction.js';
 import { useSyncDynamicContextProps } from '../../store/state/dynamicContextProps/dynamicContextProps.js';
 import { usePrimaryWalletId } from '../../store/state/primaryWalletId/primaryWalletId.js';
 import { resetConnectedWalletsInfo } from '../../store/state/connectedWalletsInfo/connectedWalletsInfo.js';
@@ -298,6 +299,7 @@ const InnerDynamicContextProvider = (props) => {
         mobileExperience,
         networkConfigurations: serverNetworkConfigurations,
         projectSettings,
+        transactionScreening: transactionScreeningService,
         useMetamaskSdk,
         walletBook,
         walletConnectPreferredChains,

package/src/lib/context/ErrorContext/hooks/useErrorText/useErrorText.cjs

@@ -23,6 +23,7 @@ const mapErrorCodeToTranslation = {
     [utils.ErrorCode.CREDENTIAL_NOT_ENABLED_FOR_SIGN_IN]: 'dyn_error.credential_not_enabled_for_sign_in',
     [utils.ErrorCode.SEI_NOT_ENABLED_IN_KEPLR_WALLET]: 'dyn_error.sei_not_enabled_in_keplr_wallet',
     [utils.RATE_LIMIT_ERROR_CODE]: 'dyn_error.rate_limit_error',
+    [utils.TRANSACTION_SCREENING_BLOCKED_ERROR_CODE]: 'dyn_error.transaction_screening_blocked',
 };
 /** A hook that listens to the error context and returns a translated value */
 const useErrorText = () => {

package/src/lib/context/ErrorContext/hooks/useErrorText/useErrorText.js

@@ -1,7 +1,7 @@
 'use client'
 import { useMemo } from 'react';
 import { useTranslation } from 'react-i18next';
-import { ErrorCode, RATE_LIMIT_ERROR_CODE } from '@dynamic-labs/utils';
+import { ErrorCode, RATE_LIMIT_ERROR_CODE, TRANSACTION_SCREENING_BLOCKED_ERROR_CODE } from '@dynamic-labs/utils';
 import { useErrorContext } from '../../ErrorContext.js';
 
 const mapErrorCodeToTranslation = {
@@ -19,6 +19,7 @@ const mapErrorCodeToTranslation = {
     [ErrorCode.CREDENTIAL_NOT_ENABLED_FOR_SIGN_IN]: 'dyn_error.credential_not_enabled_for_sign_in',
     [ErrorCode.SEI_NOT_ENABLED_IN_KEPLR_WALLET]: 'dyn_error.sei_not_enabled_in_keplr_wallet',
     [RATE_LIMIT_ERROR_CODE]: 'dyn_error.rate_limit_error',
+    [TRANSACTION_SCREENING_BLOCKED_ERROR_CODE]: 'dyn_error.transaction_screening_blocked',
 };
 /** A hook that listens to the error context and returns a translated value */
 const useErrorText = () => {

package/src/lib/data/api/transactions/index.d.ts

@@ -1 +1,2 @@
 export * from './blockaid';
+export * from './screenTransaction';

package/src/lib/data/api/transactions/screenTransaction.cjs

@@ -0,0 +1,107 @@
+'use client'
+'use strict';
+
+Object.defineProperty(exports, '__esModule', { value: true });
+
+var _tslib = require('../../../../../_virtual/_tslib.cjs');
+var sdkApiCore = require('@dynamic-labs/sdk-api-core');
+var utils = require('@dynamic-labs/utils');
+var api = require('../api.cjs');
+require('@dynamic-labs/iconic');
+require('@dynamic-labs/wallet-connector-core');
+require('react');
+require('react/jsx-runtime');
+require('../../../context/ViewContext/ViewContext.cjs');
+var logger = require('../../../shared/logger.cjs');
+require('@dynamic-labs/wallet-book');
+require('../../../utils/constants/colors.cjs');
+require('../../../utils/constants/values.cjs');
+require('../../../shared/consts/index.cjs');
+var dynamicContextProps = require('../../../store/state/dynamicContextProps/dynamicContextProps.cjs');
+require('@dynamic-labs-sdk/client/core');
+require('eventemitter3');
+require('@dynamic-labs-sdk/client');
+require('../../../config/ApiEndpoint.cjs');
+require('@dynamic-labs/multi-wallet');
+require('react-international-phone');
+require('../../../store/state/nonce/nonce.cjs');
+require('@dynamic-labs-wallet/browser-wallet-client');
+require('@dynamic-labs/locale');
+require('../../../store/state/primaryWalletId/primaryWalletId.cjs');
+require('../../../store/state/connectedWalletsInfo/connectedWalletsInfo.cjs');
+require('../../../utils/functions/getWaasAddressTypeLabel/getWaasAddressTypeLabel.cjs');
+require('../../../events/dynamicEvents.cjs');
+var getProjectSettings = require('../../../client/extension/projectSettings/getProjectSettings/getProjectSettings.cjs');
+
+// The SDK-internal chain union (shared across connector packages) is decoupled
+// from the wire-level enum; this is the one place that needs to know both.
+// Resolved per call rather than as a module-scope map, as is the block decision
+// at the bottom of this file: reading an enum member at module scope resolves it
+// the moment anything in this barrel's import graph loads, which takes down every
+// spec that partially mocks sdk-api-core before a single test can run.
+const chainEnumFor = (chain) => {
+    const chainEnumByScreeningChain = {
+        BTC: sdkApiCore.ChainEnum.Btc,
+        EVM: sdkApiCore.ChainEnum.Evm,
+        SOL: sdkApiCore.ChainEnum.Sol,
+    };
+    return chainEnumByScreeningChain[chain];
+};
+// A human is waiting on this call: it sits between "send" and the wallet
+// prompt, so an unbounded fetch would stall the prompt indefinitely on a
+// redcoast outage. Matches the enclave hook's 2000 ms wall-clock bound
+// (SANCTIONS_SCREENING_TIMEOUT_MS) so both screening paths degrade alike.
+const SCREENING_TIMEOUT_MS = 2000;
+const isScreeningEnabled = () => {
+    var _a, _b, _c;
+    return Boolean((_c = (_b = (_a = getProjectSettings.getProjectSettings()) === null || _a === void 0 ? void 0 : _a.sdk) === null || _b === void 0 ? void 0 : _b.featureFlags) === null || _c === void 0 ? void 0 : _c.enableExternalWalletOnTransactionSanctions);
+};
+/**
+ * Screens a connected-wallet transaction against the environment's sanctions
+ * providers before the wallet is prompted. Best-effort by construction:
+ * resolves on allow and on any screening failure (fail-open — signing must
+ * never hard-fail on a screening outage), and throws
+ * TransactionScreeningBlockedError only on an explicit block decision. A
+ * screen that outlives SCREENING_TIMEOUT_MS is one of those failures.
+ */
+const screenTransaction = (args) => _tslib.__awaiter(void 0, void 0, void 0, function* () {
+    let abortTimer;
+    let response;
+    try {
+        // Reading settings can itself throw (e.g. the client store isn't
+        // initialized yet), which must fail open like everything else here.
+        if (!isScreeningEnabled())
+            return;
+        // The signal cancels the in-flight request so a hung endpoint can't tie up
+        // the browser's connections to the API; the race is what actually bounds the
+        // wait, since a host-supplied FetchService implementation need not honour it.
+        const abortController = new AbortController();
+        abortTimer = setTimeout(() => abortController.abort(), SCREENING_TIMEOUT_MS);
+        response = yield utils.promiseWithTimeout(api.sdkApi().screenTransaction({
+            environmentId: dynamicContextProps.getEnvironmentId(),
+            screenTransactionRequest: Object.assign(Object.assign({}, args), { chain: chainEnumFor(args.chain) }),
+        }, { signal: abortController.signal }), SCREENING_TIMEOUT_MS, { timeoutMessage: 'screenTransaction timed out' });
+    }
+    catch (_a) {
+        // Not the raw error: it can carry internal details (endpoint paths,
+        // server-side messages) that shouldn't cross the logger's broadcast
+        // boundary to whatever a host app has subscribed to its log events.
+        logger.logger.warn('screenTransaction error', {
+            message: 'Transaction screening failed',
+        });
+        return;
+    }
+    finally {
+        clearTimeout(abortTimer);
+    }
+    if ((response === null || response === void 0 ? void 0 : response.decision) === sdkApiCore.ScreenTransactionResponseDecisionEnum.Block) {
+        throw new utils.TransactionScreeningBlockedError(response.blockedAddresses);
+    }
+});
+const transactionScreeningService = {
+    screenTransaction,
+};
+
+exports.SCREENING_TIMEOUT_MS = SCREENING_TIMEOUT_MS;
+exports.screenTransaction = screenTransaction;
+exports.transactionScreeningService = transactionScreeningService;

package/src/lib/data/api/transactions/screenTransaction.d.ts

@@ -0,0 +1,12 @@
+import { ScreenTransactionArgs, TransactionScreeningService } from '@dynamic-labs/types';
+export declare const SCREENING_TIMEOUT_MS = 2000;
+/**
+ * Screens a connected-wallet transaction against the environment's sanctions
+ * providers before the wallet is prompted. Best-effort by construction:
+ * resolves on allow and on any screening failure (fail-open — signing must
+ * never hard-fail on a screening outage), and throws
+ * TransactionScreeningBlockedError only on an explicit block decision. A
+ * screen that outlives SCREENING_TIMEOUT_MS is one of those failures.
+ */
+export declare const screenTransaction: (args: ScreenTransactionArgs) => Promise<void>;
+export declare const transactionScreeningService: TransactionScreeningService;

package/src/lib/data/api/transactions/screenTransaction.js

@@ -0,0 +1,101 @@
+'use client'
+import { __awaiter } from '../../../../../_virtual/_tslib.js';
+import { ScreenTransactionResponseDecisionEnum, ChainEnum } from '@dynamic-labs/sdk-api-core';
+import { promiseWithTimeout, TransactionScreeningBlockedError } from '@dynamic-labs/utils';
+import { sdkApi } from '../api.js';
+import '@dynamic-labs/iconic';
+import '@dynamic-labs/wallet-connector-core';
+import 'react';
+import 'react/jsx-runtime';
+import '../../../context/ViewContext/ViewContext.js';
+import { logger } from '../../../shared/logger.js';
+import '@dynamic-labs/wallet-book';
+import '../../../utils/constants/colors.js';
+import '../../../utils/constants/values.js';
+import '../../../shared/consts/index.js';
+import { getEnvironmentId } from '../../../store/state/dynamicContextProps/dynamicContextProps.js';
+import '@dynamic-labs-sdk/client/core';
+import 'eventemitter3';
+import '@dynamic-labs-sdk/client';
+import '../../../config/ApiEndpoint.js';
+import '@dynamic-labs/multi-wallet';
+import 'react-international-phone';
+import '../../../store/state/nonce/nonce.js';
+import '@dynamic-labs-wallet/browser-wallet-client';
+import '@dynamic-labs/locale';
+import '../../../store/state/primaryWalletId/primaryWalletId.js';
+import '../../../store/state/connectedWalletsInfo/connectedWalletsInfo.js';
+import '../../../utils/functions/getWaasAddressTypeLabel/getWaasAddressTypeLabel.js';
+import '../../../events/dynamicEvents.js';
+import { getProjectSettings } from '../../../client/extension/projectSettings/getProjectSettings/getProjectSettings.js';
+
+// The SDK-internal chain union (shared across connector packages) is decoupled
+// from the wire-level enum; this is the one place that needs to know both.
+// Resolved per call rather than as a module-scope map, as is the block decision
+// at the bottom of this file: reading an enum member at module scope resolves it
+// the moment anything in this barrel's import graph loads, which takes down every
+// spec that partially mocks sdk-api-core before a single test can run.
+const chainEnumFor = (chain) => {
+    const chainEnumByScreeningChain = {
+        BTC: ChainEnum.Btc,
+        EVM: ChainEnum.Evm,
+        SOL: ChainEnum.Sol,
+    };
+    return chainEnumByScreeningChain[chain];
+};
+// A human is waiting on this call: it sits between "send" and the wallet
+// prompt, so an unbounded fetch would stall the prompt indefinitely on a
+// redcoast outage. Matches the enclave hook's 2000 ms wall-clock bound
+// (SANCTIONS_SCREENING_TIMEOUT_MS) so both screening paths degrade alike.
+const SCREENING_TIMEOUT_MS = 2000;
+const isScreeningEnabled = () => {
+    var _a, _b, _c;
+    return Boolean((_c = (_b = (_a = getProjectSettings()) === null || _a === void 0 ? void 0 : _a.sdk) === null || _b === void 0 ? void 0 : _b.featureFlags) === null || _c === void 0 ? void 0 : _c.enableExternalWalletOnTransactionSanctions);
+};
+/**
+ * Screens a connected-wallet transaction against the environment's sanctions
+ * providers before the wallet is prompted. Best-effort by construction:
+ * resolves on allow and on any screening failure (fail-open — signing must
+ * never hard-fail on a screening outage), and throws
+ * TransactionScreeningBlockedError only on an explicit block decision. A
+ * screen that outlives SCREENING_TIMEOUT_MS is one of those failures.
+ */
+const screenTransaction = (args) => __awaiter(void 0, void 0, void 0, function* () {
+    let abortTimer;
+    let response;
+    try {
+        // Reading settings can itself throw (e.g. the client store isn't
+        // initialized yet), which must fail open like everything else here.
+        if (!isScreeningEnabled())
+            return;
+        // The signal cancels the in-flight request so a hung endpoint can't tie up
+        // the browser's connections to the API; the race is what actually bounds the
+        // wait, since a host-supplied FetchService implementation need not honour it.
+        const abortController = new AbortController();
+        abortTimer = setTimeout(() => abortController.abort(), SCREENING_TIMEOUT_MS);
+        response = yield promiseWithTimeout(sdkApi().screenTransaction({
+            environmentId: getEnvironmentId(),
+            screenTransactionRequest: Object.assign(Object.assign({}, args), { chain: chainEnumFor(args.chain) }),
+        }, { signal: abortController.signal }), SCREENING_TIMEOUT_MS, { timeoutMessage: 'screenTransaction timed out' });
+    }
+    catch (_a) {
+        // Not the raw error: it can carry internal details (endpoint paths,
+        // server-side messages) that shouldn't cross the logger's broadcast
+        // boundary to whatever a host app has subscribed to its log events.
+        logger.warn('screenTransaction error', {
+            message: 'Transaction screening failed',
+        });
+        return;
+    }
+    finally {
+        clearTimeout(abortTimer);
+    }
+    if ((response === null || response === void 0 ? void 0 : response.decision) === ScreenTransactionResponseDecisionEnum.Block) {
+        throw new TransactionScreeningBlockedError(response.blockedAddresses);
+    }
+});
+const transactionScreeningService = {
+    screenTransaction,
+};
+
+export { SCREENING_TIMEOUT_MS, screenTransaction, transactionScreeningService };

package/src/lib/data/api/user/user.cjs

@@ -59,6 +59,9 @@ const updateUserProfileFields = (environmentId, fields) => _tslib.__awaiter(void
             else if (error.code === 'too_many_verification_attempts') {
                 throw new utils$1.TooManyEmailVerificationsError(error.error, error.code);
             }
+            else if (error.code === 'user_has_already_account_with_phone_number') {
+                throw new utils$1.PhoneNumberAlreadyLinkedError(error.error, error.code);
+            }
             else if (error.code === 'invalid_phone' ||
                 error.code === 'invalid_sms_verification') {
                 throw new utils$1.InvalidPhoneNumberError(error.error, error.code);

package/src/lib/data/api/user/user.js

@@ -2,7 +2,7 @@
 import { __awaiter } from '../../../../../_virtual/_tslib.js';
 import { getElevatedAccessToken } from '@dynamic-labs-sdk/client';
 import { TokenScope } from '@dynamic-labs/sdk-api-core';
-import { EmailAlreadyExistsError, CustomFieldNotUniqueError, UsernameAlreadyExistsError, TooManyEmailVerificationsError, InvalidPhoneNumberError } from '@dynamic-labs/utils';
+import { EmailAlreadyExistsError, CustomFieldNotUniqueError, UsernameAlreadyExistsError, TooManyEmailVerificationsError, PhoneNumberAlreadyLinkedError, InvalidPhoneNumberError } from '@dynamic-labs/utils';
 import '@dynamic-labs-sdk/client/core';
 import 'react';
 import 'eventemitter3';
@@ -55,6 +55,9 @@ const updateUserProfileFields = (environmentId, fields) => __awaiter(void 0, voi
             else if (error.code === 'too_many_verification_attempts') {
                 throw new TooManyEmailVerificationsError(error.error, error.code);
             }
+            else if (error.code === 'user_has_already_account_with_phone_number') {
+                throw new PhoneNumberAlreadyLinkedError(error.error, error.code);
+            }
             else if (error.code === 'invalid_phone' ||
                 error.code === 'invalid_sms_verification') {
                 throw new InvalidPhoneNumberError(error.error, error.code);

package/src/lib/utils/functions/updatePrimaryWalletId/updatePrimaryWalletId.cjs

@@ -25,8 +25,8 @@ require('react-international-phone');
 require('../../../store/state/nonce/nonce.cjs');
 require('@dynamic-labs-wallet/browser-wallet-client');
 require('@dynamic-labs/locale');
-var wallets = require('../../../data/api/wallets/wallets.cjs');
 var dynamicContextProps = require('../../../store/state/dynamicContextProps/dynamicContextProps.cjs');
+var wallets = require('../../../data/api/wallets/wallets.cjs');
 var primaryWalletId = require('../../../store/state/primaryWalletId/primaryWalletId.cjs');
 require('../../../store/state/connectedWalletsInfo/connectedWalletsInfo.cjs');
 require('../getWaasAddressTypeLabel/getWaasAddressTypeLabel.cjs');

package/src/lib/utils/functions/updatePrimaryWalletId/updatePrimaryWalletId.js

@@ -21,8 +21,8 @@ import 'react-international-phone';
 import '../../../store/state/nonce/nonce.js';
 import '@dynamic-labs-wallet/browser-wallet-client';
 import '@dynamic-labs/locale';
-import { storeSelectedWallet } from '../../../data/api/wallets/wallets.js';
 import { getEnvironmentId } from '../../../store/state/dynamicContextProps/dynamicContextProps.js';
+import { storeSelectedWallet } from '../../../data/api/wallets/wallets.js';
 import { setPrimaryWalletId } from '../../../store/state/primaryWalletId/primaryWalletId.js';
 import '../../../store/state/connectedWalletsInfo/connectedWalletsInfo.js';
 import '../getWaasAddressTypeLabel/getWaasAddressTypeLabel.js';

package/src/lib/utils/hooks/useCreateWalletConnectorOptions/useCreateWalletConnectorOptions.d.ts

@@ -1,5 +1,5 @@
 import { ProjectSettings } from '@dynamic-labs/sdk-api-core';
-import { type MobileExperience, type CoinbaseWalletPreference, type NetworkConfigurationMap, type WalletUiUtils } from '@dynamic-labs/types';
+import { type MobileExperience, type CoinbaseWalletPreference, type NetworkConfigurationMap, type TransactionScreeningService, type WalletUiUtils } from '@dynamic-labs/types';
 import { DeepLinkVariant, InternalWalletConnector, WalletConnectorExtension, WalletConnectorsMethod } from '@dynamic-labs/wallet-connector-core';
 import { WalletBookSchema } from '@dynamic-labs/wallet-book';
 export type WalletConnectorProps = {
@@ -11,6 +11,7 @@ export type WalletConnectorProps = {
     mobileExperience?: MobileExperience;
     networkConfigurations: NetworkConfigurationMap | undefined;
     projectSettings: ProjectSettings | undefined;
+    transactionScreening?: TransactionScreeningService;
     walletBook: WalletBookSchema;
     walletConnectPreferredChains?: `eip155:${number}`[];
     walletConnectorsProp?: WalletConnectorsMethod[];

package/src/lib/utils/hooks/useMfa/useMfa.cjs

@@ -26,8 +26,8 @@ require('react-international-phone');
 require('../../../store/state/nonce/nonce.cjs');
 require('@dynamic-labs-wallet/browser-wallet-client');
 require('@dynamic-labs/locale');
-var user = require('../../../data/api/user/user.cjs');
 var dynamicContextProps = require('../../../store/state/dynamicContextProps/dynamicContextProps.cjs');
+var user = require('../../../data/api/user/user.cjs');
 require('../../../store/state/primaryWalletId/primaryWalletId.cjs');
 require('../../../store/state/connectedWalletsInfo/connectedWalletsInfo.cjs');
 require('../../functions/getWaasAddressTypeLabel/getWaasAddressTypeLabel.cjs');

package/src/lib/utils/hooks/useMfa/useMfa.js

@@ -22,8 +22,8 @@ import 'react-international-phone';
 import '../../../store/state/nonce/nonce.js';
 import '@dynamic-labs-wallet/browser-wallet-client';
 import '@dynamic-labs/locale';
-import { refreshUserJwt } from '../../../data/api/user/user.js';
 import { getEnvironmentId } from '../../../store/state/dynamicContextProps/dynamicContextProps.js';
+import { refreshUserJwt } from '../../../data/api/user/user.js';
 import '../../../store/state/primaryWalletId/primaryWalletId.js';
 import '../../../store/state/connectedWalletsInfo/connectedWalletsInfo.js';
 import '../../functions/getWaasAddressTypeLabel/getWaasAddressTypeLabel.js';

package/src/lib/utils/hooks/useSyncDynamicWaas/useSyncDynamicWaas.cjs

@@ -32,6 +32,7 @@ require('../../functions/getWaasAddressTypeLabel/getWaasAddressTypeLabel.cjs');
 require('../../../events/dynamicEvents.cjs');
 var useOnboardingCompleteUser = require('../../../client/extension/user/useOnboardingCompleteUser/useOnboardingCompleteUser.cjs');
 var useProjectSettings = require('../../../client/extension/projectSettings/useProjectSettings/useProjectSettings.cjs');
+var getSessionIdFromMinToken = require('../../../client/extension/functions/getSessionIdFromMinToken/getSessionIdFromMinToken.cjs');
 require('../../../context/DynamicContext/useDynamicContext/useDynamicContext.cjs');
 var useInternalDynamicContext = require('../../../context/DynamicContext/useDynamicContext/useInternalDynamicContext/useInternalDynamicContext.cjs');
 var LoadingContext = require('../../../context/LoadingContext/LoadingContext.cjs');
@@ -292,19 +293,25 @@ const useSyncDynamicWaas = () => {
     // Initialize waas iframe when user is authenticated
     // This handles both page reload (user already authenticated) and fresh authentication
     React.useEffect(() => {
+        const tokenSessionId = getSessionIdFromMinToken.getSessionIdFromMinToken();
+        const currentSessionId = tokenSessionId !== null && tokenSessionId !== void 0 ? tokenSessionId : user === null || user === void 0 ? void 0 : user.sessionId;
         // handle logout case where user is logged out but session id is still valid
-        if (sessionIdRef.current && !(user === null || user === void 0 ? void 0 : user.sessionId)) {
+        if (sessionIdRef.current && !currentSessionId) {
             sessionIdRef.current = undefined;
             hasWaasInitializedRef.current = false;
             initializingWaasRef.current = false;
             clearRecoveredWallets();
         }
-        if (shouldInitializeWaas && (user === null || user === void 0 ? void 0 : user.sessionId) && isSdkReadyForWaas()) {
-            const { sessionId, id: userId } = user;
+        if (shouldInitializeWaas &&
+            currentSessionId &&
+            (user === null || user === void 0 ? void 0 : user.sessionId) &&
+            isSdkReadyForWaas()) {
+            const { id: userId } = user;
             const shouldInitialize = !initializingWaasRef.current &&
-                (!hasWaasInitializedRef.current || sessionIdRef.current !== sessionId);
+                (!hasWaasInitializedRef.current ||
+                    sessionIdRef.current !== currentSessionId);
             if (shouldInitialize) {
-                const isSessionIdChanged = sessionIdRef.current !== sessionId;
+                const isSessionIdChanged = sessionIdRef.current !== currentSessionId;
                 // A swap from a prior session (e.g. step-up reauth) must rebuild the
                 // WaaS client so the iframe re-auths with the new session instead of
                 // 401-ing on the stale cached one. First init (no prior session) keeps
@@ -318,8 +325,11 @@ const useSyncDynamicWaas = () => {
                 initializeWaas({ forceClientRebuild })
                     .then(() => {
                     logger.logger.debug('[useSyncDynamicWaas] waas initialized');
+                    // Persist the session id this init actually ran with so a token
+                    // rotation that happened mid-flight is still detected on the next
+                    // effect run and triggers a force-rebuild.
                     hasWaasInitializedRef.current = true;
-                    sessionIdRef.current = sessionId;
+                    sessionIdRef.current = currentSessionId;
                     // Host-observed time to get the WaaS iframe/client ready. Ships to
                     // Datadog (sliced by @version + environmentId) as the host-side
                     // companion to the iframe app's `waas_iframe_*` timing — used to
@@ -334,13 +344,14 @@ const useSyncDynamicWaas = () => {
                     .catch((error) => {
                     logger.logger.warn('[useSyncDynamicWaas] Error initializing waas', {
                         error,
-                        sessionId,
+                        sessionId: currentSessionId,
                         userId,
                     });
                     logger.logger.instrument('WaaS host init failed', {
                         environmentId,
                         key: 'waas_host_init_failed',
                         reason: error instanceof Error ? error.message : String(error),
+                        sessionId: currentSessionId,
                         time: Date.now() - initStartedAt,
                         userId,
                     });

package/src/lib/utils/hooks/useSyncDynamicWaas/useSyncDynamicWaas.js

@@ -28,6 +28,7 @@ import '../../functions/getWaasAddressTypeLabel/getWaasAddressTypeLabel.js';
 import '../../../events/dynamicEvents.js';
 import { useOnboardingCompleteUser } from '../../../client/extension/user/useOnboardingCompleteUser/useOnboardingCompleteUser.js';
 import { useProjectSettings } from '../../../client/extension/projectSettings/useProjectSettings/useProjectSettings.js';
+import { getSessionIdFromMinToken } from '../../../client/extension/functions/getSessionIdFromMinToken/getSessionIdFromMinToken.js';
 import '../../../context/DynamicContext/useDynamicContext/useDynamicContext.js';
 import { useInternalDynamicContext } from '../../../context/DynamicContext/useDynamicContext/useInternalDynamicContext/useInternalDynamicContext.js';
 import { useLoadingContext } from '../../../context/LoadingContext/LoadingContext.js';
@@ -288,19 +289,25 @@ const useSyncDynamicWaas = () => {
     // Initialize waas iframe when user is authenticated
     // This handles both page reload (user already authenticated) and fresh authentication
     useEffect(() => {
+        const tokenSessionId = getSessionIdFromMinToken();
+        const currentSessionId = tokenSessionId !== null && tokenSessionId !== void 0 ? tokenSessionId : user === null || user === void 0 ? void 0 : user.sessionId;
         // handle logout case where user is logged out but session id is still valid
-        if (sessionIdRef.current && !(user === null || user === void 0 ? void 0 : user.sessionId)) {
+        if (sessionIdRef.current && !currentSessionId) {
             sessionIdRef.current = undefined;
             hasWaasInitializedRef.current = false;
             initializingWaasRef.current = false;
             clearRecoveredWallets();
         }
-        if (shouldInitializeWaas && (user === null || user === void 0 ? void 0 : user.sessionId) && isSdkReadyForWaas()) {
-            const { sessionId, id: userId } = user;
+        if (shouldInitializeWaas &&
+            currentSessionId &&
+            (user === null || user === void 0 ? void 0 : user.sessionId) &&
+            isSdkReadyForWaas()) {
+            const { id: userId } = user;
             const shouldInitialize = !initializingWaasRef.current &&
-                (!hasWaasInitializedRef.current || sessionIdRef.current !== sessionId);
+                (!hasWaasInitializedRef.current ||
+                    sessionIdRef.current !== currentSessionId);
             if (shouldInitialize) {
-                const isSessionIdChanged = sessionIdRef.current !== sessionId;
+                const isSessionIdChanged = sessionIdRef.current !== currentSessionId;
                 // A swap from a prior session (e.g. step-up reauth) must rebuild the
                 // WaaS client so the iframe re-auths with the new session instead of
                 // 401-ing on the stale cached one. First init (no prior session) keeps
@@ -314,8 +321,11 @@ const useSyncDynamicWaas = () => {
                 initializeWaas({ forceClientRebuild })
                     .then(() => {
                     logger.debug('[useSyncDynamicWaas] waas initialized');
+                    // Persist the session id this init actually ran with so a token
+                    // rotation that happened mid-flight is still detected on the next
+                    // effect run and triggers a force-rebuild.
                     hasWaasInitializedRef.current = true;
-                    sessionIdRef.current = sessionId;
+                    sessionIdRef.current = currentSessionId;
                     // Host-observed time to get the WaaS iframe/client ready. Ships to
                     // Datadog (sliced by @version + environmentId) as the host-side
                     // companion to the iframe app's `waas_iframe_*` timing — used to
@@ -330,13 +340,14 @@ const useSyncDynamicWaas = () => {
                     .catch((error) => {
                     logger.warn('[useSyncDynamicWaas] Error initializing waas', {
                         error,
-                        sessionId,
+                        sessionId: currentSessionId,
                         userId,
                     });
                     logger.instrument('WaaS host init failed', {
                         environmentId,
                         key: 'waas_host_init_failed',
                         reason: error instanceof Error ? error.message : String(error),
+                        sessionId: currentSessionId,
                         time: Date.now() - initStartedAt,
                         userId,
                     });

package/src/lib/utils/hooks/useUserAuth/useUserAuth.cjs

@@ -73,6 +73,7 @@ const useUserAuth = ({ authMethod, }) => {
             error instanceof utils.CustomFieldNotUniqueError ||
             error instanceof utils.UsernameAlreadyExistsError ||
             error instanceof utils.TooManyEmailVerificationsError ||
+            error instanceof utils.PhoneNumberAlreadyLinkedError ||
             error instanceof utils.InvalidPhoneNumberError)
             throw error;
         if (error instanceof utils.NoAccessError) {

package/src/lib/utils/hooks/useUserAuth/useUserAuth.js

@@ -3,7 +3,7 @@ import { __awaiter } from '../../../../../_virtual/_tslib.js';
 import { useCallback } from 'react';
 import { MfaInvalidOtpError, MfaRateLimitedError, SandboxMaximumThresholdReachedError as SandboxMaximumThresholdReachedError$1 } from '@dynamic-labs-sdk/client';
 import { WalletProviderEnum, EmbeddedWalletVersionEnum, MfaBackupCodeAcknowledgement } from '@dynamic-labs/sdk-api-core';
-import { EmailAlreadyExistsError, CustomFieldNotUniqueError, UsernameAlreadyExistsError, TooManyEmailVerificationsError, InvalidPhoneNumberError, NoAccessError, AccountExistsError, SandboxMaximumThresholdReachedError, UserHasAccountWithEmailError, ErrorCode, DynamicError, sleep } from '@dynamic-labs/utils';
+import { EmailAlreadyExistsError, CustomFieldNotUniqueError, UsernameAlreadyExistsError, TooManyEmailVerificationsError, PhoneNumberAlreadyLinkedError, InvalidPhoneNumberError, NoAccessError, AccountExistsError, SandboxMaximumThresholdReachedError, UserHasAccountWithEmailError, ErrorCode, DynamicError, sleep } from '@dynamic-labs/utils';
 import '@dynamic-labs-sdk/client/core';
 import 'eventemitter3';
 import '../../../config/ApiEndpoint.js';
@@ -69,6 +69,7 @@ const useUserAuth = ({ authMethod, }) => {
             error instanceof CustomFieldNotUniqueError ||
             error instanceof UsernameAlreadyExistsError ||
             error instanceof TooManyEmailVerificationsError ||
+            error instanceof PhoneNumberAlreadyLinkedError ||
             error instanceof InvalidPhoneNumberError)
             throw error;
         if (error instanceof NoAccessError) {

package/src/lib/utils/hooks/useUserDataForm/useUserDataForm.cjs

@@ -136,6 +136,9 @@ const useUserDataForm = ({ onSubmit, onError, userProfile, shouldEnforcePolicies
             else if (e instanceof utils.UsernameAlreadyExistsError) {
                 formikHelper.setErrors({ username: 'Username already exists' });
             }
+            else if (e instanceof utils.PhoneNumberAlreadyLinkedError) {
+                formikHelper.setErrors({ phoneNumber: e.message });
+            }
             else if (e instanceof utils.InvalidPhoneNumberError) {
                 formikHelper.setErrors({ phoneNumber: e.message });
             }

package/src/lib/utils/hooks/useUserDataForm/useUserDataForm.js

@@ -3,7 +3,7 @@ import { __awaiter } from '../../../../../_virtual/_tslib.js';
 import { useState, useMemo, useCallback } from 'react';
 import { object } from 'yup';
 import { KycFieldType, CustomFieldType } from '@dynamic-labs/sdk-api-core';
-import { DynamicError, EmailAlreadyExistsError, CustomFieldNotUniqueError, TooManyEmailVerificationsError, UsernameAlreadyExistsError, InvalidPhoneNumberError } from '@dynamic-labs/utils';
+import { DynamicError, EmailAlreadyExistsError, CustomFieldNotUniqueError, TooManyEmailVerificationsError, UsernameAlreadyExistsError, PhoneNumberAlreadyLinkedError, InvalidPhoneNumberError } from '@dynamic-labs/utils';
 import { useMockContext } from '../../../context/MockContext/MockContext.js';
 import '@dynamic-labs/iconic';
 import '@dynamic-labs/wallet-connector-core';
@@ -132,6 +132,9 @@ const useUserDataForm = ({ onSubmit, onError, userProfile, shouldEnforcePolicies
             else if (e instanceof UsernameAlreadyExistsError) {
                 formikHelper.setErrors({ username: 'Username already exists' });
             }
+            else if (e instanceof PhoneNumberAlreadyLinkedError) {
+                formikHelper.setErrors({ phoneNumber: e.message });
+            }
             else if (e instanceof InvalidPhoneNumberError) {
                 formikHelper.setErrors({ phoneNumber: e.message });
             }

package/src/lib/views/MergeUserAccountsWithSameEmailView/MergeUserAccountsWithSameEmailView.cjs

@@ -35,8 +35,8 @@ require('eventemitter3');
 require('@dynamic-labs-sdk/client');
 require('../../config/ApiEndpoint.cjs');
 require('@dynamic-labs/locale');
-var user = require('../../data/api/user/user.cjs');
 require('../../store/state/dynamicContextProps/dynamicContextProps.cjs');
+var user = require('../../data/api/user/user.cjs');
 require('../../store/state/primaryWalletId/primaryWalletId.cjs');
 require('../../store/state/connectedWalletsInfo/connectedWalletsInfo.cjs');
 require('../../utils/functions/getWaasAddressTypeLabel/getWaasAddressTypeLabel.cjs');

package/src/lib/views/MergeUserAccountsWithSameEmailView/MergeUserAccountsWithSameEmailView.js

@@ -31,8 +31,8 @@ import 'eventemitter3';
 import '@dynamic-labs-sdk/client';
 import '../../config/ApiEndpoint.js';
 import '@dynamic-labs/locale';
-import { mergeUserAccounts } from '../../data/api/user/user.js';
 import '../../store/state/dynamicContextProps/dynamicContextProps.js';
+import { mergeUserAccounts } from '../../data/api/user/user.js';
 import '../../store/state/primaryWalletId/primaryWalletId.js';
 import '../../store/state/connectedWalletsInfo/connectedWalletsInfo.js';
 import '../../utils/functions/getWaasAddressTypeLabel/getWaasAddressTypeLabel.js';