@dynamic-labs-sdk/client 1.32.0 → 1.33.0

package/dist/{isMfaRequiredForAction-BPEXPqSt.esm.js → isMfaRequiredForAction-BdU62usM.esm.js}

@@ -1,4 +1,4 @@
-import { St as getCore, c as createApiClient, mt as assertDefined, u as instrumentFunction, yt as getDefaultClient } from "./logoutWithReason-x8mE7EAy.esm.js";
+import { c as createApiClient, d as instrumentFunction, gt as assertDefined, u as resolveInstrumentationCore, wt as getCore, xt as getDefaultClient } from "./logoutWithReason-I6vShLpA.esm.js";
 
 //#region src/modules/mfa/consumeMfaToken/consumeMfaToken.ts
 /**
@@ -23,13 +23,7 @@ const __consumeMfaToken_impl = consumeMfaToken;
 const __consumeMfaToken_wrapped = instrumentFunction({
 	fn: __consumeMfaToken_impl,
 	functionName: "consumeMfaToken",
-	getCore: () => {
-		try {
-			return getCore(getDefaultClient());
-		} catch {
-			return;
-		}
-	}
+	getCore: resolveInstrumentationCore
 });
 
 //#endregion
@@ -74,4 +68,4 @@ const isMfaRequiredForAction = async ({ mfaAction }, client = getDefaultClient()
 
 //#endregion
 export { getMfaMethods as n, __consumeMfaToken_wrapped as r, isMfaRequiredForAction as t };
-//# sourceMappingURL=isMfaRequiredForAction-BPEXPqSt.esm.js.map
+//# sourceMappingURL=isMfaRequiredForAction-BdU62usM.esm.js.map

package/dist/{isMfaRequiredForAction-BPEXPqSt.esm.js.map → isMfaRequiredForAction-BdU62usM.esm.js.map}

@@ -1 +1 @@
-{"version":3,"file":"isMfaRequiredForAction-BPEXPqSt.esm.js","names":[],"sources":["../src/modules/mfa/consumeMfaToken/consumeMfaToken.ts","../src/modules/mfa/getMfaMethods/getMfaMethods.ts","../src/modules/mfa/isMfaRequiredForAction/isMfaRequiredForAction.ts"],"sourcesContent":["import { getCore } from '../../../client/core/getCore';\nimport { getDefaultClient } from '../../../client/defaultClient';\nimport { assertDefined } from '../../../utils/assertDefined';\n\n/**\n * Consumes and clears the current MFA token from the client state.\n *\n * This function retrieves the MFA token obtained from a successful MFA authentication,\n * and removes it from the client, to prevent it from being used again.\n *\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns The MFA token that was consumed.\n * @throws Error if no MFA token is found.\n * @instrumented\n */\nexport const consumeMfaToken = (client = getDefaultClient()): string => {\n  const core = getCore(client);\n\n  const mfaToken = core.state.get().mfaToken;\n\n  assertDefined(mfaToken, 'No MFA token found');\n\n  core.state.set({\n    mfaToken: null,\n  });\n\n  return mfaToken;\n};\n","import { getCore } from '../../../client/core/getCore';\nimport { getDefaultClient } from '../../../client/defaultClient';\nimport { createApiClient } from '../../apiClient';\nimport type { MFAMethodsResponse } from '../mfa.types';\n\n/**\n * Retrieves the available MFA methods for the current user.\n *\n * This function fetches information about which multi-factor authentication\n * methods are available and configured for the user's account.\n *\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns A promise that resolves to the user's MFA methods configuration.\n * @notInstrumented\n */\nexport const getMfaMethods = async (\n  client = getDefaultClient()\n): Promise<MFAMethodsResponse> => {\n  const core = getCore(client);\n  const apiClient = createApiClient({}, client);\n\n  const userMfaMethods = await apiClient.getUserMfaMethods({\n    environmentId: core.environmentId,\n    verifiedOnly: true,\n  });\n\n  return userMfaMethods;\n};\n","import { getDefaultClient } from '../../../client/defaultClient';\nimport type { MFAAction } from '../mfa.consts';\nimport { getMfaMethods } from '../getMfaMethods';\n\ntype IsMfaRequiredForActionParams = {\n  mfaAction: MFAAction;\n};\n\n/**\n * Checks if MFA is required for a specific action.\n *\n * This function determines whether multi-factor authentication is required\n * for the specified action based on project settings and user configuration.\n *\n * @param params.mfaAction - The action to check MFA requirements for.\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns A promise that resolves to true if MFA is required for the action, false otherwise.\n * @notInstrumented\n */\nexport const isMfaRequiredForAction = async (\n  { mfaAction }: IsMfaRequiredForActionParams,\n  client = getDefaultClient()\n): Promise<boolean> => {\n  const projectSettings = client.projectSettings;\n\n  const isRequiredForAction = projectSettings?.security?.mfa?.actions?.some(\n    (action) => action.action === mfaAction && action.required\n  );\n\n  // if mfa is not required for the action, return false\n  // no matter if general mfa is set to required or not\n  if (!isRequiredForAction) {\n    return false;\n  }\n\n  const isMfaMethodRequired = projectSettings?.security?.mfa?.required;\n\n  // if mfa is required for the action and also set as required in general, return true\n  if (isMfaMethodRequired) {\n    return true;\n  }\n\n  const mfaMethods = await getMfaMethods(client);\n  // if general mfa is optional, but user has registered methods,\n  // then it should be required for the action\n  return mfaMethods.userHasVerifiedMfaMethods;\n};\n"],"mappings":";;;;;;;;;;;;;;AAkBA,MAAE,mBAAsB,SAAU,kBAAU,KAAA;;;AAK1C,eAAY,UAAI,qBAAA;kBAGhB,UAAO,MACR,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;ACZD,MAAa,gBAAgB,OAC3B,SAAS,kBAAkB,KACK;CAChC,MAAM,OAAO,QAAQ,OAAO;AAQ5B,QALuB,MAFL,gBAAgB,EAAE,EAAE,OAAO,CAEN,kBAAkB;EACvD,eAAe,KAAK;EACpB,cAAc;EACf,CAAC;;;;;;;;;;;;;;;;ACLJ,MAAa,yBAAyB,OACpC,EAAE,aACF,SAAS,kBAAkB,KACN;CACrB,MAAM,kBAAkB,OAAO;AAQ/B,KAAI,CANwB,iBAAiB,UAAU,KAAK,SAAS,MAClE,WAAW,OAAO,WAAW,aAAa,OAAO,SACnD,CAKC,QAAO;AAMT,KAH4B,iBAAiB,UAAU,KAAK,SAI1D,QAAO;AAMT,SAHmB,MAAM,cAAc,OAAO,EAG5B"}
+{"version":3,"file":"isMfaRequiredForAction-BdU62usM.esm.js","names":[],"sources":["../src/modules/mfa/consumeMfaToken/consumeMfaToken.ts","../src/modules/mfa/getMfaMethods/getMfaMethods.ts","../src/modules/mfa/isMfaRequiredForAction/isMfaRequiredForAction.ts"],"sourcesContent":["import { getCore } from '../../../client/core/getCore';\nimport { getDefaultClient } from '../../../client/defaultClient';\nimport { assertDefined } from '../../../utils/assertDefined';\n\n/**\n * Consumes and clears the current MFA token from the client state.\n *\n * This function retrieves the MFA token obtained from a successful MFA authentication,\n * and removes it from the client, to prevent it from being used again.\n *\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns The MFA token that was consumed.\n * @throws Error if no MFA token is found.\n * @instrumented\n */\nexport const consumeMfaToken = (client = getDefaultClient()): string => {\n  const core = getCore(client);\n\n  const mfaToken = core.state.get().mfaToken;\n\n  assertDefined(mfaToken, 'No MFA token found');\n\n  core.state.set({\n    mfaToken: null,\n  });\n\n  return mfaToken;\n};\n","import { getCore } from '../../../client/core/getCore';\nimport { getDefaultClient } from '../../../client/defaultClient';\nimport { createApiClient } from '../../apiClient';\nimport type { MFAMethodsResponse } from '../mfa.types';\n\n/**\n * Retrieves the available MFA methods for the current user.\n *\n * This function fetches information about which multi-factor authentication\n * methods are available and configured for the user's account.\n *\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns A promise that resolves to the user's MFA methods configuration.\n * @notInstrumented\n */\nexport const getMfaMethods = async (\n  client = getDefaultClient()\n): Promise<MFAMethodsResponse> => {\n  const core = getCore(client);\n  const apiClient = createApiClient({}, client);\n\n  const userMfaMethods = await apiClient.getUserMfaMethods({\n    environmentId: core.environmentId,\n    verifiedOnly: true,\n  });\n\n  return userMfaMethods;\n};\n","import { getDefaultClient } from '../../../client/defaultClient';\nimport type { MFAAction } from '../mfa.consts';\nimport { getMfaMethods } from '../getMfaMethods';\n\ntype IsMfaRequiredForActionParams = {\n  mfaAction: MFAAction;\n};\n\n/**\n * Checks if MFA is required for a specific action.\n *\n * This function determines whether multi-factor authentication is required\n * for the specified action based on project settings and user configuration.\n *\n * @param params.mfaAction - The action to check MFA requirements for.\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns A promise that resolves to true if MFA is required for the action, false otherwise.\n * @notInstrumented\n */\nexport const isMfaRequiredForAction = async (\n  { mfaAction }: IsMfaRequiredForActionParams,\n  client = getDefaultClient()\n): Promise<boolean> => {\n  const projectSettings = client.projectSettings;\n\n  const isRequiredForAction = projectSettings?.security?.mfa?.actions?.some(\n    (action) => action.action === mfaAction && action.required\n  );\n\n  // if mfa is not required for the action, return false\n  // no matter if general mfa is set to required or not\n  if (!isRequiredForAction) {\n    return false;\n  }\n\n  const isMfaMethodRequired = projectSettings?.security?.mfa?.required;\n\n  // if mfa is required for the action and also set as required in general, return true\n  if (isMfaMethodRequired) {\n    return true;\n  }\n\n  const mfaMethods = await getMfaMethods(client);\n  // if general mfa is optional, but user has registered methods,\n  // then it should be required for the action\n  return mfaMethods.userHasVerifiedMfaMethods;\n};\n"],"mappings":";;;;;;;;;;;;;;;CAkBE,MAAM,OAAA,QAAe,OAAO;CAE5B,MAAA,WAAc,KAAQ,MAAM,KAAI,CAAA;AAEhC,eAAc,UAAC,qBAAA;AAEf,MAAE,MAAA,IAAA,kBAEF,CAAA;;;;;;;;;;;;;;;;;;;;;;ACXF,MAAa,gBAAgB,OAC3B,SAAS,kBAAkB,KACK;CAChC,MAAM,OAAO,QAAQ,OAAO;AAQ5B,QALuB,MAFL,gBAAgB,EAAE,EAAE,OAAO,CAEN,kBAAkB;EACvD,eAAe,KAAK;EACpB,cAAc;EACf,CAAC;;;;;;;;;;;;;;;;ACLJ,MAAa,yBAAyB,OACpC,EAAE,aACF,SAAS,kBAAkB,KACN;CACrB,MAAM,kBAAkB,OAAO;AAQ/B,KAAI,CANwB,iBAAiB,UAAU,KAAK,SAAS,MAClE,WAAW,OAAO,WAAW,aAAa,OAAO,SACnD,CAKC,QAAO;AAMT,KAH4B,iBAAiB,UAAU,KAAK,SAI1D,QAAO;AAMT,SAHmB,MAAM,cAAc,OAAO,EAG5B"}

package/dist/{isMfaRequiredForAction-DfrEFvU2.native.esm.js → isMfaRequiredForAction-DZfEkyIU.native.esm.js}

@@ -1,4 +1,4 @@
-import { St as BaseError, a as instrumentFunction, pt as assertDefined, r as createApiClient, vt as getDefaultClient, xt as getCore } from "./apiClient-Bwd6cllS.native.esm.js";
+import { Ct as getCore, a as resolveInstrumentationCore, bt as getDefaultClient, ht as assertDefined, o as instrumentFunction, r as createApiClient, wt as BaseError } from "./apiClient-4r7VAsLC.native.esm.js";
 
 //#region src/errors/NativeModuleNotLinkedError.ts
 var NativeModuleNotLinkedError = class extends BaseError {
@@ -52,13 +52,7 @@ const __consumeMfaToken_impl = consumeMfaToken;
 const __consumeMfaToken_wrapped = instrumentFunction({
 	fn: __consumeMfaToken_impl,
 	functionName: "consumeMfaToken",
-	getCore: () => {
-		try {
-			return getCore(getDefaultClient());
-		} catch {
-			return;
-		}
-	}
+	getCore: resolveInstrumentationCore
 });
 
 //#endregion
@@ -103,4 +97,4 @@ const isMfaRequiredForAction = async ({ mfaAction }, client = getDefaultClient()
 
 //#endregion
 export { NativeModuleNotLinkedError as i, getMfaMethods as n, __consumeMfaToken_wrapped as r, isMfaRequiredForAction as t };
-//# sourceMappingURL=isMfaRequiredForAction-DfrEFvU2.native.esm.js.map
+//# sourceMappingURL=isMfaRequiredForAction-DZfEkyIU.native.esm.js.map

package/dist/{isMfaRequiredForAction-DfrEFvU2.native.esm.js.map → isMfaRequiredForAction-DZfEkyIU.native.esm.js.map}

@@ -1 +1 @@
-{"version":3,"file":"isMfaRequiredForAction-DfrEFvU2.native.esm.js","names":[],"sources":["../src/errors/NativeModuleNotLinkedError.ts","../src/modules/mfa/consumeMfaToken/consumeMfaToken.ts","../src/modules/mfa/getMfaMethods/getMfaMethods.ts","../src/modules/mfa/isMfaRequiredForAction/isMfaRequiredForAction.ts"],"sourcesContent":["import { BaseError } from './base';\n\ntype NativeModuleNotLinkedErrorParams = {\n  moduleName: string;\n};\n\nexport class NativeModuleNotLinkedError extends BaseError {\n  constructor({ moduleName }: NativeModuleNotLinkedErrorParams) {\n    super({\n      cause: null,\n      code: 'native_module_not_linked_error',\n      details: [\n        `The \"${moduleName}\" TurboModule is not registered with React Native.`,\n        'This usually means the native module was not autolinked into the host app,',\n        'or the app binary was not rebuilt after installing the SDK.',\n        '',\n        'To resolve:',\n        '  1. Ensure \"@dynamic-labs-sdk/client\" is a direct dependency of the app',\n        '     and reinstall (e.g. `pnpm install`).',\n        '  2. Rebuild the native app:',\n        '       iOS:     `cd ios && pod install && cd .. && npx react-native run-ios`',\n        '       Android: `npx react-native run-android`',\n        '       Expo:    `npx expo prebuild --clean` then run the app.',\n        '  3. Confirm autolinking sees the package:',\n        '       `npx expo-modules-autolinking react-native-config --json`',\n      ].join('\\n'),\n      docsUrl: null,\n      name: 'NativeModuleNotLinkedError',\n      shortMessage: `Native TurboModule \"${moduleName}\" is not linked.`,\n    });\n  }\n}\n","import { getCore } from '../../../client/core/getCore';\nimport { getDefaultClient } from '../../../client/defaultClient';\nimport { assertDefined } from '../../../utils/assertDefined';\n\n/**\n * Consumes and clears the current MFA token from the client state.\n *\n * This function retrieves the MFA token obtained from a successful MFA authentication,\n * and removes it from the client, to prevent it from being used again.\n *\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns The MFA token that was consumed.\n * @throws Error if no MFA token is found.\n * @instrumented\n */\nexport const consumeMfaToken = (client = getDefaultClient()): string => {\n  const core = getCore(client);\n\n  const mfaToken = core.state.get().mfaToken;\n\n  assertDefined(mfaToken, 'No MFA token found');\n\n  core.state.set({\n    mfaToken: null,\n  });\n\n  return mfaToken;\n};\n","import { getCore } from '../../../client/core/getCore';\nimport { getDefaultClient } from '../../../client/defaultClient';\nimport { createApiClient } from '../../apiClient';\nimport type { MFAMethodsResponse } from '../mfa.types';\n\n/**\n * Retrieves the available MFA methods for the current user.\n *\n * This function fetches information about which multi-factor authentication\n * methods are available and configured for the user's account.\n *\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns A promise that resolves to the user's MFA methods configuration.\n * @notInstrumented\n */\nexport const getMfaMethods = async (\n  client = getDefaultClient()\n): Promise<MFAMethodsResponse> => {\n  const core = getCore(client);\n  const apiClient = createApiClient({}, client);\n\n  const userMfaMethods = await apiClient.getUserMfaMethods({\n    environmentId: core.environmentId,\n    verifiedOnly: true,\n  });\n\n  return userMfaMethods;\n};\n","import { getDefaultClient } from '../../../client/defaultClient';\nimport type { MFAAction } from '../mfa.consts';\nimport { getMfaMethods } from '../getMfaMethods';\n\ntype IsMfaRequiredForActionParams = {\n  mfaAction: MFAAction;\n};\n\n/**\n * Checks if MFA is required for a specific action.\n *\n * This function determines whether multi-factor authentication is required\n * for the specified action based on project settings and user configuration.\n *\n * @param params.mfaAction - The action to check MFA requirements for.\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns A promise that resolves to true if MFA is required for the action, false otherwise.\n * @notInstrumented\n */\nexport const isMfaRequiredForAction = async (\n  { mfaAction }: IsMfaRequiredForActionParams,\n  client = getDefaultClient()\n): Promise<boolean> => {\n  const projectSettings = client.projectSettings;\n\n  const isRequiredForAction = projectSettings?.security?.mfa?.actions?.some(\n    (action) => action.action === mfaAction && action.required\n  );\n\n  // if mfa is not required for the action, return false\n  // no matter if general mfa is set to required or not\n  if (!isRequiredForAction) {\n    return false;\n  }\n\n  const isMfaMethodRequired = projectSettings?.security?.mfa?.required;\n\n  // if mfa is required for the action and also set as required in general, return true\n  if (isMfaMethodRequired) {\n    return true;\n  }\n\n  const mfaMethods = await getMfaMethods(client);\n  // if general mfa is optional, but user has registered methods,\n  // then it should be required for the action\n  return mfaMethods.userHasVerifiedMfaMethods;\n};\n"],"mappings":";;;AAMA,IAAa,6BAAb,cAAgD,UAAU;CACxD,YAAY,EAAE,cAAgD;AAC5D,QAAM;GACJ,OAAO;GACP,MAAM;GACN,SAAS;IACP,QAAQ,WAAW;IACnB;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACD,CAAC,KAAK,KAAK;GACZ,SAAS;GACT,MAAM;GACN,cAAc,uBAAuB,WAAW;GACjD,CAAC;;;;;;;;;;;;;;;;;ACXN,MAAE,mBAAsB,SAAU,kBAAU,KAAA;;;AAK1C,eAAY,UAAI,qBAAA;kBAGhB,UAAO,MACR,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;ACZD,MAAa,gBAAgB,OAC3B,SAAS,kBAAkB,KACK;CAChC,MAAM,OAAO,QAAQ,OAAO;AAQ5B,QALuB,MAFL,gBAAgB,EAAE,EAAE,OAAO,CAEN,kBAAkB;EACvD,eAAe,KAAK;EACpB,cAAc;EACf,CAAC;;;;;;;;;;;;;;;;ACLJ,MAAa,yBAAyB,OACpC,EAAE,aACF,SAAS,kBAAkB,KACN;CACrB,MAAM,kBAAkB,OAAO;AAQ/B,KAAI,CANwB,iBAAiB,UAAU,KAAK,SAAS,MAClE,WAAW,OAAO,WAAW,aAAa,OAAO,SACnD,CAKC,QAAO;AAMT,KAH4B,iBAAiB,UAAU,KAAK,SAI1D,QAAO;AAMT,SAHmB,MAAM,cAAc,OAAO,EAG5B"}
+{"version":3,"file":"isMfaRequiredForAction-DZfEkyIU.native.esm.js","names":[],"sources":["../src/errors/NativeModuleNotLinkedError.ts","../src/modules/mfa/consumeMfaToken/consumeMfaToken.ts","../src/modules/mfa/getMfaMethods/getMfaMethods.ts","../src/modules/mfa/isMfaRequiredForAction/isMfaRequiredForAction.ts"],"sourcesContent":["import { BaseError } from './base';\n\ntype NativeModuleNotLinkedErrorParams = {\n  moduleName: string;\n};\n\nexport class NativeModuleNotLinkedError extends BaseError {\n  constructor({ moduleName }: NativeModuleNotLinkedErrorParams) {\n    super({\n      cause: null,\n      code: 'native_module_not_linked_error',\n      details: [\n        `The \"${moduleName}\" TurboModule is not registered with React Native.`,\n        'This usually means the native module was not autolinked into the host app,',\n        'or the app binary was not rebuilt after installing the SDK.',\n        '',\n        'To resolve:',\n        '  1. Ensure \"@dynamic-labs-sdk/client\" is a direct dependency of the app',\n        '     and reinstall (e.g. `pnpm install`).',\n        '  2. Rebuild the native app:',\n        '       iOS:     `cd ios && pod install && cd .. && npx react-native run-ios`',\n        '       Android: `npx react-native run-android`',\n        '       Expo:    `npx expo prebuild --clean` then run the app.',\n        '  3. Confirm autolinking sees the package:',\n        '       `npx expo-modules-autolinking react-native-config --json`',\n      ].join('\\n'),\n      docsUrl: null,\n      name: 'NativeModuleNotLinkedError',\n      shortMessage: `Native TurboModule \"${moduleName}\" is not linked.`,\n    });\n  }\n}\n","import { getCore } from '../../../client/core/getCore';\nimport { getDefaultClient } from '../../../client/defaultClient';\nimport { assertDefined } from '../../../utils/assertDefined';\n\n/**\n * Consumes and clears the current MFA token from the client state.\n *\n * This function retrieves the MFA token obtained from a successful MFA authentication,\n * and removes it from the client, to prevent it from being used again.\n *\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns The MFA token that was consumed.\n * @throws Error if no MFA token is found.\n * @instrumented\n */\nexport const consumeMfaToken = (client = getDefaultClient()): string => {\n  const core = getCore(client);\n\n  const mfaToken = core.state.get().mfaToken;\n\n  assertDefined(mfaToken, 'No MFA token found');\n\n  core.state.set({\n    mfaToken: null,\n  });\n\n  return mfaToken;\n};\n","import { getCore } from '../../../client/core/getCore';\nimport { getDefaultClient } from '../../../client/defaultClient';\nimport { createApiClient } from '../../apiClient';\nimport type { MFAMethodsResponse } from '../mfa.types';\n\n/**\n * Retrieves the available MFA methods for the current user.\n *\n * This function fetches information about which multi-factor authentication\n * methods are available and configured for the user's account.\n *\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns A promise that resolves to the user's MFA methods configuration.\n * @notInstrumented\n */\nexport const getMfaMethods = async (\n  client = getDefaultClient()\n): Promise<MFAMethodsResponse> => {\n  const core = getCore(client);\n  const apiClient = createApiClient({}, client);\n\n  const userMfaMethods = await apiClient.getUserMfaMethods({\n    environmentId: core.environmentId,\n    verifiedOnly: true,\n  });\n\n  return userMfaMethods;\n};\n","import { getDefaultClient } from '../../../client/defaultClient';\nimport type { MFAAction } from '../mfa.consts';\nimport { getMfaMethods } from '../getMfaMethods';\n\ntype IsMfaRequiredForActionParams = {\n  mfaAction: MFAAction;\n};\n\n/**\n * Checks if MFA is required for a specific action.\n *\n * This function determines whether multi-factor authentication is required\n * for the specified action based on project settings and user configuration.\n *\n * @param params.mfaAction - The action to check MFA requirements for.\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns A promise that resolves to true if MFA is required for the action, false otherwise.\n * @notInstrumented\n */\nexport const isMfaRequiredForAction = async (\n  { mfaAction }: IsMfaRequiredForActionParams,\n  client = getDefaultClient()\n): Promise<boolean> => {\n  const projectSettings = client.projectSettings;\n\n  const isRequiredForAction = projectSettings?.security?.mfa?.actions?.some(\n    (action) => action.action === mfaAction && action.required\n  );\n\n  // if mfa is not required for the action, return false\n  // no matter if general mfa is set to required or not\n  if (!isRequiredForAction) {\n    return false;\n  }\n\n  const isMfaMethodRequired = projectSettings?.security?.mfa?.required;\n\n  // if mfa is required for the action and also set as required in general, return true\n  if (isMfaMethodRequired) {\n    return true;\n  }\n\n  const mfaMethods = await getMfaMethods(client);\n  // if general mfa is optional, but user has registered methods,\n  // then it should be required for the action\n  return mfaMethods.userHasVerifiedMfaMethods;\n};\n"],"mappings":";;;AAMA,IAAa,6BAAb,cAAgD,UAAU;CACxD,YAAY,EAAE,cAAgD;AAC5D,QAAM;GACJ,OAAO;GACP,MAAM;GACN,SAAS;IACP,QAAQ,WAAW;IACnB;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACD,CAAC,KAAK,KAAK;GACZ,SAAS;GACT,MAAM;GACN,cAAc,uBAAuB,WAAW;GACjD,CAAC;;;;;;;;;;;;;;;;;;CCXJ,MAAM,OAAA,QAAe,OAAO;CAE5B,MAAA,WAAc,KAAQ,MAAM,KAAI,CAAA;AAEhC,eAAc,UAAC,qBAAA;AAEf,MAAE,MAAA,IAAA,kBAEF,CAAA;;;;;;;;;;;;;;;;;;;;;;ACXF,MAAa,gBAAgB,OAC3B,SAAS,kBAAkB,KACK;CAChC,MAAM,OAAO,QAAQ,OAAO;AAQ5B,QALuB,MAFL,gBAAgB,EAAE,EAAE,OAAO,CAEN,kBAAkB;EACvD,eAAe,KAAK;EACpB,cAAc;EACf,CAAC;;;;;;;;;;;;;;;;ACLJ,MAAa,yBAAyB,OACpC,EAAE,aACF,SAAS,kBAAkB,KACN;CACrB,MAAM,kBAAkB,OAAO;AAQ/B,KAAI,CANwB,iBAAiB,UAAU,KAAK,SAAS,MAClE,WAAW,OAAO,WAAW,aAAa,OAAO,SACnD,CAKC,QAAO;AAMT,KAH4B,iBAAiB,UAAU,KAAK,SAI1D,QAAO;AAMT,SAHmB,MAAM,cAAc,OAAO,EAG5B"}

package/dist/{isMfaRequiredForAction-62zh3W-2.cjs → isMfaRequiredForAction-Djd-jkSl.cjs}

@@ -1,4 +1,4 @@
-const require_logoutWithReason = require('./logoutWithReason-yDqQ0UIt.cjs');
+const require_logoutWithReason = require('./logoutWithReason-B-ZF0VmN.cjs');
 
 //#region src/modules/mfa/consumeMfaToken/consumeMfaToken.ts
 /**
@@ -23,13 +23,7 @@ const __consumeMfaToken_impl = consumeMfaToken;
 const __consumeMfaToken_wrapped = require_logoutWithReason.instrumentFunction({
 	fn: __consumeMfaToken_impl,
 	functionName: "consumeMfaToken",
-	getCore: () => {
-		try {
-			return require_logoutWithReason.getCore(require_logoutWithReason.getDefaultClient());
-		} catch {
-			return;
-		}
-	}
+	getCore: require_logoutWithReason.resolveInstrumentationCore
 });
 
 //#endregion
@@ -91,4 +85,4 @@ Object.defineProperty(exports, 'isMfaRequiredForAction', {
     return isMfaRequiredForAction;
   }
 });
-//# sourceMappingURL=isMfaRequiredForAction-62zh3W-2.cjs.map
+//# sourceMappingURL=isMfaRequiredForAction-Djd-jkSl.cjs.map

package/dist/{isMfaRequiredForAction-62zh3W-2.cjs.map → isMfaRequiredForAction-Djd-jkSl.cjs.map}

@@ -1 +1 @@
-{"version":3,"file":"isMfaRequiredForAction-62zh3W-2.cjs","names":["getDefaultClient","getCore","createApiClient","getDefaultClient"],"sources":["../src/modules/mfa/consumeMfaToken/consumeMfaToken.ts","../src/modules/mfa/getMfaMethods/getMfaMethods.ts","../src/modules/mfa/isMfaRequiredForAction/isMfaRequiredForAction.ts"],"sourcesContent":["import { getCore } from '../../../client/core/getCore';\nimport { getDefaultClient } from '../../../client/defaultClient';\nimport { assertDefined } from '../../../utils/assertDefined';\n\n/**\n * Consumes and clears the current MFA token from the client state.\n *\n * This function retrieves the MFA token obtained from a successful MFA authentication,\n * and removes it from the client, to prevent it from being used again.\n *\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns The MFA token that was consumed.\n * @throws Error if no MFA token is found.\n * @instrumented\n */\nexport const consumeMfaToken = (client = getDefaultClient()): string => {\n  const core = getCore(client);\n\n  const mfaToken = core.state.get().mfaToken;\n\n  assertDefined(mfaToken, 'No MFA token found');\n\n  core.state.set({\n    mfaToken: null,\n  });\n\n  return mfaToken;\n};\n","import { getCore } from '../../../client/core/getCore';\nimport { getDefaultClient } from '../../../client/defaultClient';\nimport { createApiClient } from '../../apiClient';\nimport type { MFAMethodsResponse } from '../mfa.types';\n\n/**\n * Retrieves the available MFA methods for the current user.\n *\n * This function fetches information about which multi-factor authentication\n * methods are available and configured for the user's account.\n *\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns A promise that resolves to the user's MFA methods configuration.\n * @notInstrumented\n */\nexport const getMfaMethods = async (\n  client = getDefaultClient()\n): Promise<MFAMethodsResponse> => {\n  const core = getCore(client);\n  const apiClient = createApiClient({}, client);\n\n  const userMfaMethods = await apiClient.getUserMfaMethods({\n    environmentId: core.environmentId,\n    verifiedOnly: true,\n  });\n\n  return userMfaMethods;\n};\n","import { getDefaultClient } from '../../../client/defaultClient';\nimport type { MFAAction } from '../mfa.consts';\nimport { getMfaMethods } from '../getMfaMethods';\n\ntype IsMfaRequiredForActionParams = {\n  mfaAction: MFAAction;\n};\n\n/**\n * Checks if MFA is required for a specific action.\n *\n * This function determines whether multi-factor authentication is required\n * for the specified action based on project settings and user configuration.\n *\n * @param params.mfaAction - The action to check MFA requirements for.\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns A promise that resolves to true if MFA is required for the action, false otherwise.\n * @notInstrumented\n */\nexport const isMfaRequiredForAction = async (\n  { mfaAction }: IsMfaRequiredForActionParams,\n  client = getDefaultClient()\n): Promise<boolean> => {\n  const projectSettings = client.projectSettings;\n\n  const isRequiredForAction = projectSettings?.security?.mfa?.actions?.some(\n    (action) => action.action === mfaAction && action.required\n  );\n\n  // if mfa is not required for the action, return false\n  // no matter if general mfa is set to required or not\n  if (!isRequiredForAction) {\n    return false;\n  }\n\n  const isMfaMethodRequired = projectSettings?.security?.mfa?.required;\n\n  // if mfa is required for the action and also set as required in general, return true\n  if (isMfaMethodRequired) {\n    return true;\n  }\n\n  const mfaMethods = await getMfaMethods(client);\n  // if general mfa is optional, but user has registered methods,\n  // then it should be required for the action\n  return mfaMethods.userHasVerifiedMfaMethods;\n};\n"],"mappings":";;;;;;;;;;;;;;AAkBA,MAAE,mBAAsB,SAAU,2CAAU,KAAA;;;AAK1C,wCAAY,UAAI,qBAAA;kBAGhB,UAAO,MACR,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;ACZD,MAAa,gBAAgB,OAC3B,SAASA,2CAAkB,KACK;CAChC,MAAM,OAAOC,iCAAQ,OAAO;AAQ5B,QALuB,MAFLC,yCAAgB,EAAE,EAAE,OAAO,CAEN,kBAAkB;EACvD,eAAe,KAAK;EACpB,cAAc;EACf,CAAC;;;;;;;;;;;;;;;;ACLJ,MAAa,yBAAyB,OACpC,EAAE,aACF,SAASC,2CAAkB,KACN;CACrB,MAAM,kBAAkB,OAAO;AAQ/B,KAAI,CANwB,iBAAiB,UAAU,KAAK,SAAS,MAClE,WAAW,OAAO,WAAW,aAAa,OAAO,SACnD,CAKC,QAAO;AAMT,KAH4B,iBAAiB,UAAU,KAAK,SAI1D,QAAO;AAMT,SAHmB,MAAM,cAAc,OAAO,EAG5B"}
+{"version":3,"file":"isMfaRequiredForAction-Djd-jkSl.cjs","names":["getDefaultClient","getCore","createApiClient","getDefaultClient"],"sources":["../src/modules/mfa/consumeMfaToken/consumeMfaToken.ts","../src/modules/mfa/getMfaMethods/getMfaMethods.ts","../src/modules/mfa/isMfaRequiredForAction/isMfaRequiredForAction.ts"],"sourcesContent":["import { getCore } from '../../../client/core/getCore';\nimport { getDefaultClient } from '../../../client/defaultClient';\nimport { assertDefined } from '../../../utils/assertDefined';\n\n/**\n * Consumes and clears the current MFA token from the client state.\n *\n * This function retrieves the MFA token obtained from a successful MFA authentication,\n * and removes it from the client, to prevent it from being used again.\n *\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns The MFA token that was consumed.\n * @throws Error if no MFA token is found.\n * @instrumented\n */\nexport const consumeMfaToken = (client = getDefaultClient()): string => {\n  const core = getCore(client);\n\n  const mfaToken = core.state.get().mfaToken;\n\n  assertDefined(mfaToken, 'No MFA token found');\n\n  core.state.set({\n    mfaToken: null,\n  });\n\n  return mfaToken;\n};\n","import { getCore } from '../../../client/core/getCore';\nimport { getDefaultClient } from '../../../client/defaultClient';\nimport { createApiClient } from '../../apiClient';\nimport type { MFAMethodsResponse } from '../mfa.types';\n\n/**\n * Retrieves the available MFA methods for the current user.\n *\n * This function fetches information about which multi-factor authentication\n * methods are available and configured for the user's account.\n *\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns A promise that resolves to the user's MFA methods configuration.\n * @notInstrumented\n */\nexport const getMfaMethods = async (\n  client = getDefaultClient()\n): Promise<MFAMethodsResponse> => {\n  const core = getCore(client);\n  const apiClient = createApiClient({}, client);\n\n  const userMfaMethods = await apiClient.getUserMfaMethods({\n    environmentId: core.environmentId,\n    verifiedOnly: true,\n  });\n\n  return userMfaMethods;\n};\n","import { getDefaultClient } from '../../../client/defaultClient';\nimport type { MFAAction } from '../mfa.consts';\nimport { getMfaMethods } from '../getMfaMethods';\n\ntype IsMfaRequiredForActionParams = {\n  mfaAction: MFAAction;\n};\n\n/**\n * Checks if MFA is required for a specific action.\n *\n * This function determines whether multi-factor authentication is required\n * for the specified action based on project settings and user configuration.\n *\n * @param params.mfaAction - The action to check MFA requirements for.\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns A promise that resolves to true if MFA is required for the action, false otherwise.\n * @notInstrumented\n */\nexport const isMfaRequiredForAction = async (\n  { mfaAction }: IsMfaRequiredForActionParams,\n  client = getDefaultClient()\n): Promise<boolean> => {\n  const projectSettings = client.projectSettings;\n\n  const isRequiredForAction = projectSettings?.security?.mfa?.actions?.some(\n    (action) => action.action === mfaAction && action.required\n  );\n\n  // if mfa is not required for the action, return false\n  // no matter if general mfa is set to required or not\n  if (!isRequiredForAction) {\n    return false;\n  }\n\n  const isMfaMethodRequired = projectSettings?.security?.mfa?.required;\n\n  // if mfa is required for the action and also set as required in general, return true\n  if (isMfaMethodRequired) {\n    return true;\n  }\n\n  const mfaMethods = await getMfaMethods(client);\n  // if general mfa is optional, but user has registered methods,\n  // then it should be required for the action\n  return mfaMethods.userHasVerifiedMfaMethods;\n};\n"],"mappings":";;;;;;;;;;;;;;;CAkBE,MAAM,OAAA,iCAAe,OAAO;CAE5B,MAAA,WAAc,KAAQ,MAAM,KAAI,CAAA;AAEhC,wCAAc,UAAC,qBAAA;AAEf,MAAE,MAAA,IAAA,kBAEF,CAAA;;;;;;;;;;;;;;;;;;;;;;ACXF,MAAa,gBAAgB,OAC3B,SAASA,2CAAkB,KACK;CAChC,MAAM,OAAOC,iCAAQ,OAAO;AAQ5B,QALuB,MAFLC,yCAAgB,EAAE,EAAE,OAAO,CAEN,kBAAkB;EACvD,eAAe,KAAK;EACpB,cAAc;EACf,CAAC;;;;;;;;;;;;;;;;ACLJ,MAAa,yBAAyB,OACpC,EAAE,aACF,SAASC,2CAAkB,KACN;CACrB,MAAM,kBAAkB,OAAO;AAQ/B,KAAI,CANwB,iBAAiB,UAAU,KAAK,SAAS,MAClE,WAAW,OAAO,WAAW,aAAa,OAAO,SACnD,CAKC,QAAO;AAMT,KAH4B,iBAAiB,UAAU,KAAK,SAI1D,QAAO;AAMT,SAHmB,MAAM,cAAc,OAAO,EAG5B"}

package/dist/{isUserOnboardingComplete-Dmck83_2.esm.js → isUserOnboardingComplete-BEZOYohA.esm.js}

@@ -1,5 +1,5 @@
-import { Ct as BaseError, D as DEFAULT_WAAS_BASE_API_URL, St as getCore, mt as assertDefined, pt as isCookieEnabled, q as isUserMissingMfaAuth, yt as getDefaultClient } from "./logoutWithReason-x8mE7EAy.esm.js";
-import { n as isDynamicWaasEnabled } from "./migrateFromFireblocks-BapjEhra.esm.js";
+import { J as isUserMissingMfaAuth, O as DEFAULT_WAAS_BASE_API_URL, Tt as BaseError, gt as assertDefined, ht as isCookieEnabled, wt as getCore, xt as getDefaultClient } from "./logoutWithReason-I6vShLpA.esm.js";
+import { n as isDynamicWaasEnabled } from "./migrateFromFireblocks-Dtk6t8hN.esm.js";
 import { MfaBackupCodeAcknowledgement } from "@dynamic-labs/sdk-api-core";
 import { preconnectWaasIframe } from "@dynamic-labs-wallet/browser-wallet-client";
 
@@ -211,4 +211,4 @@ const isUserOnboardingComplete = (client = getDefaultClient()) => {
 
 //#endregion
 export { WaasRbacStaleRetryUnsafeError as a, preconnectWaasIframe$1 as i, isPendingRecoveryCodesAcknowledgment as n, WaasOnboardingIncompleteError as o, isDeviceRegistrationRequired as r, WaasLoadFailedError as s, isUserOnboardingComplete as t };
-//# sourceMappingURL=isUserOnboardingComplete-Dmck83_2.esm.js.map
+//# sourceMappingURL=isUserOnboardingComplete-BEZOYohA.esm.js.map

package/dist/{isUserOnboardingComplete-Dmck83_2.esm.js.map → isUserOnboardingComplete-BEZOYohA.esm.js.map}

@@ -1 +1 @@
-{"version":3,"file":"isUserOnboardingComplete-Dmck83_2.esm.js","names":["preconnectWaasIframe"],"sources":["../src/errors/WaasLoadFailedError.ts","../src/errors/WaasOnboardingIncompleteError.ts","../src/errors/WaasRbacStaleRetryUnsafeError.ts","../src/modules/waas/preconnectWaasIframe/preconnectWaasIframe.ts","../src/modules/deviceRegistration/isDeviceRegistrationRequired/isDeviceRegistrationRequired.ts","../src/modules/mfa/isPendingRecoveryCodesAcknowledgment/isPendingRecoveryCodesAcknowledgment.ts","../src/modules/user/isUserOnboardingComplete/isUserOnboardingComplete.ts"],"sourcesContent":["import { BaseError } from './base';\n\n/**\n * Why the embedded wallet load failed. Currently only retry exhaustion is\n * reported; the union exists so new reasons can be added without a breaking\n * change to consumer `instanceof` handling.\n *\n * @example\n * ```ts\n * const reason: WaasLoadFailedErrorReason = 'load_attempts_exhausted';\n * ```\n * @see WaasLoadFailedError\n * @see signMessage\n */\nexport type WaasLoadFailedErrorReason = 'load_attempts_exhausted';\n\n/**\n * Thrown when the embedded (WaaS) wallet's secure container failed to load\n * after exhausting all of its internal retry attempts.\n *\n * This failure is transient: the next wallet operation triggers a fresh load\n * cycle, so hosts can catch this error and re-attempt the operation at their\n * own cadence (for example, when connectivity returns or the app is\n * foregrounded). Other load failures (for example, a CSP block) are not\n * wrapped by this error and their shape is not guaranteed.\n *\n * @example\n * ```ts\n * try {\n *   await signMessage({ message, walletAccount });\n * } catch (error) {\n *   if (error instanceof WaasLoadFailedError) {\n *     // transient — retry the operation at your own cadence\n *     await signMessage({ message, walletAccount });\n *   }\n * }\n * ```\n * @see WaasLoadFailedErrorReason\n * @see signMessage\n */\nexport class WaasLoadFailedError extends BaseError {\n  readonly reason: WaasLoadFailedErrorReason;\n\n  constructor({ cause }: { cause: Error }) {\n    super({\n      cause,\n      code: 'waas_load_failed',\n      docsUrl: null,\n      name: 'WaasLoadFailedError',\n      shortMessage:\n        'The embedded wallet failed to load after exhausting its retry attempts. Retrying the wallet operation triggers a fresh load.',\n    });\n    this.reason = 'load_attempts_exhausted';\n  }\n}\n","import { BaseError } from './base';\n\n/**\n * Thrown when the embedded (WaaS) wallet client is requested before the user\n * has completed onboarding — i.e. the JWT has not upgraded to `user:basic`\n * because MFA, KYC, recovery-codes acknowledgment, or device registration is\n * still pending.\n *\n * The WaaS iframe's init-time room-cache pre-warm fires `createRooms` using the\n * token captured at client construction (before any per-operation token\n * resync). Building the client during this window lets that pre-warm fire with\n * a pre-`user:basic` token, get a 401, and the iframe's unauthorized handler\n * force-logs-out the user. Throwing here surfaces a clear, recoverable reason\n * instead — wait for onboarding to complete and retry.\n */\nexport class WaasOnboardingIncompleteError extends BaseError {\n  constructor() {\n    super({\n      cause: null,\n      code: 'waas_onboarding_incomplete',\n      docsUrl: null,\n      name: 'WaasOnboardingIncompleteError',\n      shortMessage:\n        'Cannot create or access the embedded wallet until onboarding is complete (pending MFA, KYC, recovery-codes acknowledgment, or device registration).',\n    });\n  }\n}\n","import { BaseError } from './base';\n\n/**\n * Thrown when a WaaS ceremony operation (sign, export, reshare, create\n * wallet) receives a 403 `rbac_stale` response after the attempt has already\n * spent its one-time authorization — either the legacy MFA token or a\n * single-use elevated access token.\n *\n * The SDK cannot safely retry in that case: the restarted attempt would find\n * the approval already consumed and fail deeper in the stack with an\n * unrelated \"no MFA token\" error, hiding the permission change that actually\n * caused the failure. Surfacing this error instead tells the host exactly what\n * happened. Recover by re-running the step-up/MFA flow and retrying the\n * operation; the business-account role change has already taken effect, so the\n * retry is evaluated against the caller's current permissions.\n *\n * @example\n * ```ts\n * try {\n *   await signMessage({ message, walletAccount });\n * } catch (error) {\n *   if (error instanceof WaasRbacStaleRetryUnsafeError) {\n *     // The one-time approval was spent; re-verify before trying again.\n *     await promptStepUp();\n *     await signMessage({ message, walletAccount });\n *   }\n * }\n * ```\n * @see WaasLoadFailedError\n * @see signMessage\n */\nexport class WaasRbacStaleRetryUnsafeError extends BaseError {\n  constructor({ cause }: { cause: Error }) {\n    super({\n      cause,\n      code: 'waas_rbac_stale_retry_unsafe',\n      docsUrl: null,\n      name: 'WaasRbacStaleRetryUnsafeError',\n      shortMessage:\n        'The business account role change could not be retried automatically because a one-time authorization was already consumed. Re-authenticate and retry the operation.',\n    });\n  }\n}\n","import type { AuthMode } from '@dynamic-labs-wallet/browser-wallet-client';\nimport { preconnectWaasIframe as preconnectWaasIframeOrigin } from '@dynamic-labs-wallet/browser-wallet-client';\n\nimport { getCore } from '../../../client/core/getCore';\nimport type { DynamicClient } from '../../../client/types';\nimport { isCookieEnabled } from '../../projectSettings/isCookieEnabled';\nimport { DEFAULT_WAAS_BASE_API_URL } from '../constants';\nimport { isDynamicWaasEnabled } from '../isDynamicWaasEnabled';\n\n/**\n * Warms the browser's connection (DNS + TCP + TLS) to the embedded-wallet\n * iframe origin so the iframe mounted after authentication completes loads on\n * a hot connection. Called when an auth flow starts (OTP send/verify, social\n * callback). Safe to call repeatedly; no-op on React Native / SSR and when\n * Dynamic WaaS is not enabled.\n *\n * @param client - The Dynamic client instance.\n * @notInstrumented\n */\nexport const preconnectWaasIframe = (client: DynamicClient): void => {\n  const core = getCore(client);\n  try {\n    if (!isDynamicWaasEnabled(client)) return;\n\n    preconnectWaasIframeOrigin({\n      authMode: (isCookieEnabled(client) ? 'cookie' : 'header') as AuthMode,\n      baseApiUrl: (core.apiBaseUrl || DEFAULT_WAAS_BASE_API_URL).replace(\n        '/api/v0',\n        ''\n      ),\n    });\n  } catch (error) {\n    // Best-effort: never break the auth flow (also swallows the assertion\n    // from isDynamicWaasEnabled when project settings are not loaded yet).\n    core.logger.warn('[preconnectWaasIframe] skipped', error);\n  }\n};\n","import type { User } from '../../user/user.types';\n\n/**\n * Checks if device registration is required for the given user.\n *\n * This function determines if the user has the deviceRegistration\n * scope, indicating that device registration is required.\n *\n * @param user - The user to check.\n * @returns True if device registration is required, false otherwise.\n * @notInstrumented\n * @hook Exposed as a hook so consumers reactively know when this device must be registered, updated when the user changes.\n */\nexport const isDeviceRegistrationRequired = (user: User): boolean =>\n  Boolean(user.scope?.includes('device:register'));\n","import { MfaBackupCodeAcknowledgement } from '@dynamic-labs/sdk-api-core';\n\nimport { getDefaultClient } from '../../../client/defaultClient';\nimport { assertDefined } from '../../../utils/assertDefined';\n\n/**\n * Checks if the user is still pending acknowledgment of their MFA recovery codes.\n *\n * This function determines whether the user has been presented with recovery\n * codes that they have not yet acknowledged as saved or backed up.\n *\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns True if recovery codes are pending acknowledgment, false otherwise.\n * @notInstrumented\n * @hook Exposed as a hook so consumers reactively know when recovery codes await acknowledgment, updated when the user changes.\n */\nexport const isPendingRecoveryCodesAcknowledgment = (\n  client = getDefaultClient()\n): boolean => {\n  const user = client.user;\n\n  assertDefined(user, 'User not logged in');\n\n  return (\n    user.mfaBackupCodeAcknowledgement === MfaBackupCodeAcknowledgement.Pending\n  );\n};\n","import { getDefaultClient } from '../../../client/defaultClient';\nimport { assertDefined } from '../../../utils/assertDefined';\nimport { isDeviceRegistrationRequired } from '../../deviceRegistration/isDeviceRegistrationRequired';\nimport { isPendingRecoveryCodesAcknowledgment } from '../../mfa/isPendingRecoveryCodesAcknowledgment';\nimport { isUserMissingMfaAuth } from '../../mfa/isUserMissingMfaAuth';\n\n/**\n * Checks if the user has completed all onboarding requirements.\n *\n * This function verifies whether a user has fulfilled all necessary requirements\n * including KYC fields (Know Your Customer information), MFA setup\n * (Multi-Factor Authentication including recovery codes acknowledgment), and\n * device registration.\n *\n * A `false` result means the user still has an outstanding onboarding step, so\n * any feature that requires a fully onboarded (`user:basic`) user should hold\n * off until it returns `true`. Creating or accessing an embedded (WaaS) wallet\n * is one such feature — its backend calls reject a pre-`user:basic` token — but\n * this predicate is general and not specific to embedded wallets.\n *\n * @deprecated Use {@link checkUserScopes} instead. This function conflates\n * Dynamic-controlled requirements (MFA, device registration, required fields)\n * with the concept of \"onboarding complete\", which is app-specific. Replace\n * with `checkUserScopes({ user, scopes: ['user:basic'] })` to check whether\n * Dynamic's requirements are satisfied, and compose your own logic on top for\n * any app-specific onboarding steps.\n *\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns True if onboarding is complete (no pending requirements), false if there are pending requirements.\n * @notInstrumented\n * @hook Exposed as a hook so consumers reactively know when onboarding is complete, updated when the user changes.\n */\nexport const isUserOnboardingComplete = (\n  client = getDefaultClient()\n): boolean => {\n  const user = client.user;\n\n  assertDefined(user, 'User not logged in');\n\n  const hasMissingKycFields = Boolean(user.missingFields?.length);\n  const hasPendingMfaAuth = isUserMissingMfaAuth(client);\n  const hasPendingRecoveryCodes = isPendingRecoveryCodesAcknowledgment(client);\n  const hasPendingDeviceRegistration = isDeviceRegistrationRequired(user);\n\n  const userOnboardingComplete =\n    !hasMissingKycFields &&\n    !hasPendingMfaAuth &&\n    !hasPendingRecoveryCodes &&\n    !hasPendingDeviceRegistration;\n\n  return userOnboardingComplete;\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAwCA,IAAa,sBAAb,cAAyC,UAAU;CACjD,AAAS;CAET,YAAY,EAAE,SAA2B;AACvC,QAAM;GACJ;GACA,MAAM;GACN,SAAS;GACT,MAAM;GACN,cACE;GACH,CAAC;AACF,OAAK,SAAS;;;;;;;;;;;;;;;;;;;ACrClB,IAAa,gCAAb,cAAmD,UAAU;CAC3D,cAAc;AACZ,QAAM;GACJ,OAAO;GACP,MAAM;GACN,SAAS;GACT,MAAM;GACN,cACE;GACH,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;ACON,IAAa,gCAAb,cAAmD,UAAU;CAC3D,YAAY,EAAE,SAA2B;AACvC,QAAM;GACJ;GACA,MAAM;GACN,SAAS;GACT,MAAM;GACN,cACE;GACH,CAAC;;;;;;;;;;;;;;;;ACrBN,MAAaA,0BAAwB,WAAgC;CACnE,MAAM,OAAO,QAAQ,OAAO;AAC5B,KAAI;AACF,MAAI,CAAC,qBAAqB,OAAO,CAAE;AAEnC,uBAA2B;GACzB,UAAW,gBAAgB,OAAO,GAAG,WAAW;GAChD,aAAa,KAAK,cAAc,2BAA2B,QACzD,WACA,GACD;GACF,CAAC;UACK,OAAO;AAGd,OAAK,OAAO,KAAK,kCAAkC,MAAM;;;;;;;;;;;;;;;;;ACrB7D,MAAa,gCAAgC,SAC3C,QAAQ,KAAK,OAAO,SAAS,kBAAkB,CAAC;;;;;;;;;;;;;;;ACElD,MAAa,wCACX,SAAS,kBAAkB,KACf;CACZ,MAAM,OAAO,OAAO;AAEpB,eAAc,MAAM,qBAAqB;AAEzC,QACE,KAAK,iCAAiC,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;ACQvE,MAAa,4BACX,SAAS,kBAAkB,KACf;CACZ,MAAM,OAAO,OAAO;AAEpB,eAAc,MAAM,qBAAqB;CAEzC,MAAM,sBAAsB,QAAQ,KAAK,eAAe,OAAO;CAC/D,MAAM,oBAAoB,qBAAqB,OAAO;CACtD,MAAM,0BAA0B,qCAAqC,OAAO;CAC5E,MAAM,+BAA+B,6BAA6B,KAAK;AAQvE,QALE,CAAC,uBACD,CAAC,qBACD,CAAC,2BACD,CAAC"}
+{"version":3,"file":"isUserOnboardingComplete-BEZOYohA.esm.js","names":["preconnectWaasIframe"],"sources":["../src/errors/WaasLoadFailedError.ts","../src/errors/WaasOnboardingIncompleteError.ts","../src/errors/WaasRbacStaleRetryUnsafeError.ts","../src/modules/waas/preconnectWaasIframe/preconnectWaasIframe.ts","../src/modules/deviceRegistration/isDeviceRegistrationRequired/isDeviceRegistrationRequired.ts","../src/modules/mfa/isPendingRecoveryCodesAcknowledgment/isPendingRecoveryCodesAcknowledgment.ts","../src/modules/user/isUserOnboardingComplete/isUserOnboardingComplete.ts"],"sourcesContent":["import { BaseError } from './base';\n\n/**\n * Why the embedded wallet load failed. Currently only retry exhaustion is\n * reported; the union exists so new reasons can be added without a breaking\n * change to consumer `instanceof` handling.\n *\n * @example\n * ```ts\n * const reason: WaasLoadFailedErrorReason = 'load_attempts_exhausted';\n * ```\n * @see WaasLoadFailedError\n * @see signMessage\n */\nexport type WaasLoadFailedErrorReason = 'load_attempts_exhausted';\n\n/**\n * Thrown when the embedded (WaaS) wallet's secure container failed to load\n * after exhausting all of its internal retry attempts.\n *\n * This failure is transient: the next wallet operation triggers a fresh load\n * cycle, so hosts can catch this error and re-attempt the operation at their\n * own cadence (for example, when connectivity returns or the app is\n * foregrounded). Other load failures (for example, a CSP block) are not\n * wrapped by this error and their shape is not guaranteed.\n *\n * @example\n * ```ts\n * try {\n *   await signMessage({ message, walletAccount });\n * } catch (error) {\n *   if (error instanceof WaasLoadFailedError) {\n *     // transient — retry the operation at your own cadence\n *     await signMessage({ message, walletAccount });\n *   }\n * }\n * ```\n * @see WaasLoadFailedErrorReason\n * @see signMessage\n */\nexport class WaasLoadFailedError extends BaseError {\n  readonly reason: WaasLoadFailedErrorReason;\n\n  constructor({ cause }: { cause: Error }) {\n    super({\n      cause,\n      code: 'waas_load_failed',\n      docsUrl: null,\n      name: 'WaasLoadFailedError',\n      shortMessage:\n        'The embedded wallet failed to load after exhausting its retry attempts. Retrying the wallet operation triggers a fresh load.',\n    });\n    this.reason = 'load_attempts_exhausted';\n  }\n}\n","import { BaseError } from './base';\n\n/**\n * Thrown when the embedded (WaaS) wallet client is requested before the user\n * has completed onboarding — i.e. the JWT has not upgraded to `user:basic`\n * because MFA, KYC, recovery-codes acknowledgment, or device registration is\n * still pending.\n *\n * The WaaS iframe's init-time room-cache pre-warm fires `createRooms` using the\n * token captured at client construction (before any per-operation token\n * resync). Building the client during this window lets that pre-warm fire with\n * a pre-`user:basic` token, get a 401, and the iframe's unauthorized handler\n * force-logs-out the user. Throwing here surfaces a clear, recoverable reason\n * instead — wait for onboarding to complete and retry.\n */\nexport class WaasOnboardingIncompleteError extends BaseError {\n  constructor() {\n    super({\n      cause: null,\n      code: 'waas_onboarding_incomplete',\n      docsUrl: null,\n      name: 'WaasOnboardingIncompleteError',\n      shortMessage:\n        'Cannot create or access the embedded wallet until onboarding is complete (pending MFA, KYC, recovery-codes acknowledgment, or device registration).',\n    });\n  }\n}\n","import { BaseError } from './base';\n\n/**\n * Thrown when a WaaS ceremony operation (sign, export, reshare, create\n * wallet) receives a 403 `rbac_stale` response after the attempt has already\n * spent its one-time authorization — either the legacy MFA token or a\n * single-use elevated access token.\n *\n * The SDK cannot safely retry in that case: the restarted attempt would find\n * the approval already consumed and fail deeper in the stack with an\n * unrelated \"no MFA token\" error, hiding the permission change that actually\n * caused the failure. Surfacing this error instead tells the host exactly what\n * happened. Recover by re-running the step-up/MFA flow and retrying the\n * operation; the business-account role change has already taken effect, so the\n * retry is evaluated against the caller's current permissions.\n *\n * @example\n * ```ts\n * try {\n *   await signMessage({ message, walletAccount });\n * } catch (error) {\n *   if (error instanceof WaasRbacStaleRetryUnsafeError) {\n *     // The one-time approval was spent; re-verify before trying again.\n *     await promptStepUp();\n *     await signMessage({ message, walletAccount });\n *   }\n * }\n * ```\n * @see WaasLoadFailedError\n * @see signMessage\n */\nexport class WaasRbacStaleRetryUnsafeError extends BaseError {\n  constructor({ cause }: { cause: Error }) {\n    super({\n      cause,\n      code: 'waas_rbac_stale_retry_unsafe',\n      docsUrl: null,\n      name: 'WaasRbacStaleRetryUnsafeError',\n      shortMessage:\n        'The business account role change could not be retried automatically because a one-time authorization was already consumed. Re-authenticate and retry the operation.',\n    });\n  }\n}\n","import type { AuthMode } from '@dynamic-labs-wallet/browser-wallet-client';\nimport { preconnectWaasIframe as preconnectWaasIframeOrigin } from '@dynamic-labs-wallet/browser-wallet-client';\n\nimport { getCore } from '../../../client/core/getCore';\nimport type { DynamicClient } from '../../../client/types';\nimport { isCookieEnabled } from '../../projectSettings/isCookieEnabled';\nimport { DEFAULT_WAAS_BASE_API_URL } from '../constants';\nimport { isDynamicWaasEnabled } from '../isDynamicWaasEnabled';\n\n/**\n * Warms the browser's connection (DNS + TCP + TLS) to the embedded-wallet\n * iframe origin so the iframe mounted after authentication completes loads on\n * a hot connection. Called when an auth flow starts (OTP send/verify, social\n * callback). Safe to call repeatedly; no-op on React Native / SSR and when\n * Dynamic WaaS is not enabled.\n *\n * @param client - The Dynamic client instance.\n * @notInstrumented\n */\nexport const preconnectWaasIframe = (client: DynamicClient): void => {\n  const core = getCore(client);\n  try {\n    if (!isDynamicWaasEnabled(client)) return;\n\n    preconnectWaasIframeOrigin({\n      authMode: (isCookieEnabled(client) ? 'cookie' : 'header') as AuthMode,\n      baseApiUrl: (core.apiBaseUrl || DEFAULT_WAAS_BASE_API_URL).replace(\n        '/api/v0',\n        ''\n      ),\n    });\n  } catch (error) {\n    // Best-effort: never break the auth flow (also swallows the assertion\n    // from isDynamicWaasEnabled when project settings are not loaded yet).\n    core.logger.warn('[preconnectWaasIframe] skipped', error);\n  }\n};\n","import type { User } from '../../user/user.types';\n\n/**\n * Checks if device registration is required for the given user.\n *\n * This function determines if the user has the deviceRegistration\n * scope, indicating that device registration is required.\n *\n * @param user - The user to check.\n * @returns True if device registration is required, false otherwise.\n * @notInstrumented\n * @hook Exposed as a hook so consumers reactively know when this device must be registered, updated when the user changes.\n */\nexport const isDeviceRegistrationRequired = (user: User): boolean =>\n  Boolean(user.scope?.includes('device:register'));\n","import { MfaBackupCodeAcknowledgement } from '@dynamic-labs/sdk-api-core';\n\nimport { getDefaultClient } from '../../../client/defaultClient';\nimport { assertDefined } from '../../../utils/assertDefined';\n\n/**\n * Checks if the user is still pending acknowledgment of their MFA recovery codes.\n *\n * This function determines whether the user has been presented with recovery\n * codes that they have not yet acknowledged as saved or backed up.\n *\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns True if recovery codes are pending acknowledgment, false otherwise.\n * @notInstrumented\n * @hook Exposed as a hook so consumers reactively know when recovery codes await acknowledgment, updated when the user changes.\n */\nexport const isPendingRecoveryCodesAcknowledgment = (\n  client = getDefaultClient()\n): boolean => {\n  const user = client.user;\n\n  assertDefined(user, 'User not logged in');\n\n  return (\n    user.mfaBackupCodeAcknowledgement === MfaBackupCodeAcknowledgement.Pending\n  );\n};\n","import { getDefaultClient } from '../../../client/defaultClient';\nimport { assertDefined } from '../../../utils/assertDefined';\nimport { isDeviceRegistrationRequired } from '../../deviceRegistration/isDeviceRegistrationRequired';\nimport { isPendingRecoveryCodesAcknowledgment } from '../../mfa/isPendingRecoveryCodesAcknowledgment';\nimport { isUserMissingMfaAuth } from '../../mfa/isUserMissingMfaAuth';\n\n/**\n * Checks if the user has completed all onboarding requirements.\n *\n * This function verifies whether a user has fulfilled all necessary requirements\n * including KYC fields (Know Your Customer information), MFA setup\n * (Multi-Factor Authentication including recovery codes acknowledgment), and\n * device registration.\n *\n * A `false` result means the user still has an outstanding onboarding step, so\n * any feature that requires a fully onboarded (`user:basic`) user should hold\n * off until it returns `true`. Creating or accessing an embedded (WaaS) wallet\n * is one such feature — its backend calls reject a pre-`user:basic` token — but\n * this predicate is general and not specific to embedded wallets.\n *\n * @deprecated Use {@link checkUserScopes} instead. This function conflates\n * Dynamic-controlled requirements (MFA, device registration, required fields)\n * with the concept of \"onboarding complete\", which is app-specific. Replace\n * with `checkUserScopes({ user, scopes: ['user:basic'] })` to check whether\n * Dynamic's requirements are satisfied, and compose your own logic on top for\n * any app-specific onboarding steps.\n *\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns True if onboarding is complete (no pending requirements), false if there are pending requirements.\n * @notInstrumented\n * @hook Exposed as a hook so consumers reactively know when onboarding is complete, updated when the user changes.\n */\nexport const isUserOnboardingComplete = (\n  client = getDefaultClient()\n): boolean => {\n  const user = client.user;\n\n  assertDefined(user, 'User not logged in');\n\n  const hasMissingKycFields = Boolean(user.missingFields?.length);\n  const hasPendingMfaAuth = isUserMissingMfaAuth(client);\n  const hasPendingRecoveryCodes = isPendingRecoveryCodesAcknowledgment(client);\n  const hasPendingDeviceRegistration = isDeviceRegistrationRequired(user);\n\n  const userOnboardingComplete =\n    !hasMissingKycFields &&\n    !hasPendingMfaAuth &&\n    !hasPendingRecoveryCodes &&\n    !hasPendingDeviceRegistration;\n\n  return userOnboardingComplete;\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAwCA,IAAa,sBAAb,cAAyC,UAAU;CACjD,AAAS;CAET,YAAY,EAAE,SAA2B;AACvC,QAAM;GACJ;GACA,MAAM;GACN,SAAS;GACT,MAAM;GACN,cACE;GACH,CAAC;AACF,OAAK,SAAS;;;;;;;;;;;;;;;;;;;ACrClB,IAAa,gCAAb,cAAmD,UAAU;CAC3D,cAAc;AACZ,QAAM;GACJ,OAAO;GACP,MAAM;GACN,SAAS;GACT,MAAM;GACN,cACE;GACH,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;ACON,IAAa,gCAAb,cAAmD,UAAU;CAC3D,YAAY,EAAE,SAA2B;AACvC,QAAM;GACJ;GACA,MAAM;GACN,SAAS;GACT,MAAM;GACN,cACE;GACH,CAAC;;;;;;;;;;;;;;;;ACrBN,MAAaA,0BAAwB,WAAgC;CACnE,MAAM,OAAO,QAAQ,OAAO;AAC5B,KAAI;AACF,MAAI,CAAC,qBAAqB,OAAO,CAAE;AAEnC,uBAA2B;GACzB,UAAW,gBAAgB,OAAO,GAAG,WAAW;GAChD,aAAa,KAAK,cAAc,2BAA2B,QACzD,WACA,GACD;GACF,CAAC;UACK,OAAO;AAGd,OAAK,OAAO,KAAK,kCAAkC,MAAM;;;;;;;;;;;;;;;;;ACrB7D,MAAa,gCAAgC,SAC3C,QAAQ,KAAK,OAAO,SAAS,kBAAkB,CAAC;;;;;;;;;;;;;;;ACElD,MAAa,wCACX,SAAS,kBAAkB,KACf;CACZ,MAAM,OAAO,OAAO;AAEpB,eAAc,MAAM,qBAAqB;AAEzC,QACE,KAAK,iCAAiC,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;ACQvE,MAAa,4BACX,SAAS,kBAAkB,KACf;CACZ,MAAM,OAAO,OAAO;AAEpB,eAAc,MAAM,qBAAqB;CAEzC,MAAM,sBAAsB,QAAQ,KAAK,eAAe,OAAO;CAC/D,MAAM,oBAAoB,qBAAqB,OAAO;CACtD,MAAM,0BAA0B,qCAAqC,OAAO;CAC5E,MAAM,+BAA+B,6BAA6B,KAAK;AAQvE,QALE,CAAC,uBACD,CAAC,qBACD,CAAC,2BACD,CAAC"}

package/dist/{isUserOnboardingComplete-DtxIznZD.cjs → isUserOnboardingComplete-Bwvv6Urs.cjs}

@@ -1,5 +1,5 @@
-const require_logoutWithReason = require('./logoutWithReason-yDqQ0UIt.cjs');
-const require_migrateFromFireblocks = require('./migrateFromFireblocks-qYPrnWF8.cjs');
+const require_logoutWithReason = require('./logoutWithReason-B-ZF0VmN.cjs');
+const require_migrateFromFireblocks = require('./migrateFromFireblocks-C23-24bK.cjs');
 let _dynamic_labs_sdk_api_core = require("@dynamic-labs/sdk-api-core");
 let _dynamic_labs_wallet_browser_wallet_client = require("@dynamic-labs-wallet/browser-wallet-client");
 
@@ -252,4 +252,4 @@ Object.defineProperty(exports, 'preconnectWaasIframe', {
     return preconnectWaasIframe;
   }
 });
-//# sourceMappingURL=isUserOnboardingComplete-DtxIznZD.cjs.map
+//# sourceMappingURL=isUserOnboardingComplete-Bwvv6Urs.cjs.map

package/dist/{isUserOnboardingComplete-DtxIznZD.cjs.map → isUserOnboardingComplete-Bwvv6Urs.cjs.map}

@@ -1 +1 @@
-{"version":3,"file":"isUserOnboardingComplete-DtxIznZD.cjs","names":["BaseError","BaseError","BaseError","getCore","isDynamicWaasEnabled","isCookieEnabled","DEFAULT_WAAS_BASE_API_URL","getDefaultClient","MfaBackupCodeAcknowledgement","getDefaultClient","isUserMissingMfaAuth"],"sources":["../src/errors/WaasLoadFailedError.ts","../src/errors/WaasOnboardingIncompleteError.ts","../src/errors/WaasRbacStaleRetryUnsafeError.ts","../src/modules/waas/preconnectWaasIframe/preconnectWaasIframe.ts","../src/modules/deviceRegistration/isDeviceRegistrationRequired/isDeviceRegistrationRequired.ts","../src/modules/mfa/isPendingRecoveryCodesAcknowledgment/isPendingRecoveryCodesAcknowledgment.ts","../src/modules/user/isUserOnboardingComplete/isUserOnboardingComplete.ts"],"sourcesContent":["import { BaseError } from './base';\n\n/**\n * Why the embedded wallet load failed. Currently only retry exhaustion is\n * reported; the union exists so new reasons can be added without a breaking\n * change to consumer `instanceof` handling.\n *\n * @example\n * ```ts\n * const reason: WaasLoadFailedErrorReason = 'load_attempts_exhausted';\n * ```\n * @see WaasLoadFailedError\n * @see signMessage\n */\nexport type WaasLoadFailedErrorReason = 'load_attempts_exhausted';\n\n/**\n * Thrown when the embedded (WaaS) wallet's secure container failed to load\n * after exhausting all of its internal retry attempts.\n *\n * This failure is transient: the next wallet operation triggers a fresh load\n * cycle, so hosts can catch this error and re-attempt the operation at their\n * own cadence (for example, when connectivity returns or the app is\n * foregrounded). Other load failures (for example, a CSP block) are not\n * wrapped by this error and their shape is not guaranteed.\n *\n * @example\n * ```ts\n * try {\n *   await signMessage({ message, walletAccount });\n * } catch (error) {\n *   if (error instanceof WaasLoadFailedError) {\n *     // transient — retry the operation at your own cadence\n *     await signMessage({ message, walletAccount });\n *   }\n * }\n * ```\n * @see WaasLoadFailedErrorReason\n * @see signMessage\n */\nexport class WaasLoadFailedError extends BaseError {\n  readonly reason: WaasLoadFailedErrorReason;\n\n  constructor({ cause }: { cause: Error }) {\n    super({\n      cause,\n      code: 'waas_load_failed',\n      docsUrl: null,\n      name: 'WaasLoadFailedError',\n      shortMessage:\n        'The embedded wallet failed to load after exhausting its retry attempts. Retrying the wallet operation triggers a fresh load.',\n    });\n    this.reason = 'load_attempts_exhausted';\n  }\n}\n","import { BaseError } from './base';\n\n/**\n * Thrown when the embedded (WaaS) wallet client is requested before the user\n * has completed onboarding — i.e. the JWT has not upgraded to `user:basic`\n * because MFA, KYC, recovery-codes acknowledgment, or device registration is\n * still pending.\n *\n * The WaaS iframe's init-time room-cache pre-warm fires `createRooms` using the\n * token captured at client construction (before any per-operation token\n * resync). Building the client during this window lets that pre-warm fire with\n * a pre-`user:basic` token, get a 401, and the iframe's unauthorized handler\n * force-logs-out the user. Throwing here surfaces a clear, recoverable reason\n * instead — wait for onboarding to complete and retry.\n */\nexport class WaasOnboardingIncompleteError extends BaseError {\n  constructor() {\n    super({\n      cause: null,\n      code: 'waas_onboarding_incomplete',\n      docsUrl: null,\n      name: 'WaasOnboardingIncompleteError',\n      shortMessage:\n        'Cannot create or access the embedded wallet until onboarding is complete (pending MFA, KYC, recovery-codes acknowledgment, or device registration).',\n    });\n  }\n}\n","import { BaseError } from './base';\n\n/**\n * Thrown when a WaaS ceremony operation (sign, export, reshare, create\n * wallet) receives a 403 `rbac_stale` response after the attempt has already\n * spent its one-time authorization — either the legacy MFA token or a\n * single-use elevated access token.\n *\n * The SDK cannot safely retry in that case: the restarted attempt would find\n * the approval already consumed and fail deeper in the stack with an\n * unrelated \"no MFA token\" error, hiding the permission change that actually\n * caused the failure. Surfacing this error instead tells the host exactly what\n * happened. Recover by re-running the step-up/MFA flow and retrying the\n * operation; the business-account role change has already taken effect, so the\n * retry is evaluated against the caller's current permissions.\n *\n * @example\n * ```ts\n * try {\n *   await signMessage({ message, walletAccount });\n * } catch (error) {\n *   if (error instanceof WaasRbacStaleRetryUnsafeError) {\n *     // The one-time approval was spent; re-verify before trying again.\n *     await promptStepUp();\n *     await signMessage({ message, walletAccount });\n *   }\n * }\n * ```\n * @see WaasLoadFailedError\n * @see signMessage\n */\nexport class WaasRbacStaleRetryUnsafeError extends BaseError {\n  constructor({ cause }: { cause: Error }) {\n    super({\n      cause,\n      code: 'waas_rbac_stale_retry_unsafe',\n      docsUrl: null,\n      name: 'WaasRbacStaleRetryUnsafeError',\n      shortMessage:\n        'The business account role change could not be retried automatically because a one-time authorization was already consumed. Re-authenticate and retry the operation.',\n    });\n  }\n}\n","import type { AuthMode } from '@dynamic-labs-wallet/browser-wallet-client';\nimport { preconnectWaasIframe as preconnectWaasIframeOrigin } from '@dynamic-labs-wallet/browser-wallet-client';\n\nimport { getCore } from '../../../client/core/getCore';\nimport type { DynamicClient } from '../../../client/types';\nimport { isCookieEnabled } from '../../projectSettings/isCookieEnabled';\nimport { DEFAULT_WAAS_BASE_API_URL } from '../constants';\nimport { isDynamicWaasEnabled } from '../isDynamicWaasEnabled';\n\n/**\n * Warms the browser's connection (DNS + TCP + TLS) to the embedded-wallet\n * iframe origin so the iframe mounted after authentication completes loads on\n * a hot connection. Called when an auth flow starts (OTP send/verify, social\n * callback). Safe to call repeatedly; no-op on React Native / SSR and when\n * Dynamic WaaS is not enabled.\n *\n * @param client - The Dynamic client instance.\n * @notInstrumented\n */\nexport const preconnectWaasIframe = (client: DynamicClient): void => {\n  const core = getCore(client);\n  try {\n    if (!isDynamicWaasEnabled(client)) return;\n\n    preconnectWaasIframeOrigin({\n      authMode: (isCookieEnabled(client) ? 'cookie' : 'header') as AuthMode,\n      baseApiUrl: (core.apiBaseUrl || DEFAULT_WAAS_BASE_API_URL).replace(\n        '/api/v0',\n        ''\n      ),\n    });\n  } catch (error) {\n    // Best-effort: never break the auth flow (also swallows the assertion\n    // from isDynamicWaasEnabled when project settings are not loaded yet).\n    core.logger.warn('[preconnectWaasIframe] skipped', error);\n  }\n};\n","import type { User } from '../../user/user.types';\n\n/**\n * Checks if device registration is required for the given user.\n *\n * This function determines if the user has the deviceRegistration\n * scope, indicating that device registration is required.\n *\n * @param user - The user to check.\n * @returns True if device registration is required, false otherwise.\n * @notInstrumented\n * @hook Exposed as a hook so consumers reactively know when this device must be registered, updated when the user changes.\n */\nexport const isDeviceRegistrationRequired = (user: User): boolean =>\n  Boolean(user.scope?.includes('device:register'));\n","import { MfaBackupCodeAcknowledgement } from '@dynamic-labs/sdk-api-core';\n\nimport { getDefaultClient } from '../../../client/defaultClient';\nimport { assertDefined } from '../../../utils/assertDefined';\n\n/**\n * Checks if the user is still pending acknowledgment of their MFA recovery codes.\n *\n * This function determines whether the user has been presented with recovery\n * codes that they have not yet acknowledged as saved or backed up.\n *\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns True if recovery codes are pending acknowledgment, false otherwise.\n * @notInstrumented\n * @hook Exposed as a hook so consumers reactively know when recovery codes await acknowledgment, updated when the user changes.\n */\nexport const isPendingRecoveryCodesAcknowledgment = (\n  client = getDefaultClient()\n): boolean => {\n  const user = client.user;\n\n  assertDefined(user, 'User not logged in');\n\n  return (\n    user.mfaBackupCodeAcknowledgement === MfaBackupCodeAcknowledgement.Pending\n  );\n};\n","import { getDefaultClient } from '../../../client/defaultClient';\nimport { assertDefined } from '../../../utils/assertDefined';\nimport { isDeviceRegistrationRequired } from '../../deviceRegistration/isDeviceRegistrationRequired';\nimport { isPendingRecoveryCodesAcknowledgment } from '../../mfa/isPendingRecoveryCodesAcknowledgment';\nimport { isUserMissingMfaAuth } from '../../mfa/isUserMissingMfaAuth';\n\n/**\n * Checks if the user has completed all onboarding requirements.\n *\n * This function verifies whether a user has fulfilled all necessary requirements\n * including KYC fields (Know Your Customer information), MFA setup\n * (Multi-Factor Authentication including recovery codes acknowledgment), and\n * device registration.\n *\n * A `false` result means the user still has an outstanding onboarding step, so\n * any feature that requires a fully onboarded (`user:basic`) user should hold\n * off until it returns `true`. Creating or accessing an embedded (WaaS) wallet\n * is one such feature — its backend calls reject a pre-`user:basic` token — but\n * this predicate is general and not specific to embedded wallets.\n *\n * @deprecated Use {@link checkUserScopes} instead. This function conflates\n * Dynamic-controlled requirements (MFA, device registration, required fields)\n * with the concept of \"onboarding complete\", which is app-specific. Replace\n * with `checkUserScopes({ user, scopes: ['user:basic'] })` to check whether\n * Dynamic's requirements are satisfied, and compose your own logic on top for\n * any app-specific onboarding steps.\n *\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns True if onboarding is complete (no pending requirements), false if there are pending requirements.\n * @notInstrumented\n * @hook Exposed as a hook so consumers reactively know when onboarding is complete, updated when the user changes.\n */\nexport const isUserOnboardingComplete = (\n  client = getDefaultClient()\n): boolean => {\n  const user = client.user;\n\n  assertDefined(user, 'User not logged in');\n\n  const hasMissingKycFields = Boolean(user.missingFields?.length);\n  const hasPendingMfaAuth = isUserMissingMfaAuth(client);\n  const hasPendingRecoveryCodes = isPendingRecoveryCodesAcknowledgment(client);\n  const hasPendingDeviceRegistration = isDeviceRegistrationRequired(user);\n\n  const userOnboardingComplete =\n    !hasMissingKycFields &&\n    !hasPendingMfaAuth &&\n    !hasPendingRecoveryCodes &&\n    !hasPendingDeviceRegistration;\n\n  return userOnboardingComplete;\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAwCA,IAAa,sBAAb,cAAyCA,mCAAU;CACjD,AAAS;CAET,YAAY,EAAE,SAA2B;AACvC,QAAM;GACJ;GACA,MAAM;GACN,SAAS;GACT,MAAM;GACN,cACE;GACH,CAAC;AACF,OAAK,SAAS;;;;;;;;;;;;;;;;;;;ACrClB,IAAa,gCAAb,cAAmDC,mCAAU;CAC3D,cAAc;AACZ,QAAM;GACJ,OAAO;GACP,MAAM;GACN,SAAS;GACT,MAAM;GACN,cACE;GACH,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;ACON,IAAa,gCAAb,cAAmDC,mCAAU;CAC3D,YAAY,EAAE,SAA2B;AACvC,QAAM;GACJ;GACA,MAAM;GACN,SAAS;GACT,MAAM;GACN,cACE;GACH,CAAC;;;;;;;;;;;;;;;;ACrBN,MAAa,wBAAwB,WAAgC;CACnE,MAAM,OAAOC,iCAAQ,OAAO;AAC5B,KAAI;AACF,MAAI,CAACC,mDAAqB,OAAO,CAAE;AAEnC,uEAA2B;GACzB,UAAWC,yCAAgB,OAAO,GAAG,WAAW;GAChD,aAAa,KAAK,cAAcC,oDAA2B,QACzD,WACA,GACD;GACF,CAAC;UACK,OAAO;AAGd,OAAK,OAAO,KAAK,kCAAkC,MAAM;;;;;;;;;;;;;;;;;ACrB7D,MAAa,gCAAgC,SAC3C,QAAQ,KAAK,OAAO,SAAS,kBAAkB,CAAC;;;;;;;;;;;;;;;ACElD,MAAa,wCACX,SAASC,2CAAkB,KACf;CACZ,MAAM,OAAO,OAAO;AAEpB,wCAAc,MAAM,qBAAqB;AAEzC,QACE,KAAK,iCAAiCC,wDAA6B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;ACQvE,MAAa,4BACX,SAASC,2CAAkB,KACf;CACZ,MAAM,OAAO,OAAO;AAEpB,wCAAc,MAAM,qBAAqB;CAEzC,MAAM,sBAAsB,QAAQ,KAAK,eAAe,OAAO;CAC/D,MAAM,oBAAoBC,8CAAqB,OAAO;CACtD,MAAM,0BAA0B,qCAAqC,OAAO;CAC5E,MAAM,+BAA+B,6BAA6B,KAAK;AAQvE,QALE,CAAC,uBACD,CAAC,qBACD,CAAC,2BACD,CAAC"}
+{"version":3,"file":"isUserOnboardingComplete-Bwvv6Urs.cjs","names":["BaseError","BaseError","BaseError","getCore","isDynamicWaasEnabled","isCookieEnabled","DEFAULT_WAAS_BASE_API_URL","getDefaultClient","MfaBackupCodeAcknowledgement","getDefaultClient","isUserMissingMfaAuth"],"sources":["../src/errors/WaasLoadFailedError.ts","../src/errors/WaasOnboardingIncompleteError.ts","../src/errors/WaasRbacStaleRetryUnsafeError.ts","../src/modules/waas/preconnectWaasIframe/preconnectWaasIframe.ts","../src/modules/deviceRegistration/isDeviceRegistrationRequired/isDeviceRegistrationRequired.ts","../src/modules/mfa/isPendingRecoveryCodesAcknowledgment/isPendingRecoveryCodesAcknowledgment.ts","../src/modules/user/isUserOnboardingComplete/isUserOnboardingComplete.ts"],"sourcesContent":["import { BaseError } from './base';\n\n/**\n * Why the embedded wallet load failed. Currently only retry exhaustion is\n * reported; the union exists so new reasons can be added without a breaking\n * change to consumer `instanceof` handling.\n *\n * @example\n * ```ts\n * const reason: WaasLoadFailedErrorReason = 'load_attempts_exhausted';\n * ```\n * @see WaasLoadFailedError\n * @see signMessage\n */\nexport type WaasLoadFailedErrorReason = 'load_attempts_exhausted';\n\n/**\n * Thrown when the embedded (WaaS) wallet's secure container failed to load\n * after exhausting all of its internal retry attempts.\n *\n * This failure is transient: the next wallet operation triggers a fresh load\n * cycle, so hosts can catch this error and re-attempt the operation at their\n * own cadence (for example, when connectivity returns or the app is\n * foregrounded). Other load failures (for example, a CSP block) are not\n * wrapped by this error and their shape is not guaranteed.\n *\n * @example\n * ```ts\n * try {\n *   await signMessage({ message, walletAccount });\n * } catch (error) {\n *   if (error instanceof WaasLoadFailedError) {\n *     // transient — retry the operation at your own cadence\n *     await signMessage({ message, walletAccount });\n *   }\n * }\n * ```\n * @see WaasLoadFailedErrorReason\n * @see signMessage\n */\nexport class WaasLoadFailedError extends BaseError {\n  readonly reason: WaasLoadFailedErrorReason;\n\n  constructor({ cause }: { cause: Error }) {\n    super({\n      cause,\n      code: 'waas_load_failed',\n      docsUrl: null,\n      name: 'WaasLoadFailedError',\n      shortMessage:\n        'The embedded wallet failed to load after exhausting its retry attempts. Retrying the wallet operation triggers a fresh load.',\n    });\n    this.reason = 'load_attempts_exhausted';\n  }\n}\n","import { BaseError } from './base';\n\n/**\n * Thrown when the embedded (WaaS) wallet client is requested before the user\n * has completed onboarding — i.e. the JWT has not upgraded to `user:basic`\n * because MFA, KYC, recovery-codes acknowledgment, or device registration is\n * still pending.\n *\n * The WaaS iframe's init-time room-cache pre-warm fires `createRooms` using the\n * token captured at client construction (before any per-operation token\n * resync). Building the client during this window lets that pre-warm fire with\n * a pre-`user:basic` token, get a 401, and the iframe's unauthorized handler\n * force-logs-out the user. Throwing here surfaces a clear, recoverable reason\n * instead — wait for onboarding to complete and retry.\n */\nexport class WaasOnboardingIncompleteError extends BaseError {\n  constructor() {\n    super({\n      cause: null,\n      code: 'waas_onboarding_incomplete',\n      docsUrl: null,\n      name: 'WaasOnboardingIncompleteError',\n      shortMessage:\n        'Cannot create or access the embedded wallet until onboarding is complete (pending MFA, KYC, recovery-codes acknowledgment, or device registration).',\n    });\n  }\n}\n","import { BaseError } from './base';\n\n/**\n * Thrown when a WaaS ceremony operation (sign, export, reshare, create\n * wallet) receives a 403 `rbac_stale` response after the attempt has already\n * spent its one-time authorization — either the legacy MFA token or a\n * single-use elevated access token.\n *\n * The SDK cannot safely retry in that case: the restarted attempt would find\n * the approval already consumed and fail deeper in the stack with an\n * unrelated \"no MFA token\" error, hiding the permission change that actually\n * caused the failure. Surfacing this error instead tells the host exactly what\n * happened. Recover by re-running the step-up/MFA flow and retrying the\n * operation; the business-account role change has already taken effect, so the\n * retry is evaluated against the caller's current permissions.\n *\n * @example\n * ```ts\n * try {\n *   await signMessage({ message, walletAccount });\n * } catch (error) {\n *   if (error instanceof WaasRbacStaleRetryUnsafeError) {\n *     // The one-time approval was spent; re-verify before trying again.\n *     await promptStepUp();\n *     await signMessage({ message, walletAccount });\n *   }\n * }\n * ```\n * @see WaasLoadFailedError\n * @see signMessage\n */\nexport class WaasRbacStaleRetryUnsafeError extends BaseError {\n  constructor({ cause }: { cause: Error }) {\n    super({\n      cause,\n      code: 'waas_rbac_stale_retry_unsafe',\n      docsUrl: null,\n      name: 'WaasRbacStaleRetryUnsafeError',\n      shortMessage:\n        'The business account role change could not be retried automatically because a one-time authorization was already consumed. Re-authenticate and retry the operation.',\n    });\n  }\n}\n","import type { AuthMode } from '@dynamic-labs-wallet/browser-wallet-client';\nimport { preconnectWaasIframe as preconnectWaasIframeOrigin } from '@dynamic-labs-wallet/browser-wallet-client';\n\nimport { getCore } from '../../../client/core/getCore';\nimport type { DynamicClient } from '../../../client/types';\nimport { isCookieEnabled } from '../../projectSettings/isCookieEnabled';\nimport { DEFAULT_WAAS_BASE_API_URL } from '../constants';\nimport { isDynamicWaasEnabled } from '../isDynamicWaasEnabled';\n\n/**\n * Warms the browser's connection (DNS + TCP + TLS) to the embedded-wallet\n * iframe origin so the iframe mounted after authentication completes loads on\n * a hot connection. Called when an auth flow starts (OTP send/verify, social\n * callback). Safe to call repeatedly; no-op on React Native / SSR and when\n * Dynamic WaaS is not enabled.\n *\n * @param client - The Dynamic client instance.\n * @notInstrumented\n */\nexport const preconnectWaasIframe = (client: DynamicClient): void => {\n  const core = getCore(client);\n  try {\n    if (!isDynamicWaasEnabled(client)) return;\n\n    preconnectWaasIframeOrigin({\n      authMode: (isCookieEnabled(client) ? 'cookie' : 'header') as AuthMode,\n      baseApiUrl: (core.apiBaseUrl || DEFAULT_WAAS_BASE_API_URL).replace(\n        '/api/v0',\n        ''\n      ),\n    });\n  } catch (error) {\n    // Best-effort: never break the auth flow (also swallows the assertion\n    // from isDynamicWaasEnabled when project settings are not loaded yet).\n    core.logger.warn('[preconnectWaasIframe] skipped', error);\n  }\n};\n","import type { User } from '../../user/user.types';\n\n/**\n * Checks if device registration is required for the given user.\n *\n * This function determines if the user has the deviceRegistration\n * scope, indicating that device registration is required.\n *\n * @param user - The user to check.\n * @returns True if device registration is required, false otherwise.\n * @notInstrumented\n * @hook Exposed as a hook so consumers reactively know when this device must be registered, updated when the user changes.\n */\nexport const isDeviceRegistrationRequired = (user: User): boolean =>\n  Boolean(user.scope?.includes('device:register'));\n","import { MfaBackupCodeAcknowledgement } from '@dynamic-labs/sdk-api-core';\n\nimport { getDefaultClient } from '../../../client/defaultClient';\nimport { assertDefined } from '../../../utils/assertDefined';\n\n/**\n * Checks if the user is still pending acknowledgment of their MFA recovery codes.\n *\n * This function determines whether the user has been presented with recovery\n * codes that they have not yet acknowledged as saved or backed up.\n *\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns True if recovery codes are pending acknowledgment, false otherwise.\n * @notInstrumented\n * @hook Exposed as a hook so consumers reactively know when recovery codes await acknowledgment, updated when the user changes.\n */\nexport const isPendingRecoveryCodesAcknowledgment = (\n  client = getDefaultClient()\n): boolean => {\n  const user = client.user;\n\n  assertDefined(user, 'User not logged in');\n\n  return (\n    user.mfaBackupCodeAcknowledgement === MfaBackupCodeAcknowledgement.Pending\n  );\n};\n","import { getDefaultClient } from '../../../client/defaultClient';\nimport { assertDefined } from '../../../utils/assertDefined';\nimport { isDeviceRegistrationRequired } from '../../deviceRegistration/isDeviceRegistrationRequired';\nimport { isPendingRecoveryCodesAcknowledgment } from '../../mfa/isPendingRecoveryCodesAcknowledgment';\nimport { isUserMissingMfaAuth } from '../../mfa/isUserMissingMfaAuth';\n\n/**\n * Checks if the user has completed all onboarding requirements.\n *\n * This function verifies whether a user has fulfilled all necessary requirements\n * including KYC fields (Know Your Customer information), MFA setup\n * (Multi-Factor Authentication including recovery codes acknowledgment), and\n * device registration.\n *\n * A `false` result means the user still has an outstanding onboarding step, so\n * any feature that requires a fully onboarded (`user:basic`) user should hold\n * off until it returns `true`. Creating or accessing an embedded (WaaS) wallet\n * is one such feature — its backend calls reject a pre-`user:basic` token — but\n * this predicate is general and not specific to embedded wallets.\n *\n * @deprecated Use {@link checkUserScopes} instead. This function conflates\n * Dynamic-controlled requirements (MFA, device registration, required fields)\n * with the concept of \"onboarding complete\", which is app-specific. Replace\n * with `checkUserScopes({ user, scopes: ['user:basic'] })` to check whether\n * Dynamic's requirements are satisfied, and compose your own logic on top for\n * any app-specific onboarding steps.\n *\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns True if onboarding is complete (no pending requirements), false if there are pending requirements.\n * @notInstrumented\n * @hook Exposed as a hook so consumers reactively know when onboarding is complete, updated when the user changes.\n */\nexport const isUserOnboardingComplete = (\n  client = getDefaultClient()\n): boolean => {\n  const user = client.user;\n\n  assertDefined(user, 'User not logged in');\n\n  const hasMissingKycFields = Boolean(user.missingFields?.length);\n  const hasPendingMfaAuth = isUserMissingMfaAuth(client);\n  const hasPendingRecoveryCodes = isPendingRecoveryCodesAcknowledgment(client);\n  const hasPendingDeviceRegistration = isDeviceRegistrationRequired(user);\n\n  const userOnboardingComplete =\n    !hasMissingKycFields &&\n    !hasPendingMfaAuth &&\n    !hasPendingRecoveryCodes &&\n    !hasPendingDeviceRegistration;\n\n  return userOnboardingComplete;\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAwCA,IAAa,sBAAb,cAAyCA,mCAAU;CACjD,AAAS;CAET,YAAY,EAAE,SAA2B;AACvC,QAAM;GACJ;GACA,MAAM;GACN,SAAS;GACT,MAAM;GACN,cACE;GACH,CAAC;AACF,OAAK,SAAS;;;;;;;;;;;;;;;;;;;ACrClB,IAAa,gCAAb,cAAmDC,mCAAU;CAC3D,cAAc;AACZ,QAAM;GACJ,OAAO;GACP,MAAM;GACN,SAAS;GACT,MAAM;GACN,cACE;GACH,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;ACON,IAAa,gCAAb,cAAmDC,mCAAU;CAC3D,YAAY,EAAE,SAA2B;AACvC,QAAM;GACJ;GACA,MAAM;GACN,SAAS;GACT,MAAM;GACN,cACE;GACH,CAAC;;;;;;;;;;;;;;;;ACrBN,MAAa,wBAAwB,WAAgC;CACnE,MAAM,OAAOC,iCAAQ,OAAO;AAC5B,KAAI;AACF,MAAI,CAACC,mDAAqB,OAAO,CAAE;AAEnC,uEAA2B;GACzB,UAAWC,yCAAgB,OAAO,GAAG,WAAW;GAChD,aAAa,KAAK,cAAcC,oDAA2B,QACzD,WACA,GACD;GACF,CAAC;UACK,OAAO;AAGd,OAAK,OAAO,KAAK,kCAAkC,MAAM;;;;;;;;;;;;;;;;;ACrB7D,MAAa,gCAAgC,SAC3C,QAAQ,KAAK,OAAO,SAAS,kBAAkB,CAAC;;;;;;;;;;;;;;;ACElD,MAAa,wCACX,SAASC,2CAAkB,KACf;CACZ,MAAM,OAAO,OAAO;AAEpB,wCAAc,MAAM,qBAAqB;AAEzC,QACE,KAAK,iCAAiCC,wDAA6B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;ACQvE,MAAa,4BACX,SAASC,2CAAkB,KACf;CACZ,MAAM,OAAO,OAAO;AAEpB,wCAAc,MAAM,qBAAqB;CAEzC,MAAM,sBAAsB,QAAQ,KAAK,eAAe,OAAO;CAC/D,MAAM,oBAAoBC,8CAAqB,OAAO;CACtD,MAAM,0BAA0B,qCAAqC,OAAO;CAC5E,MAAM,+BAA+B,6BAA6B,KAAK;AAQvE,QALE,CAAC,uBACD,CAAC,qBACD,CAAC,2BACD,CAAC"}

package/dist/{isUserOnboardingComplete-BWrCHXXO.native.esm.js → isUserOnboardingComplete-CEUkAzCi.native.esm.js}

@@ -1,5 +1,5 @@
-import { H as isUserMissingMfaAuth, S as DEFAULT_WAAS_BASE_API_URL, St as BaseError, ft as isCookieEnabled, pt as assertDefined, vt as getDefaultClient, xt as getCore } from "./apiClient-Bwd6cllS.native.esm.js";
-import { n as isDynamicWaasEnabled } from "./migrateFromFireblocks-BUhWQCqm.native.esm.js";
+import { C as DEFAULT_WAAS_BASE_API_URL, Ct as getCore, U as isUserMissingMfaAuth, bt as getDefaultClient, ht as assertDefined, mt as isCookieEnabled, wt as BaseError } from "./apiClient-4r7VAsLC.native.esm.js";
+import { n as isDynamicWaasEnabled } from "./migrateFromFireblocks-6I7lkraQ.native.esm.js";
 import { MfaBackupCodeAcknowledgement } from "@dynamic-labs/sdk-api-core";
 import { preconnectWaasIframe } from "@dynamic-labs-wallet/browser-wallet-client";
 
@@ -211,4 +211,4 @@ const isUserOnboardingComplete = (client = getDefaultClient()) => {
 
 //#endregion
 export { WaasRbacStaleRetryUnsafeError as a, preconnectWaasIframe$1 as i, isPendingRecoveryCodesAcknowledgment as n, WaasOnboardingIncompleteError as o, isDeviceRegistrationRequired as r, WaasLoadFailedError as s, isUserOnboardingComplete as t };
-//# sourceMappingURL=isUserOnboardingComplete-BWrCHXXO.native.esm.js.map
+//# sourceMappingURL=isUserOnboardingComplete-CEUkAzCi.native.esm.js.map

package/dist/{isUserOnboardingComplete-BWrCHXXO.native.esm.js.map → isUserOnboardingComplete-CEUkAzCi.native.esm.js.map}

@@ -1 +1 @@
-{"version":3,"file":"isUserOnboardingComplete-BWrCHXXO.native.esm.js","names":["preconnectWaasIframe"],"sources":["../src/errors/WaasLoadFailedError.ts","../src/errors/WaasOnboardingIncompleteError.ts","../src/errors/WaasRbacStaleRetryUnsafeError.ts","../src/modules/waas/preconnectWaasIframe/preconnectWaasIframe.ts","../src/modules/deviceRegistration/isDeviceRegistrationRequired/isDeviceRegistrationRequired.ts","../src/modules/mfa/isPendingRecoveryCodesAcknowledgment/isPendingRecoveryCodesAcknowledgment.ts","../src/modules/user/isUserOnboardingComplete/isUserOnboardingComplete.ts"],"sourcesContent":["import { BaseError } from './base';\n\n/**\n * Why the embedded wallet load failed. Currently only retry exhaustion is\n * reported; the union exists so new reasons can be added without a breaking\n * change to consumer `instanceof` handling.\n *\n * @example\n * ```ts\n * const reason: WaasLoadFailedErrorReason = 'load_attempts_exhausted';\n * ```\n * @see WaasLoadFailedError\n * @see signMessage\n */\nexport type WaasLoadFailedErrorReason = 'load_attempts_exhausted';\n\n/**\n * Thrown when the embedded (WaaS) wallet's secure container failed to load\n * after exhausting all of its internal retry attempts.\n *\n * This failure is transient: the next wallet operation triggers a fresh load\n * cycle, so hosts can catch this error and re-attempt the operation at their\n * own cadence (for example, when connectivity returns or the app is\n * foregrounded). Other load failures (for example, a CSP block) are not\n * wrapped by this error and their shape is not guaranteed.\n *\n * @example\n * ```ts\n * try {\n *   await signMessage({ message, walletAccount });\n * } catch (error) {\n *   if (error instanceof WaasLoadFailedError) {\n *     // transient — retry the operation at your own cadence\n *     await signMessage({ message, walletAccount });\n *   }\n * }\n * ```\n * @see WaasLoadFailedErrorReason\n * @see signMessage\n */\nexport class WaasLoadFailedError extends BaseError {\n  readonly reason: WaasLoadFailedErrorReason;\n\n  constructor({ cause }: { cause: Error }) {\n    super({\n      cause,\n      code: 'waas_load_failed',\n      docsUrl: null,\n      name: 'WaasLoadFailedError',\n      shortMessage:\n        'The embedded wallet failed to load after exhausting its retry attempts. Retrying the wallet operation triggers a fresh load.',\n    });\n    this.reason = 'load_attempts_exhausted';\n  }\n}\n","import { BaseError } from './base';\n\n/**\n * Thrown when the embedded (WaaS) wallet client is requested before the user\n * has completed onboarding — i.e. the JWT has not upgraded to `user:basic`\n * because MFA, KYC, recovery-codes acknowledgment, or device registration is\n * still pending.\n *\n * The WaaS iframe's init-time room-cache pre-warm fires `createRooms` using the\n * token captured at client construction (before any per-operation token\n * resync). Building the client during this window lets that pre-warm fire with\n * a pre-`user:basic` token, get a 401, and the iframe's unauthorized handler\n * force-logs-out the user. Throwing here surfaces a clear, recoverable reason\n * instead — wait for onboarding to complete and retry.\n */\nexport class WaasOnboardingIncompleteError extends BaseError {\n  constructor() {\n    super({\n      cause: null,\n      code: 'waas_onboarding_incomplete',\n      docsUrl: null,\n      name: 'WaasOnboardingIncompleteError',\n      shortMessage:\n        'Cannot create or access the embedded wallet until onboarding is complete (pending MFA, KYC, recovery-codes acknowledgment, or device registration).',\n    });\n  }\n}\n","import { BaseError } from './base';\n\n/**\n * Thrown when a WaaS ceremony operation (sign, export, reshare, create\n * wallet) receives a 403 `rbac_stale` response after the attempt has already\n * spent its one-time authorization — either the legacy MFA token or a\n * single-use elevated access token.\n *\n * The SDK cannot safely retry in that case: the restarted attempt would find\n * the approval already consumed and fail deeper in the stack with an\n * unrelated \"no MFA token\" error, hiding the permission change that actually\n * caused the failure. Surfacing this error instead tells the host exactly what\n * happened. Recover by re-running the step-up/MFA flow and retrying the\n * operation; the business-account role change has already taken effect, so the\n * retry is evaluated against the caller's current permissions.\n *\n * @example\n * ```ts\n * try {\n *   await signMessage({ message, walletAccount });\n * } catch (error) {\n *   if (error instanceof WaasRbacStaleRetryUnsafeError) {\n *     // The one-time approval was spent; re-verify before trying again.\n *     await promptStepUp();\n *     await signMessage({ message, walletAccount });\n *   }\n * }\n * ```\n * @see WaasLoadFailedError\n * @see signMessage\n */\nexport class WaasRbacStaleRetryUnsafeError extends BaseError {\n  constructor({ cause }: { cause: Error }) {\n    super({\n      cause,\n      code: 'waas_rbac_stale_retry_unsafe',\n      docsUrl: null,\n      name: 'WaasRbacStaleRetryUnsafeError',\n      shortMessage:\n        'The business account role change could not be retried automatically because a one-time authorization was already consumed. Re-authenticate and retry the operation.',\n    });\n  }\n}\n","import type { AuthMode } from '@dynamic-labs-wallet/browser-wallet-client';\nimport { preconnectWaasIframe as preconnectWaasIframeOrigin } from '@dynamic-labs-wallet/browser-wallet-client';\n\nimport { getCore } from '../../../client/core/getCore';\nimport type { DynamicClient } from '../../../client/types';\nimport { isCookieEnabled } from '../../projectSettings/isCookieEnabled';\nimport { DEFAULT_WAAS_BASE_API_URL } from '../constants';\nimport { isDynamicWaasEnabled } from '../isDynamicWaasEnabled';\n\n/**\n * Warms the browser's connection (DNS + TCP + TLS) to the embedded-wallet\n * iframe origin so the iframe mounted after authentication completes loads on\n * a hot connection. Called when an auth flow starts (OTP send/verify, social\n * callback). Safe to call repeatedly; no-op on React Native / SSR and when\n * Dynamic WaaS is not enabled.\n *\n * @param client - The Dynamic client instance.\n * @notInstrumented\n */\nexport const preconnectWaasIframe = (client: DynamicClient): void => {\n  const core = getCore(client);\n  try {\n    if (!isDynamicWaasEnabled(client)) return;\n\n    preconnectWaasIframeOrigin({\n      authMode: (isCookieEnabled(client) ? 'cookie' : 'header') as AuthMode,\n      baseApiUrl: (core.apiBaseUrl || DEFAULT_WAAS_BASE_API_URL).replace(\n        '/api/v0',\n        ''\n      ),\n    });\n  } catch (error) {\n    // Best-effort: never break the auth flow (also swallows the assertion\n    // from isDynamicWaasEnabled when project settings are not loaded yet).\n    core.logger.warn('[preconnectWaasIframe] skipped', error);\n  }\n};\n","import type { User } from '../../user/user.types';\n\n/**\n * Checks if device registration is required for the given user.\n *\n * This function determines if the user has the deviceRegistration\n * scope, indicating that device registration is required.\n *\n * @param user - The user to check.\n * @returns True if device registration is required, false otherwise.\n * @notInstrumented\n * @hook Exposed as a hook so consumers reactively know when this device must be registered, updated when the user changes.\n */\nexport const isDeviceRegistrationRequired = (user: User): boolean =>\n  Boolean(user.scope?.includes('device:register'));\n","import { MfaBackupCodeAcknowledgement } from '@dynamic-labs/sdk-api-core';\n\nimport { getDefaultClient } from '../../../client/defaultClient';\nimport { assertDefined } from '../../../utils/assertDefined';\n\n/**\n * Checks if the user is still pending acknowledgment of their MFA recovery codes.\n *\n * This function determines whether the user has been presented with recovery\n * codes that they have not yet acknowledged as saved or backed up.\n *\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns True if recovery codes are pending acknowledgment, false otherwise.\n * @notInstrumented\n * @hook Exposed as a hook so consumers reactively know when recovery codes await acknowledgment, updated when the user changes.\n */\nexport const isPendingRecoveryCodesAcknowledgment = (\n  client = getDefaultClient()\n): boolean => {\n  const user = client.user;\n\n  assertDefined(user, 'User not logged in');\n\n  return (\n    user.mfaBackupCodeAcknowledgement === MfaBackupCodeAcknowledgement.Pending\n  );\n};\n","import { getDefaultClient } from '../../../client/defaultClient';\nimport { assertDefined } from '../../../utils/assertDefined';\nimport { isDeviceRegistrationRequired } from '../../deviceRegistration/isDeviceRegistrationRequired';\nimport { isPendingRecoveryCodesAcknowledgment } from '../../mfa/isPendingRecoveryCodesAcknowledgment';\nimport { isUserMissingMfaAuth } from '../../mfa/isUserMissingMfaAuth';\n\n/**\n * Checks if the user has completed all onboarding requirements.\n *\n * This function verifies whether a user has fulfilled all necessary requirements\n * including KYC fields (Know Your Customer information), MFA setup\n * (Multi-Factor Authentication including recovery codes acknowledgment), and\n * device registration.\n *\n * A `false` result means the user still has an outstanding onboarding step, so\n * any feature that requires a fully onboarded (`user:basic`) user should hold\n * off until it returns `true`. Creating or accessing an embedded (WaaS) wallet\n * is one such feature — its backend calls reject a pre-`user:basic` token — but\n * this predicate is general and not specific to embedded wallets.\n *\n * @deprecated Use {@link checkUserScopes} instead. This function conflates\n * Dynamic-controlled requirements (MFA, device registration, required fields)\n * with the concept of \"onboarding complete\", which is app-specific. Replace\n * with `checkUserScopes({ user, scopes: ['user:basic'] })` to check whether\n * Dynamic's requirements are satisfied, and compose your own logic on top for\n * any app-specific onboarding steps.\n *\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns True if onboarding is complete (no pending requirements), false if there are pending requirements.\n * @notInstrumented\n * @hook Exposed as a hook so consumers reactively know when onboarding is complete, updated when the user changes.\n */\nexport const isUserOnboardingComplete = (\n  client = getDefaultClient()\n): boolean => {\n  const user = client.user;\n\n  assertDefined(user, 'User not logged in');\n\n  const hasMissingKycFields = Boolean(user.missingFields?.length);\n  const hasPendingMfaAuth = isUserMissingMfaAuth(client);\n  const hasPendingRecoveryCodes = isPendingRecoveryCodesAcknowledgment(client);\n  const hasPendingDeviceRegistration = isDeviceRegistrationRequired(user);\n\n  const userOnboardingComplete =\n    !hasMissingKycFields &&\n    !hasPendingMfaAuth &&\n    !hasPendingRecoveryCodes &&\n    !hasPendingDeviceRegistration;\n\n  return userOnboardingComplete;\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAwCA,IAAa,sBAAb,cAAyC,UAAU;CACjD,AAAS;CAET,YAAY,EAAE,SAA2B;AACvC,QAAM;GACJ;GACA,MAAM;GACN,SAAS;GACT,MAAM;GACN,cACE;GACH,CAAC;AACF,OAAK,SAAS;;;;;;;;;;;;;;;;;;;ACrClB,IAAa,gCAAb,cAAmD,UAAU;CAC3D,cAAc;AACZ,QAAM;GACJ,OAAO;GACP,MAAM;GACN,SAAS;GACT,MAAM;GACN,cACE;GACH,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;ACON,IAAa,gCAAb,cAAmD,UAAU;CAC3D,YAAY,EAAE,SAA2B;AACvC,QAAM;GACJ;GACA,MAAM;GACN,SAAS;GACT,MAAM;GACN,cACE;GACH,CAAC;;;;;;;;;;;;;;;;ACrBN,MAAaA,0BAAwB,WAAgC;CACnE,MAAM,OAAO,QAAQ,OAAO;AAC5B,KAAI;AACF,MAAI,CAAC,qBAAqB,OAAO,CAAE;AAEnC,uBAA2B;GACzB,UAAW,gBAAgB,OAAO,GAAG,WAAW;GAChD,aAAa,KAAK,cAAc,2BAA2B,QACzD,WACA,GACD;GACF,CAAC;UACK,OAAO;AAGd,OAAK,OAAO,KAAK,kCAAkC,MAAM;;;;;;;;;;;;;;;;;ACrB7D,MAAa,gCAAgC,SAC3C,QAAQ,KAAK,OAAO,SAAS,kBAAkB,CAAC;;;;;;;;;;;;;;;ACElD,MAAa,wCACX,SAAS,kBAAkB,KACf;CACZ,MAAM,OAAO,OAAO;AAEpB,eAAc,MAAM,qBAAqB;AAEzC,QACE,KAAK,iCAAiC,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;ACQvE,MAAa,4BACX,SAAS,kBAAkB,KACf;CACZ,MAAM,OAAO,OAAO;AAEpB,eAAc,MAAM,qBAAqB;CAEzC,MAAM,sBAAsB,QAAQ,KAAK,eAAe,OAAO;CAC/D,MAAM,oBAAoB,qBAAqB,OAAO;CACtD,MAAM,0BAA0B,qCAAqC,OAAO;CAC5E,MAAM,+BAA+B,6BAA6B,KAAK;AAQvE,QALE,CAAC,uBACD,CAAC,qBACD,CAAC,2BACD,CAAC"}
+{"version":3,"file":"isUserOnboardingComplete-CEUkAzCi.native.esm.js","names":["preconnectWaasIframe"],"sources":["../src/errors/WaasLoadFailedError.ts","../src/errors/WaasOnboardingIncompleteError.ts","../src/errors/WaasRbacStaleRetryUnsafeError.ts","../src/modules/waas/preconnectWaasIframe/preconnectWaasIframe.ts","../src/modules/deviceRegistration/isDeviceRegistrationRequired/isDeviceRegistrationRequired.ts","../src/modules/mfa/isPendingRecoveryCodesAcknowledgment/isPendingRecoveryCodesAcknowledgment.ts","../src/modules/user/isUserOnboardingComplete/isUserOnboardingComplete.ts"],"sourcesContent":["import { BaseError } from './base';\n\n/**\n * Why the embedded wallet load failed. Currently only retry exhaustion is\n * reported; the union exists so new reasons can be added without a breaking\n * change to consumer `instanceof` handling.\n *\n * @example\n * ```ts\n * const reason: WaasLoadFailedErrorReason = 'load_attempts_exhausted';\n * ```\n * @see WaasLoadFailedError\n * @see signMessage\n */\nexport type WaasLoadFailedErrorReason = 'load_attempts_exhausted';\n\n/**\n * Thrown when the embedded (WaaS) wallet's secure container failed to load\n * after exhausting all of its internal retry attempts.\n *\n * This failure is transient: the next wallet operation triggers a fresh load\n * cycle, so hosts can catch this error and re-attempt the operation at their\n * own cadence (for example, when connectivity returns or the app is\n * foregrounded). Other load failures (for example, a CSP block) are not\n * wrapped by this error and their shape is not guaranteed.\n *\n * @example\n * ```ts\n * try {\n *   await signMessage({ message, walletAccount });\n * } catch (error) {\n *   if (error instanceof WaasLoadFailedError) {\n *     // transient — retry the operation at your own cadence\n *     await signMessage({ message, walletAccount });\n *   }\n * }\n * ```\n * @see WaasLoadFailedErrorReason\n * @see signMessage\n */\nexport class WaasLoadFailedError extends BaseError {\n  readonly reason: WaasLoadFailedErrorReason;\n\n  constructor({ cause }: { cause: Error }) {\n    super({\n      cause,\n      code: 'waas_load_failed',\n      docsUrl: null,\n      name: 'WaasLoadFailedError',\n      shortMessage:\n        'The embedded wallet failed to load after exhausting its retry attempts. Retrying the wallet operation triggers a fresh load.',\n    });\n    this.reason = 'load_attempts_exhausted';\n  }\n}\n","import { BaseError } from './base';\n\n/**\n * Thrown when the embedded (WaaS) wallet client is requested before the user\n * has completed onboarding — i.e. the JWT has not upgraded to `user:basic`\n * because MFA, KYC, recovery-codes acknowledgment, or device registration is\n * still pending.\n *\n * The WaaS iframe's init-time room-cache pre-warm fires `createRooms` using the\n * token captured at client construction (before any per-operation token\n * resync). Building the client during this window lets that pre-warm fire with\n * a pre-`user:basic` token, get a 401, and the iframe's unauthorized handler\n * force-logs-out the user. Throwing here surfaces a clear, recoverable reason\n * instead — wait for onboarding to complete and retry.\n */\nexport class WaasOnboardingIncompleteError extends BaseError {\n  constructor() {\n    super({\n      cause: null,\n      code: 'waas_onboarding_incomplete',\n      docsUrl: null,\n      name: 'WaasOnboardingIncompleteError',\n      shortMessage:\n        'Cannot create or access the embedded wallet until onboarding is complete (pending MFA, KYC, recovery-codes acknowledgment, or device registration).',\n    });\n  }\n}\n","import { BaseError } from './base';\n\n/**\n * Thrown when a WaaS ceremony operation (sign, export, reshare, create\n * wallet) receives a 403 `rbac_stale` response after the attempt has already\n * spent its one-time authorization — either the legacy MFA token or a\n * single-use elevated access token.\n *\n * The SDK cannot safely retry in that case: the restarted attempt would find\n * the approval already consumed and fail deeper in the stack with an\n * unrelated \"no MFA token\" error, hiding the permission change that actually\n * caused the failure. Surfacing this error instead tells the host exactly what\n * happened. Recover by re-running the step-up/MFA flow and retrying the\n * operation; the business-account role change has already taken effect, so the\n * retry is evaluated against the caller's current permissions.\n *\n * @example\n * ```ts\n * try {\n *   await signMessage({ message, walletAccount });\n * } catch (error) {\n *   if (error instanceof WaasRbacStaleRetryUnsafeError) {\n *     // The one-time approval was spent; re-verify before trying again.\n *     await promptStepUp();\n *     await signMessage({ message, walletAccount });\n *   }\n * }\n * ```\n * @see WaasLoadFailedError\n * @see signMessage\n */\nexport class WaasRbacStaleRetryUnsafeError extends BaseError {\n  constructor({ cause }: { cause: Error }) {\n    super({\n      cause,\n      code: 'waas_rbac_stale_retry_unsafe',\n      docsUrl: null,\n      name: 'WaasRbacStaleRetryUnsafeError',\n      shortMessage:\n        'The business account role change could not be retried automatically because a one-time authorization was already consumed. Re-authenticate and retry the operation.',\n    });\n  }\n}\n","import type { AuthMode } from '@dynamic-labs-wallet/browser-wallet-client';\nimport { preconnectWaasIframe as preconnectWaasIframeOrigin } from '@dynamic-labs-wallet/browser-wallet-client';\n\nimport { getCore } from '../../../client/core/getCore';\nimport type { DynamicClient } from '../../../client/types';\nimport { isCookieEnabled } from '../../projectSettings/isCookieEnabled';\nimport { DEFAULT_WAAS_BASE_API_URL } from '../constants';\nimport { isDynamicWaasEnabled } from '../isDynamicWaasEnabled';\n\n/**\n * Warms the browser's connection (DNS + TCP + TLS) to the embedded-wallet\n * iframe origin so the iframe mounted after authentication completes loads on\n * a hot connection. Called when an auth flow starts (OTP send/verify, social\n * callback). Safe to call repeatedly; no-op on React Native / SSR and when\n * Dynamic WaaS is not enabled.\n *\n * @param client - The Dynamic client instance.\n * @notInstrumented\n */\nexport const preconnectWaasIframe = (client: DynamicClient): void => {\n  const core = getCore(client);\n  try {\n    if (!isDynamicWaasEnabled(client)) return;\n\n    preconnectWaasIframeOrigin({\n      authMode: (isCookieEnabled(client) ? 'cookie' : 'header') as AuthMode,\n      baseApiUrl: (core.apiBaseUrl || DEFAULT_WAAS_BASE_API_URL).replace(\n        '/api/v0',\n        ''\n      ),\n    });\n  } catch (error) {\n    // Best-effort: never break the auth flow (also swallows the assertion\n    // from isDynamicWaasEnabled when project settings are not loaded yet).\n    core.logger.warn('[preconnectWaasIframe] skipped', error);\n  }\n};\n","import type { User } from '../../user/user.types';\n\n/**\n * Checks if device registration is required for the given user.\n *\n * This function determines if the user has the deviceRegistration\n * scope, indicating that device registration is required.\n *\n * @param user - The user to check.\n * @returns True if device registration is required, false otherwise.\n * @notInstrumented\n * @hook Exposed as a hook so consumers reactively know when this device must be registered, updated when the user changes.\n */\nexport const isDeviceRegistrationRequired = (user: User): boolean =>\n  Boolean(user.scope?.includes('device:register'));\n","import { MfaBackupCodeAcknowledgement } from '@dynamic-labs/sdk-api-core';\n\nimport { getDefaultClient } from '../../../client/defaultClient';\nimport { assertDefined } from '../../../utils/assertDefined';\n\n/**\n * Checks if the user is still pending acknowledgment of their MFA recovery codes.\n *\n * This function determines whether the user has been presented with recovery\n * codes that they have not yet acknowledged as saved or backed up.\n *\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns True if recovery codes are pending acknowledgment, false otherwise.\n * @notInstrumented\n * @hook Exposed as a hook so consumers reactively know when recovery codes await acknowledgment, updated when the user changes.\n */\nexport const isPendingRecoveryCodesAcknowledgment = (\n  client = getDefaultClient()\n): boolean => {\n  const user = client.user;\n\n  assertDefined(user, 'User not logged in');\n\n  return (\n    user.mfaBackupCodeAcknowledgement === MfaBackupCodeAcknowledgement.Pending\n  );\n};\n","import { getDefaultClient } from '../../../client/defaultClient';\nimport { assertDefined } from '../../../utils/assertDefined';\nimport { isDeviceRegistrationRequired } from '../../deviceRegistration/isDeviceRegistrationRequired';\nimport { isPendingRecoveryCodesAcknowledgment } from '../../mfa/isPendingRecoveryCodesAcknowledgment';\nimport { isUserMissingMfaAuth } from '../../mfa/isUserMissingMfaAuth';\n\n/**\n * Checks if the user has completed all onboarding requirements.\n *\n * This function verifies whether a user has fulfilled all necessary requirements\n * including KYC fields (Know Your Customer information), MFA setup\n * (Multi-Factor Authentication including recovery codes acknowledgment), and\n * device registration.\n *\n * A `false` result means the user still has an outstanding onboarding step, so\n * any feature that requires a fully onboarded (`user:basic`) user should hold\n * off until it returns `true`. Creating or accessing an embedded (WaaS) wallet\n * is one such feature — its backend calls reject a pre-`user:basic` token — but\n * this predicate is general and not specific to embedded wallets.\n *\n * @deprecated Use {@link checkUserScopes} instead. This function conflates\n * Dynamic-controlled requirements (MFA, device registration, required fields)\n * with the concept of \"onboarding complete\", which is app-specific. Replace\n * with `checkUserScopes({ user, scopes: ['user:basic'] })` to check whether\n * Dynamic's requirements are satisfied, and compose your own logic on top for\n * any app-specific onboarding steps.\n *\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns True if onboarding is complete (no pending requirements), false if there are pending requirements.\n * @notInstrumented\n * @hook Exposed as a hook so consumers reactively know when onboarding is complete, updated when the user changes.\n */\nexport const isUserOnboardingComplete = (\n  client = getDefaultClient()\n): boolean => {\n  const user = client.user;\n\n  assertDefined(user, 'User not logged in');\n\n  const hasMissingKycFields = Boolean(user.missingFields?.length);\n  const hasPendingMfaAuth = isUserMissingMfaAuth(client);\n  const hasPendingRecoveryCodes = isPendingRecoveryCodesAcknowledgment(client);\n  const hasPendingDeviceRegistration = isDeviceRegistrationRequired(user);\n\n  const userOnboardingComplete =\n    !hasMissingKycFields &&\n    !hasPendingMfaAuth &&\n    !hasPendingRecoveryCodes &&\n    !hasPendingDeviceRegistration;\n\n  return userOnboardingComplete;\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAwCA,IAAa,sBAAb,cAAyC,UAAU;CACjD,AAAS;CAET,YAAY,EAAE,SAA2B;AACvC,QAAM;GACJ;GACA,MAAM;GACN,SAAS;GACT,MAAM;GACN,cACE;GACH,CAAC;AACF,OAAK,SAAS;;;;;;;;;;;;;;;;;;;ACrClB,IAAa,gCAAb,cAAmD,UAAU;CAC3D,cAAc;AACZ,QAAM;GACJ,OAAO;GACP,MAAM;GACN,SAAS;GACT,MAAM;GACN,cACE;GACH,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;ACON,IAAa,gCAAb,cAAmD,UAAU;CAC3D,YAAY,EAAE,SAA2B;AACvC,QAAM;GACJ;GACA,MAAM;GACN,SAAS;GACT,MAAM;GACN,cACE;GACH,CAAC;;;;;;;;;;;;;;;;ACrBN,MAAaA,0BAAwB,WAAgC;CACnE,MAAM,OAAO,QAAQ,OAAO;AAC5B,KAAI;AACF,MAAI,CAAC,qBAAqB,OAAO,CAAE;AAEnC,uBAA2B;GACzB,UAAW,gBAAgB,OAAO,GAAG,WAAW;GAChD,aAAa,KAAK,cAAc,2BAA2B,QACzD,WACA,GACD;GACF,CAAC;UACK,OAAO;AAGd,OAAK,OAAO,KAAK,kCAAkC,MAAM;;;;;;;;;;;;;;;;;ACrB7D,MAAa,gCAAgC,SAC3C,QAAQ,KAAK,OAAO,SAAS,kBAAkB,CAAC;;;;;;;;;;;;;;;ACElD,MAAa,wCACX,SAAS,kBAAkB,KACf;CACZ,MAAM,OAAO,OAAO;AAEpB,eAAc,MAAM,qBAAqB;AAEzC,QACE,KAAK,iCAAiC,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;ACQvE,MAAa,4BACX,SAAS,kBAAkB,KACf;CACZ,MAAM,OAAO,OAAO;AAEpB,eAAc,MAAM,qBAAqB;CAEzC,MAAM,sBAAsB,QAAQ,KAAK,eAAe,OAAO;CAC/D,MAAM,oBAAoB,qBAAqB,OAAO;CACtD,MAAM,0BAA0B,qCAAqC,OAAO;CAC5E,MAAM,+BAA+B,6BAA6B,KAAK;AAQvE,QALE,CAAC,uBACD,CAAC,qBACD,CAAC,2BACD,CAAC"}

package/dist/{logoutWithReason-yDqQ0UIt.cjs → logoutWithReason-B-ZF0VmN.cjs}

@@ -31,7 +31,7 @@ zod_mini = __toESM(zod_mini);
 
 //#region package.json
 var name = "@dynamic-labs-sdk/client";
-var version = "1.32.0";
+var version = "1.33.0";
 
 //#endregion
 //#region src/modules/auth/consts.ts
@@ -295,6 +295,12 @@ const dependencyCatalog = { "@dynamic-labs/sdk-api-core": "0.25.0" };
 //#region src/constants.ts
 const SDK_API_CORE_VERSION = dependencyCatalog["@dynamic-labs/sdk-api-core"];
 const DYNAMIC_ICONIC_SPRITE_URL = "https://iconic.dynamic-static-assets.com/icons/sprite.svg";
+/**
+* Wire codes the SDK API returns when wallet screening blocks a request. A
+* wallet can be blocked by any screening provider or policy, and the
+* provider-specific code is still emitted by older backends.
+*/
+const SCREENING_BLOCKED_WALLET_ERROR_CODES = ["screening_blocked_wallet", "chainalysis_blocked_wallet"];
 
 //#endregion
 //#region src/modules/apiClient/constants.ts
@@ -1976,7 +1982,7 @@ const safeSelect = ({ functionName, logger, piiFields, selector, value }) => {
 * const transfer = instrumentFunction({
 *   fn: rawTransfer,
 *   functionName: 'transfer',
-*   getCore: () => core,
+*   getCore: (args) => resolveInstrumentationCore(args),
 *   selectors: {
 *     // `args` is the argument tuple the wrapped function was called with.
 *     started: ([{ chainId, amount }]) => ({ amount, chainId }),
@@ -2004,7 +2010,7 @@ const safeSelect = ({ functionName, logger, piiFields, selector, value }) => {
 */
 const instrumentFunction = ({ fn, functionName, getCore: getCore$1, selectors }) => {
 	const wrapped = (...args) => {
-		const core = getCore$1();
+		const core = getCore$1(args);
 		if (!core?.instrumentation.config.enabled) return fn(...args);
 		const { instrumentation, logger } = core;
 		const { piiFields } = instrumentation.config;
@@ -2071,6 +2077,39 @@ const instrumentFunction = ({ fn, functionName, getCore: getCore$1, selectors })
 	return wrapped;
 };
 
+//#endregion
+//#region src/services/instrumentation/resolveInstrumentationCore/resolveInstrumentationCore.ts
+const isDynamicClient = (value) => {
+	if (typeof value !== "object" || value === null || !("__core" in value)) return false;
+	const core = value.__core;
+	return typeof core === "object" && core !== null && "instrumentation" in core && "state" in core;
+};
+/**
+* Resolves the instrumentation core from invocation arguments so telemetry is
+* attributed to the client actually serving the call. Returns `undefined`
+* when no client is initialized, such as during SSR or in unit tests, so
+* instrumentation is skipped rather than throwing.
+*
+* @param args - The arguments passed to the instrumented function.
+* @returns The core for the explicit client or the default client.
+* @example
+* ```ts
+* const core = resolveInstrumentationCore([params, client]);
+* ```
+* @see DynamicClient
+* @see instrumentFunction
+* @notInstrumented
+*/
+const resolveInstrumentationCore = (args) => {
+	const clientArg = args.find(isDynamicClient);
+	if (clientArg) return getCore(clientArg);
+	try {
+		return getCore(getDefaultClient());
+	} catch {
+		return;
+	}
+};
+
 //#endregion
 //#region src/modules/user/refreshAuth/refreshAuth.ts
 /**
@@ -2107,13 +2146,7 @@ const __refreshAuth_impl = refreshAuth;
 const __refreshAuth_wrapped = instrumentFunction({
 	fn: __refreshAuth_impl,
 	functionName: "refreshAuth",
-	getCore: () => {
-		try {
-			return getCore(getDefaultClient());
-		} catch {
-			return;
-		}
-	}
+	getCore: resolveInstrumentationCore
 });
 
 //#endregion
@@ -2445,13 +2478,7 @@ const __logoutWithReason_impl = logoutWithReason;
 const __logoutWithReason_wrapped = instrumentFunction({
 	fn: __logoutWithReason_impl,
 	functionName: "logoutWithReason",
-	getCore: () => {
-		try {
-			return getCore(getDefaultClient());
-		} catch {
-			return;
-		}
-	}
+	getCore: resolveInstrumentationCore
 });
 
 //#endregion
@@ -2563,6 +2590,12 @@ Object.defineProperty(exports, 'NoWalletProviderFoundError', {
     return NoWalletProviderFoundError;
   }
 });
+Object.defineProperty(exports, 'SCREENING_BLOCKED_WALLET_ERROR_CODES', {
+  enumerable: true,
+  get: function () {
+    return SCREENING_BLOCKED_WALLET_ERROR_CODES;
+  }
+});
 Object.defineProperty(exports, 'SDK_API_CORE_VERSION', {
   enumerable: true,
   get: function () {
@@ -2893,6 +2926,12 @@ Object.defineProperty(exports, 'randomString', {
     return randomString;
   }
 });
+Object.defineProperty(exports, 'resolveInstrumentationCore', {
+  enumerable: true,
+  get: function () {
+    return resolveInstrumentationCore;
+  }
+});
 Object.defineProperty(exports, 'retryOnFail', {
   enumerable: true,
   get: function () {
@@ -2941,4 +2980,4 @@ Object.defineProperty(exports, 'version', {
     return version;
   }
 });
-//# sourceMappingURL=logoutWithReason-yDqQ0UIt.cjs.map
+//# sourceMappingURL=logoutWithReason-B-ZF0VmN.cjs.map