@dynamic-labs-sdk/client 1.33.1 → 1.33.3

package/dist/{isMfaRequiredForAction-D7b7mUT9.native.esm.js → isMfaRequiredForAction-CxYft5KR.native.esm.js}

@@ -1,4 +1,4 @@
-import { Ct as getCore, a as resolveInstrumentationCore, bt as getDefaultClient, ht as assertDefined, o as instrumentFunction, r as createApiClient, wt as BaseError } from "./apiClient-BbjPoAwE.native.esm.js";
+import { Ct as getCore, a as resolveInstrumentationCore, bt as getDefaultClient, ht as assertDefined, o as instrumentFunction, r as createApiClient, wt as BaseError } from "./apiClient-CpfEx6Uc.native.esm.js";
 
 //#region src/errors/NativeModuleNotLinkedError.ts
 var NativeModuleNotLinkedError = class extends BaseError {
@@ -97,4 +97,4 @@ const isMfaRequiredForAction = async ({ mfaAction }, client = getDefaultClient()
 
 //#endregion
 export { NativeModuleNotLinkedError as i, getMfaMethods as n, __consumeMfaToken_wrapped as r, isMfaRequiredForAction as t };
-//# sourceMappingURL=isMfaRequiredForAction-D7b7mUT9.native.esm.js.map
+//# sourceMappingURL=isMfaRequiredForAction-CxYft5KR.native.esm.js.map

package/dist/{isMfaRequiredForAction-D7b7mUT9.native.esm.js.map → isMfaRequiredForAction-CxYft5KR.native.esm.js.map}

@@ -1 +1 @@
-{"version":3,"file":"isMfaRequiredForAction-D7b7mUT9.native.esm.js","names":[],"sources":["../src/errors/NativeModuleNotLinkedError.ts","../src/modules/mfa/consumeMfaToken/consumeMfaToken.ts","../src/modules/mfa/getMfaMethods/getMfaMethods.ts","../src/modules/mfa/isMfaRequiredForAction/isMfaRequiredForAction.ts"],"sourcesContent":["import { BaseError } from './base';\n\ntype NativeModuleNotLinkedErrorParams = {\n  moduleName: string;\n};\n\nexport class NativeModuleNotLinkedError extends BaseError {\n  constructor({ moduleName }: NativeModuleNotLinkedErrorParams) {\n    super({\n      cause: null,\n      code: 'native_module_not_linked_error',\n      details: [\n        `The \"${moduleName}\" TurboModule is not registered with React Native.`,\n        'This usually means the native module was not autolinked into the host app,',\n        'or the app binary was not rebuilt after installing the SDK.',\n        '',\n        'To resolve:',\n        '  1. Ensure \"@dynamic-labs-sdk/client\" is a direct dependency of the app',\n        '     and reinstall (e.g. `pnpm install`).',\n        '  2. Rebuild the native app:',\n        '       iOS:     `cd ios && pod install && cd .. && npx react-native run-ios`',\n        '       Android: `npx react-native run-android`',\n        '       Expo:    `npx expo prebuild --clean` then run the app.',\n        '  3. Confirm autolinking sees the package:',\n        '       `npx expo-modules-autolinking react-native-config --json`',\n      ].join('\\n'),\n      docsUrl: null,\n      name: 'NativeModuleNotLinkedError',\n      shortMessage: `Native TurboModule \"${moduleName}\" is not linked.`,\n    });\n  }\n}\n","import { getCore } from '../../../client/core/getCore';\nimport { getDefaultClient } from '../../../client/defaultClient';\nimport { assertDefined } from '../../../utils/assertDefined';\n\n/**\n * Consumes and clears the current MFA token from the client state.\n *\n * This function retrieves the MFA token obtained from a successful MFA authentication,\n * and removes it from the client, to prevent it from being used again.\n *\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns The MFA token that was consumed.\n * @throws Error if no MFA token is found.\n * @instrumented\n */\nexport const consumeMfaToken = (client = getDefaultClient()): string => {\n  const core = getCore(client);\n\n  const mfaToken = core.state.get().mfaToken;\n\n  assertDefined(mfaToken, 'No MFA token found');\n\n  core.state.set({\n    mfaToken: null,\n  });\n\n  return mfaToken;\n};\n","import { getCore } from '../../../client/core/getCore';\nimport { getDefaultClient } from '../../../client/defaultClient';\nimport { createApiClient } from '../../apiClient';\nimport type { MFAMethodsResponse } from '../mfa.types';\n\n/**\n * Retrieves the available MFA methods for the current user.\n *\n * This function fetches information about which multi-factor authentication\n * methods are available and configured for the user's account.\n *\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns A promise that resolves to the user's MFA methods configuration.\n * @notInstrumented\n */\nexport const getMfaMethods = async (\n  client = getDefaultClient()\n): Promise<MFAMethodsResponse> => {\n  const core = getCore(client);\n  const apiClient = createApiClient({}, client);\n\n  const userMfaMethods = await apiClient.getUserMfaMethods({\n    environmentId: core.environmentId,\n    verifiedOnly: true,\n  });\n\n  return userMfaMethods;\n};\n","import { getDefaultClient } from '../../../client/defaultClient';\nimport type { MFAAction } from '../mfa.consts';\nimport { getMfaMethods } from '../getMfaMethods';\n\ntype IsMfaRequiredForActionParams = {\n  mfaAction: MFAAction;\n};\n\n/**\n * Checks if MFA is required for a specific action.\n *\n * This function determines whether multi-factor authentication is required\n * for the specified action based on project settings and user configuration.\n *\n * @param params.mfaAction - The action to check MFA requirements for.\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns A promise that resolves to true if MFA is required for the action, false otherwise.\n * @notInstrumented\n */\nexport const isMfaRequiredForAction = async (\n  { mfaAction }: IsMfaRequiredForActionParams,\n  client = getDefaultClient()\n): Promise<boolean> => {\n  const projectSettings = client.projectSettings;\n\n  const isRequiredForAction = projectSettings?.security?.mfa?.actions?.some(\n    (action) => action.action === mfaAction && action.required\n  );\n\n  // if mfa is not required for the action, return false\n  // no matter if general mfa is set to required or not\n  if (!isRequiredForAction) {\n    return false;\n  }\n\n  const isMfaMethodRequired = projectSettings?.security?.mfa?.required;\n\n  // if mfa is required for the action and also set as required in general, return true\n  if (isMfaMethodRequired) {\n    return true;\n  }\n\n  const mfaMethods = await getMfaMethods(client);\n  // if general mfa is optional, but user has registered methods,\n  // then it should be required for the action\n  return mfaMethods.userHasVerifiedMfaMethods;\n};\n"],"mappings":";;;AAMA,IAAa,6BAAb,cAAgD,UAAU;CACxD,YAAY,EAAE,cAAgD;AAC5D,QAAM;GACJ,OAAO;GACP,MAAM;GACN,SAAS;IACP,QAAQ,WAAW;IACnB;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACD,CAAC,KAAK,KAAK;GACZ,SAAS;GACT,MAAM;GACN,cAAc,uBAAuB,WAAW;GACjD,CAAC;;;;;;;;;;;;;;;;;;CCXJ,MAAM,OAAA,QAAe,OAAO;CAE5B,MAAA,WAAc,KAAQ,MAAM,KAAI,CAAA;AAEhC,eAAc,UAAC,qBAAA;AAEf,MAAE,MAAA,IAAA,kBAEF,CAAA;;;;;;;;;;;;;;;;;;;;;;ACXF,MAAa,gBAAgB,OAC3B,SAAS,kBAAkB,KACK;CAChC,MAAM,OAAO,QAAQ,OAAO;AAQ5B,QALuB,MAFL,gBAAgB,EAAE,EAAE,OAAO,CAEN,kBAAkB;EACvD,eAAe,KAAK;EACpB,cAAc;EACf,CAAC;;;;;;;;;;;;;;;;ACLJ,MAAa,yBAAyB,OACpC,EAAE,aACF,SAAS,kBAAkB,KACN;CACrB,MAAM,kBAAkB,OAAO;AAQ/B,KAAI,CANwB,iBAAiB,UAAU,KAAK,SAAS,MAClE,WAAW,OAAO,WAAW,aAAa,OAAO,SACnD,CAKC,QAAO;AAMT,KAH4B,iBAAiB,UAAU,KAAK,SAI1D,QAAO;AAMT,SAHmB,MAAM,cAAc,OAAO,EAG5B"}
+{"version":3,"file":"isMfaRequiredForAction-CxYft5KR.native.esm.js","names":[],"sources":["../src/errors/NativeModuleNotLinkedError.ts","../src/modules/mfa/consumeMfaToken/consumeMfaToken.ts","../src/modules/mfa/getMfaMethods/getMfaMethods.ts","../src/modules/mfa/isMfaRequiredForAction/isMfaRequiredForAction.ts"],"sourcesContent":["import { BaseError } from './base';\n\ntype NativeModuleNotLinkedErrorParams = {\n  moduleName: string;\n};\n\nexport class NativeModuleNotLinkedError extends BaseError {\n  constructor({ moduleName }: NativeModuleNotLinkedErrorParams) {\n    super({\n      cause: null,\n      code: 'native_module_not_linked_error',\n      details: [\n        `The \"${moduleName}\" TurboModule is not registered with React Native.`,\n        'This usually means the native module was not autolinked into the host app,',\n        'or the app binary was not rebuilt after installing the SDK.',\n        '',\n        'To resolve:',\n        '  1. Ensure \"@dynamic-labs-sdk/client\" is a direct dependency of the app',\n        '     and reinstall (e.g. `pnpm install`).',\n        '  2. Rebuild the native app:',\n        '       iOS:     `cd ios && pod install && cd .. && npx react-native run-ios`',\n        '       Android: `npx react-native run-android`',\n        '       Expo:    `npx expo prebuild --clean` then run the app.',\n        '  3. Confirm autolinking sees the package:',\n        '       `npx expo-modules-autolinking react-native-config --json`',\n      ].join('\\n'),\n      docsUrl: null,\n      name: 'NativeModuleNotLinkedError',\n      shortMessage: `Native TurboModule \"${moduleName}\" is not linked.`,\n    });\n  }\n}\n","import { getCore } from '../../../client/core/getCore';\nimport { getDefaultClient } from '../../../client/defaultClient';\nimport { assertDefined } from '../../../utils/assertDefined';\n\n/**\n * Consumes and clears the current MFA token from the client state.\n *\n * This function retrieves the MFA token obtained from a successful MFA authentication,\n * and removes it from the client, to prevent it from being used again.\n *\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns The MFA token that was consumed.\n * @throws Error if no MFA token is found.\n * @instrumented\n */\nexport const consumeMfaToken = (client = getDefaultClient()): string => {\n  const core = getCore(client);\n\n  const mfaToken = core.state.get().mfaToken;\n\n  assertDefined(mfaToken, 'No MFA token found');\n\n  core.state.set({\n    mfaToken: null,\n  });\n\n  return mfaToken;\n};\n","import { getCore } from '../../../client/core/getCore';\nimport { getDefaultClient } from '../../../client/defaultClient';\nimport { createApiClient } from '../../apiClient';\nimport type { MFAMethodsResponse } from '../mfa.types';\n\n/**\n * Retrieves the available MFA methods for the current user.\n *\n * This function fetches information about which multi-factor authentication\n * methods are available and configured for the user's account.\n *\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns A promise that resolves to the user's MFA methods configuration.\n * @notInstrumented\n */\nexport const getMfaMethods = async (\n  client = getDefaultClient()\n): Promise<MFAMethodsResponse> => {\n  const core = getCore(client);\n  const apiClient = createApiClient({}, client);\n\n  const userMfaMethods = await apiClient.getUserMfaMethods({\n    environmentId: core.environmentId,\n    verifiedOnly: true,\n  });\n\n  return userMfaMethods;\n};\n","import { getDefaultClient } from '../../../client/defaultClient';\nimport type { MFAAction } from '../mfa.consts';\nimport { getMfaMethods } from '../getMfaMethods';\n\ntype IsMfaRequiredForActionParams = {\n  mfaAction: MFAAction;\n};\n\n/**\n * Checks if MFA is required for a specific action.\n *\n * This function determines whether multi-factor authentication is required\n * for the specified action based on project settings and user configuration.\n *\n * @param params.mfaAction - The action to check MFA requirements for.\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns A promise that resolves to true if MFA is required for the action, false otherwise.\n * @notInstrumented\n */\nexport const isMfaRequiredForAction = async (\n  { mfaAction }: IsMfaRequiredForActionParams,\n  client = getDefaultClient()\n): Promise<boolean> => {\n  const projectSettings = client.projectSettings;\n\n  const isRequiredForAction = projectSettings?.security?.mfa?.actions?.some(\n    (action) => action.action === mfaAction && action.required\n  );\n\n  // if mfa is not required for the action, return false\n  // no matter if general mfa is set to required or not\n  if (!isRequiredForAction) {\n    return false;\n  }\n\n  const isMfaMethodRequired = projectSettings?.security?.mfa?.required;\n\n  // if mfa is required for the action and also set as required in general, return true\n  if (isMfaMethodRequired) {\n    return true;\n  }\n\n  const mfaMethods = await getMfaMethods(client);\n  // if general mfa is optional, but user has registered methods,\n  // then it should be required for the action\n  return mfaMethods.userHasVerifiedMfaMethods;\n};\n"],"mappings":";;;AAMA,IAAa,6BAAb,cAAgD,UAAU;CACxD,YAAY,EAAE,cAAgD;AAC5D,QAAM;GACJ,OAAO;GACP,MAAM;GACN,SAAS;IACP,QAAQ,WAAW;IACnB;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACD,CAAC,KAAK,KAAK;GACZ,SAAS;GACT,MAAM;GACN,cAAc,uBAAuB,WAAW;GACjD,CAAC;;;;;;;;;;;;;;;;;;CCXJ,MAAM,OAAA,QAAe,OAAO;CAE5B,MAAA,WAAc,KAAQ,MAAM,KAAI,CAAA;AAEhC,eAAc,UAAC,qBAAA;AAEf,MAAE,MAAA,IAAA,kBAEF,CAAA;;;;;;;;;;;;;;;;;;;;;;ACXF,MAAa,gBAAgB,OAC3B,SAAS,kBAAkB,KACK;CAChC,MAAM,OAAO,QAAQ,OAAO;AAQ5B,QALuB,MAFL,gBAAgB,EAAE,EAAE,OAAO,CAEN,kBAAkB;EACvD,eAAe,KAAK;EACpB,cAAc;EACf,CAAC;;;;;;;;;;;;;;;;ACLJ,MAAa,yBAAyB,OACpC,EAAE,aACF,SAAS,kBAAkB,KACN;CACrB,MAAM,kBAAkB,OAAO;AAQ/B,KAAI,CANwB,iBAAiB,UAAU,KAAK,SAAS,MAClE,WAAW,OAAO,WAAW,aAAa,OAAO,SACnD,CAKC,QAAO;AAMT,KAH4B,iBAAiB,UAAU,KAAK,SAI1D,QAAO;AAMT,SAHmB,MAAM,cAAc,OAAO,EAG5B"}

package/dist/{isMfaRequiredForAction-DF65MJNN.cjs → isMfaRequiredForAction-Czx-uPFY.cjs}

@@ -1,4 +1,4 @@
-const require_logoutWithReason = require('./logoutWithReason-CFjm8dbR.cjs');
+const require_logoutWithReason = require('./logoutWithReason-BKwWBsCT.cjs');
 
 //#region src/modules/mfa/consumeMfaToken/consumeMfaToken.ts
 /**
@@ -85,4 +85,4 @@ Object.defineProperty(exports, 'isMfaRequiredForAction', {
     return isMfaRequiredForAction;
   }
 });
-//# sourceMappingURL=isMfaRequiredForAction-DF65MJNN.cjs.map
+//# sourceMappingURL=isMfaRequiredForAction-Czx-uPFY.cjs.map

package/dist/{isMfaRequiredForAction-DF65MJNN.cjs.map → isMfaRequiredForAction-Czx-uPFY.cjs.map}

@@ -1 +1 @@
-{"version":3,"file":"isMfaRequiredForAction-DF65MJNN.cjs","names":["getDefaultClient","getCore","createApiClient","getDefaultClient"],"sources":["../src/modules/mfa/consumeMfaToken/consumeMfaToken.ts","../src/modules/mfa/getMfaMethods/getMfaMethods.ts","../src/modules/mfa/isMfaRequiredForAction/isMfaRequiredForAction.ts"],"sourcesContent":["import { getCore } from '../../../client/core/getCore';\nimport { getDefaultClient } from '../../../client/defaultClient';\nimport { assertDefined } from '../../../utils/assertDefined';\n\n/**\n * Consumes and clears the current MFA token from the client state.\n *\n * This function retrieves the MFA token obtained from a successful MFA authentication,\n * and removes it from the client, to prevent it from being used again.\n *\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns The MFA token that was consumed.\n * @throws Error if no MFA token is found.\n * @instrumented\n */\nexport const consumeMfaToken = (client = getDefaultClient()): string => {\n  const core = getCore(client);\n\n  const mfaToken = core.state.get().mfaToken;\n\n  assertDefined(mfaToken, 'No MFA token found');\n\n  core.state.set({\n    mfaToken: null,\n  });\n\n  return mfaToken;\n};\n","import { getCore } from '../../../client/core/getCore';\nimport { getDefaultClient } from '../../../client/defaultClient';\nimport { createApiClient } from '../../apiClient';\nimport type { MFAMethodsResponse } from '../mfa.types';\n\n/**\n * Retrieves the available MFA methods for the current user.\n *\n * This function fetches information about which multi-factor authentication\n * methods are available and configured for the user's account.\n *\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns A promise that resolves to the user's MFA methods configuration.\n * @notInstrumented\n */\nexport const getMfaMethods = async (\n  client = getDefaultClient()\n): Promise<MFAMethodsResponse> => {\n  const core = getCore(client);\n  const apiClient = createApiClient({}, client);\n\n  const userMfaMethods = await apiClient.getUserMfaMethods({\n    environmentId: core.environmentId,\n    verifiedOnly: true,\n  });\n\n  return userMfaMethods;\n};\n","import { getDefaultClient } from '../../../client/defaultClient';\nimport type { MFAAction } from '../mfa.consts';\nimport { getMfaMethods } from '../getMfaMethods';\n\ntype IsMfaRequiredForActionParams = {\n  mfaAction: MFAAction;\n};\n\n/**\n * Checks if MFA is required for a specific action.\n *\n * This function determines whether multi-factor authentication is required\n * for the specified action based on project settings and user configuration.\n *\n * @param params.mfaAction - The action to check MFA requirements for.\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns A promise that resolves to true if MFA is required for the action, false otherwise.\n * @notInstrumented\n */\nexport const isMfaRequiredForAction = async (\n  { mfaAction }: IsMfaRequiredForActionParams,\n  client = getDefaultClient()\n): Promise<boolean> => {\n  const projectSettings = client.projectSettings;\n\n  const isRequiredForAction = projectSettings?.security?.mfa?.actions?.some(\n    (action) => action.action === mfaAction && action.required\n  );\n\n  // if mfa is not required for the action, return false\n  // no matter if general mfa is set to required or not\n  if (!isRequiredForAction) {\n    return false;\n  }\n\n  const isMfaMethodRequired = projectSettings?.security?.mfa?.required;\n\n  // if mfa is required for the action and also set as required in general, return true\n  if (isMfaMethodRequired) {\n    return true;\n  }\n\n  const mfaMethods = await getMfaMethods(client);\n  // if general mfa is optional, but user has registered methods,\n  // then it should be required for the action\n  return mfaMethods.userHasVerifiedMfaMethods;\n};\n"],"mappings":";;;;;;;;;;;;;;;CAkBE,MAAM,OAAA,iCAAe,OAAO;CAE5B,MAAA,WAAc,KAAQ,MAAM,KAAI,CAAA;AAEhC,wCAAc,UAAC,qBAAA;AAEf,MAAE,MAAA,IAAA,kBAEF,CAAA;;;;;;;;;;;;;;;;;;;;;;ACXF,MAAa,gBAAgB,OAC3B,SAASA,2CAAkB,KACK;CAChC,MAAM,OAAOC,iCAAQ,OAAO;AAQ5B,QALuB,MAFLC,yCAAgB,EAAE,EAAE,OAAO,CAEN,kBAAkB;EACvD,eAAe,KAAK;EACpB,cAAc;EACf,CAAC;;;;;;;;;;;;;;;;ACLJ,MAAa,yBAAyB,OACpC,EAAE,aACF,SAASC,2CAAkB,KACN;CACrB,MAAM,kBAAkB,OAAO;AAQ/B,KAAI,CANwB,iBAAiB,UAAU,KAAK,SAAS,MAClE,WAAW,OAAO,WAAW,aAAa,OAAO,SACnD,CAKC,QAAO;AAMT,KAH4B,iBAAiB,UAAU,KAAK,SAI1D,QAAO;AAMT,SAHmB,MAAM,cAAc,OAAO,EAG5B"}
+{"version":3,"file":"isMfaRequiredForAction-Czx-uPFY.cjs","names":["getDefaultClient","getCore","createApiClient","getDefaultClient"],"sources":["../src/modules/mfa/consumeMfaToken/consumeMfaToken.ts","../src/modules/mfa/getMfaMethods/getMfaMethods.ts","../src/modules/mfa/isMfaRequiredForAction/isMfaRequiredForAction.ts"],"sourcesContent":["import { getCore } from '../../../client/core/getCore';\nimport { getDefaultClient } from '../../../client/defaultClient';\nimport { assertDefined } from '../../../utils/assertDefined';\n\n/**\n * Consumes and clears the current MFA token from the client state.\n *\n * This function retrieves the MFA token obtained from a successful MFA authentication,\n * and removes it from the client, to prevent it from being used again.\n *\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns The MFA token that was consumed.\n * @throws Error if no MFA token is found.\n * @instrumented\n */\nexport const consumeMfaToken = (client = getDefaultClient()): string => {\n  const core = getCore(client);\n\n  const mfaToken = core.state.get().mfaToken;\n\n  assertDefined(mfaToken, 'No MFA token found');\n\n  core.state.set({\n    mfaToken: null,\n  });\n\n  return mfaToken;\n};\n","import { getCore } from '../../../client/core/getCore';\nimport { getDefaultClient } from '../../../client/defaultClient';\nimport { createApiClient } from '../../apiClient';\nimport type { MFAMethodsResponse } from '../mfa.types';\n\n/**\n * Retrieves the available MFA methods for the current user.\n *\n * This function fetches information about which multi-factor authentication\n * methods are available and configured for the user's account.\n *\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns A promise that resolves to the user's MFA methods configuration.\n * @notInstrumented\n */\nexport const getMfaMethods = async (\n  client = getDefaultClient()\n): Promise<MFAMethodsResponse> => {\n  const core = getCore(client);\n  const apiClient = createApiClient({}, client);\n\n  const userMfaMethods = await apiClient.getUserMfaMethods({\n    environmentId: core.environmentId,\n    verifiedOnly: true,\n  });\n\n  return userMfaMethods;\n};\n","import { getDefaultClient } from '../../../client/defaultClient';\nimport type { MFAAction } from '../mfa.consts';\nimport { getMfaMethods } from '../getMfaMethods';\n\ntype IsMfaRequiredForActionParams = {\n  mfaAction: MFAAction;\n};\n\n/**\n * Checks if MFA is required for a specific action.\n *\n * This function determines whether multi-factor authentication is required\n * for the specified action based on project settings and user configuration.\n *\n * @param params.mfaAction - The action to check MFA requirements for.\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns A promise that resolves to true if MFA is required for the action, false otherwise.\n * @notInstrumented\n */\nexport const isMfaRequiredForAction = async (\n  { mfaAction }: IsMfaRequiredForActionParams,\n  client = getDefaultClient()\n): Promise<boolean> => {\n  const projectSettings = client.projectSettings;\n\n  const isRequiredForAction = projectSettings?.security?.mfa?.actions?.some(\n    (action) => action.action === mfaAction && action.required\n  );\n\n  // if mfa is not required for the action, return false\n  // no matter if general mfa is set to required or not\n  if (!isRequiredForAction) {\n    return false;\n  }\n\n  const isMfaMethodRequired = projectSettings?.security?.mfa?.required;\n\n  // if mfa is required for the action and also set as required in general, return true\n  if (isMfaMethodRequired) {\n    return true;\n  }\n\n  const mfaMethods = await getMfaMethods(client);\n  // if general mfa is optional, but user has registered methods,\n  // then it should be required for the action\n  return mfaMethods.userHasVerifiedMfaMethods;\n};\n"],"mappings":";;;;;;;;;;;;;;;CAkBE,MAAM,OAAA,iCAAe,OAAO;CAE5B,MAAA,WAAc,KAAQ,MAAM,KAAI,CAAA;AAEhC,wCAAc,UAAC,qBAAA;AAEf,MAAE,MAAA,IAAA,kBAEF,CAAA;;;;;;;;;;;;;;;;;;;;;;ACXF,MAAa,gBAAgB,OAC3B,SAASA,2CAAkB,KACK;CAChC,MAAM,OAAOC,iCAAQ,OAAO;AAQ5B,QALuB,MAFLC,yCAAgB,EAAE,EAAE,OAAO,CAEN,kBAAkB;EACvD,eAAe,KAAK;EACpB,cAAc;EACf,CAAC;;;;;;;;;;;;;;;;ACLJ,MAAa,yBAAyB,OACpC,EAAE,aACF,SAASC,2CAAkB,KACN;CACrB,MAAM,kBAAkB,OAAO;AAQ/B,KAAI,CANwB,iBAAiB,UAAU,KAAK,SAAS,MAClE,WAAW,OAAO,WAAW,aAAa,OAAO,SACnD,CAKC,QAAO;AAMT,KAH4B,iBAAiB,UAAU,KAAK,SAI1D,QAAO;AAMT,SAHmB,MAAM,cAAc,OAAO,EAG5B"}

package/dist/{isMfaRequiredForAction-CHqeZeTS.esm.js → isMfaRequiredForAction-DS8fcwxO.esm.js}

@@ -1,4 +1,4 @@
-import { c as createApiClient, d as instrumentFunction, gt as assertDefined, u as resolveInstrumentationCore, wt as getCore, xt as getDefaultClient } from "./logoutWithReason-CX9hGTPw.esm.js";
+import { St as getDefaultClient, Tt as getCore, _t as assertDefined, d as resolveInstrumentationCore, f as instrumentFunction, l as createApiClient } from "./logoutWithReason-DO0kP7nf.esm.js";
 
 //#region src/modules/mfa/consumeMfaToken/consumeMfaToken.ts
 /**
@@ -68,4 +68,4 @@ const isMfaRequiredForAction = async ({ mfaAction }, client = getDefaultClient()
 
 //#endregion
 export { getMfaMethods as n, __consumeMfaToken_wrapped as r, isMfaRequiredForAction as t };
-//# sourceMappingURL=isMfaRequiredForAction-CHqeZeTS.esm.js.map
+//# sourceMappingURL=isMfaRequiredForAction-DS8fcwxO.esm.js.map

package/dist/{isMfaRequiredForAction-CHqeZeTS.esm.js.map → isMfaRequiredForAction-DS8fcwxO.esm.js.map}

@@ -1 +1 @@
-{"version":3,"file":"isMfaRequiredForAction-CHqeZeTS.esm.js","names":[],"sources":["../src/modules/mfa/consumeMfaToken/consumeMfaToken.ts","../src/modules/mfa/getMfaMethods/getMfaMethods.ts","../src/modules/mfa/isMfaRequiredForAction/isMfaRequiredForAction.ts"],"sourcesContent":["import { getCore } from '../../../client/core/getCore';\nimport { getDefaultClient } from '../../../client/defaultClient';\nimport { assertDefined } from '../../../utils/assertDefined';\n\n/**\n * Consumes and clears the current MFA token from the client state.\n *\n * This function retrieves the MFA token obtained from a successful MFA authentication,\n * and removes it from the client, to prevent it from being used again.\n *\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns The MFA token that was consumed.\n * @throws Error if no MFA token is found.\n * @instrumented\n */\nexport const consumeMfaToken = (client = getDefaultClient()): string => {\n  const core = getCore(client);\n\n  const mfaToken = core.state.get().mfaToken;\n\n  assertDefined(mfaToken, 'No MFA token found');\n\n  core.state.set({\n    mfaToken: null,\n  });\n\n  return mfaToken;\n};\n","import { getCore } from '../../../client/core/getCore';\nimport { getDefaultClient } from '../../../client/defaultClient';\nimport { createApiClient } from '../../apiClient';\nimport type { MFAMethodsResponse } from '../mfa.types';\n\n/**\n * Retrieves the available MFA methods for the current user.\n *\n * This function fetches information about which multi-factor authentication\n * methods are available and configured for the user's account.\n *\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns A promise that resolves to the user's MFA methods configuration.\n * @notInstrumented\n */\nexport const getMfaMethods = async (\n  client = getDefaultClient()\n): Promise<MFAMethodsResponse> => {\n  const core = getCore(client);\n  const apiClient = createApiClient({}, client);\n\n  const userMfaMethods = await apiClient.getUserMfaMethods({\n    environmentId: core.environmentId,\n    verifiedOnly: true,\n  });\n\n  return userMfaMethods;\n};\n","import { getDefaultClient } from '../../../client/defaultClient';\nimport type { MFAAction } from '../mfa.consts';\nimport { getMfaMethods } from '../getMfaMethods';\n\ntype IsMfaRequiredForActionParams = {\n  mfaAction: MFAAction;\n};\n\n/**\n * Checks if MFA is required for a specific action.\n *\n * This function determines whether multi-factor authentication is required\n * for the specified action based on project settings and user configuration.\n *\n * @param params.mfaAction - The action to check MFA requirements for.\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns A promise that resolves to true if MFA is required for the action, false otherwise.\n * @notInstrumented\n */\nexport const isMfaRequiredForAction = async (\n  { mfaAction }: IsMfaRequiredForActionParams,\n  client = getDefaultClient()\n): Promise<boolean> => {\n  const projectSettings = client.projectSettings;\n\n  const isRequiredForAction = projectSettings?.security?.mfa?.actions?.some(\n    (action) => action.action === mfaAction && action.required\n  );\n\n  // if mfa is not required for the action, return false\n  // no matter if general mfa is set to required or not\n  if (!isRequiredForAction) {\n    return false;\n  }\n\n  const isMfaMethodRequired = projectSettings?.security?.mfa?.required;\n\n  // if mfa is required for the action and also set as required in general, return true\n  if (isMfaMethodRequired) {\n    return true;\n  }\n\n  const mfaMethods = await getMfaMethods(client);\n  // if general mfa is optional, but user has registered methods,\n  // then it should be required for the action\n  return mfaMethods.userHasVerifiedMfaMethods;\n};\n"],"mappings":";;;;;;;;;;;;;;;CAkBE,MAAM,OAAA,QAAe,OAAO;CAE5B,MAAA,WAAc,KAAQ,MAAM,KAAI,CAAA;AAEhC,eAAc,UAAC,qBAAA;AAEf,MAAE,MAAA,IAAA,kBAEF,CAAA;;;;;;;;;;;;;;;;;;;;;;ACXF,MAAa,gBAAgB,OAC3B,SAAS,kBAAkB,KACK;CAChC,MAAM,OAAO,QAAQ,OAAO;AAQ5B,QALuB,MAFL,gBAAgB,EAAE,EAAE,OAAO,CAEN,kBAAkB;EACvD,eAAe,KAAK;EACpB,cAAc;EACf,CAAC;;;;;;;;;;;;;;;;ACLJ,MAAa,yBAAyB,OACpC,EAAE,aACF,SAAS,kBAAkB,KACN;CACrB,MAAM,kBAAkB,OAAO;AAQ/B,KAAI,CANwB,iBAAiB,UAAU,KAAK,SAAS,MAClE,WAAW,OAAO,WAAW,aAAa,OAAO,SACnD,CAKC,QAAO;AAMT,KAH4B,iBAAiB,UAAU,KAAK,SAI1D,QAAO;AAMT,SAHmB,MAAM,cAAc,OAAO,EAG5B"}
+{"version":3,"file":"isMfaRequiredForAction-DS8fcwxO.esm.js","names":[],"sources":["../src/modules/mfa/consumeMfaToken/consumeMfaToken.ts","../src/modules/mfa/getMfaMethods/getMfaMethods.ts","../src/modules/mfa/isMfaRequiredForAction/isMfaRequiredForAction.ts"],"sourcesContent":["import { getCore } from '../../../client/core/getCore';\nimport { getDefaultClient } from '../../../client/defaultClient';\nimport { assertDefined } from '../../../utils/assertDefined';\n\n/**\n * Consumes and clears the current MFA token from the client state.\n *\n * This function retrieves the MFA token obtained from a successful MFA authentication,\n * and removes it from the client, to prevent it from being used again.\n *\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns The MFA token that was consumed.\n * @throws Error if no MFA token is found.\n * @instrumented\n */\nexport const consumeMfaToken = (client = getDefaultClient()): string => {\n  const core = getCore(client);\n\n  const mfaToken = core.state.get().mfaToken;\n\n  assertDefined(mfaToken, 'No MFA token found');\n\n  core.state.set({\n    mfaToken: null,\n  });\n\n  return mfaToken;\n};\n","import { getCore } from '../../../client/core/getCore';\nimport { getDefaultClient } from '../../../client/defaultClient';\nimport { createApiClient } from '../../apiClient';\nimport type { MFAMethodsResponse } from '../mfa.types';\n\n/**\n * Retrieves the available MFA methods for the current user.\n *\n * This function fetches information about which multi-factor authentication\n * methods are available and configured for the user's account.\n *\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns A promise that resolves to the user's MFA methods configuration.\n * @notInstrumented\n */\nexport const getMfaMethods = async (\n  client = getDefaultClient()\n): Promise<MFAMethodsResponse> => {\n  const core = getCore(client);\n  const apiClient = createApiClient({}, client);\n\n  const userMfaMethods = await apiClient.getUserMfaMethods({\n    environmentId: core.environmentId,\n    verifiedOnly: true,\n  });\n\n  return userMfaMethods;\n};\n","import { getDefaultClient } from '../../../client/defaultClient';\nimport type { MFAAction } from '../mfa.consts';\nimport { getMfaMethods } from '../getMfaMethods';\n\ntype IsMfaRequiredForActionParams = {\n  mfaAction: MFAAction;\n};\n\n/**\n * Checks if MFA is required for a specific action.\n *\n * This function determines whether multi-factor authentication is required\n * for the specified action based on project settings and user configuration.\n *\n * @param params.mfaAction - The action to check MFA requirements for.\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns A promise that resolves to true if MFA is required for the action, false otherwise.\n * @notInstrumented\n */\nexport const isMfaRequiredForAction = async (\n  { mfaAction }: IsMfaRequiredForActionParams,\n  client = getDefaultClient()\n): Promise<boolean> => {\n  const projectSettings = client.projectSettings;\n\n  const isRequiredForAction = projectSettings?.security?.mfa?.actions?.some(\n    (action) => action.action === mfaAction && action.required\n  );\n\n  // if mfa is not required for the action, return false\n  // no matter if general mfa is set to required or not\n  if (!isRequiredForAction) {\n    return false;\n  }\n\n  const isMfaMethodRequired = projectSettings?.security?.mfa?.required;\n\n  // if mfa is required for the action and also set as required in general, return true\n  if (isMfaMethodRequired) {\n    return true;\n  }\n\n  const mfaMethods = await getMfaMethods(client);\n  // if general mfa is optional, but user has registered methods,\n  // then it should be required for the action\n  return mfaMethods.userHasVerifiedMfaMethods;\n};\n"],"mappings":";;;;;;;;;;;;;;;CAkBE,MAAM,OAAA,QAAe,OAAO;CAE5B,MAAA,WAAc,KAAQ,MAAM,KAAI,CAAA;AAEhC,eAAc,UAAC,qBAAA;AAEf,MAAE,MAAA,IAAA,kBAEF,CAAA;;;;;;;;;;;;;;;;;;;;;;ACXF,MAAa,gBAAgB,OAC3B,SAAS,kBAAkB,KACK;CAChC,MAAM,OAAO,QAAQ,OAAO;AAQ5B,QALuB,MAFL,gBAAgB,EAAE,EAAE,OAAO,CAEN,kBAAkB;EACvD,eAAe,KAAK;EACpB,cAAc;EACf,CAAC;;;;;;;;;;;;;;;;ACLJ,MAAa,yBAAyB,OACpC,EAAE,aACF,SAAS,kBAAkB,KACN;CACrB,MAAM,kBAAkB,OAAO;AAQ/B,KAAI,CANwB,iBAAiB,UAAU,KAAK,SAAS,MAClE,WAAW,OAAO,WAAW,aAAa,OAAO,SACnD,CAKC,QAAO;AAMT,KAH4B,iBAAiB,UAAU,KAAK,SAI1D,QAAO;AAMT,SAHmB,MAAM,cAAc,OAAO,EAG5B"}

package/dist/{isUserOnboardingComplete-CpHVw8ee.esm.js → isUserOnboardingComplete-COmYFW26.esm.js}

@@ -1,5 +1,5 @@
-import { J as isUserMissingMfaAuth, O as DEFAULT_WAAS_BASE_API_URL, Tt as BaseError, gt as assertDefined, ht as isCookieEnabled, wt as getCore, xt as getDefaultClient } from "./logoutWithReason-CX9hGTPw.esm.js";
-import { n as isDynamicWaasEnabled } from "./migrateFromFireblocks-C8KXMXk-.esm.js";
+import { Et as BaseError, St as getDefaultClient, Tt as getCore, Y as isUserMissingMfaAuth, _t as assertDefined, gt as isCookieEnabled, k as DEFAULT_WAAS_BASE_API_URL } from "./logoutWithReason-DO0kP7nf.esm.js";
+import { n as isDynamicWaasEnabled } from "./migrateFromFireblocks-C_cap--b.esm.js";
 import { MfaBackupCodeAcknowledgement } from "@dynamic-labs/sdk-api-core";
 import { preconnectWaasIframe } from "@dynamic-labs-wallet/browser-wallet-client";
 
@@ -211,4 +211,4 @@ const isUserOnboardingComplete = (client = getDefaultClient()) => {
 
 //#endregion
 export { WaasRbacStaleRetryUnsafeError as a, preconnectWaasIframe$1 as i, isPendingRecoveryCodesAcknowledgment as n, WaasOnboardingIncompleteError as o, isDeviceRegistrationRequired as r, WaasLoadFailedError as s, isUserOnboardingComplete as t };
-//# sourceMappingURL=isUserOnboardingComplete-CpHVw8ee.esm.js.map
+//# sourceMappingURL=isUserOnboardingComplete-COmYFW26.esm.js.map

package/dist/{isUserOnboardingComplete-CpHVw8ee.esm.js.map → isUserOnboardingComplete-COmYFW26.esm.js.map}

@@ -1 +1 @@
-{"version":3,"file":"isUserOnboardingComplete-CpHVw8ee.esm.js","names":["preconnectWaasIframe"],"sources":["../src/errors/WaasLoadFailedError.ts","../src/errors/WaasOnboardingIncompleteError.ts","../src/errors/WaasRbacStaleRetryUnsafeError.ts","../src/modules/waas/preconnectWaasIframe/preconnectWaasIframe.ts","../src/modules/deviceRegistration/isDeviceRegistrationRequired/isDeviceRegistrationRequired.ts","../src/modules/mfa/isPendingRecoveryCodesAcknowledgment/isPendingRecoveryCodesAcknowledgment.ts","../src/modules/user/isUserOnboardingComplete/isUserOnboardingComplete.ts"],"sourcesContent":["import { BaseError } from './base';\n\n/**\n * Why the embedded wallet load failed. Currently only retry exhaustion is\n * reported; the union exists so new reasons can be added without a breaking\n * change to consumer `instanceof` handling.\n *\n * @example\n * ```ts\n * const reason: WaasLoadFailedErrorReason = 'load_attempts_exhausted';\n * ```\n * @see WaasLoadFailedError\n * @see signMessage\n */\nexport type WaasLoadFailedErrorReason = 'load_attempts_exhausted';\n\n/**\n * Thrown when the embedded (WaaS) wallet's secure container failed to load\n * after exhausting all of its internal retry attempts.\n *\n * This failure is transient: the next wallet operation triggers a fresh load\n * cycle, so hosts can catch this error and re-attempt the operation at their\n * own cadence (for example, when connectivity returns or the app is\n * foregrounded). Other load failures (for example, a CSP block) are not\n * wrapped by this error and their shape is not guaranteed.\n *\n * @example\n * ```ts\n * try {\n *   await signMessage({ message, walletAccount });\n * } catch (error) {\n *   if (error instanceof WaasLoadFailedError) {\n *     // transient — retry the operation at your own cadence\n *     await signMessage({ message, walletAccount });\n *   }\n * }\n * ```\n * @see WaasLoadFailedErrorReason\n * @see signMessage\n */\nexport class WaasLoadFailedError extends BaseError {\n  readonly reason: WaasLoadFailedErrorReason;\n\n  constructor({ cause }: { cause: Error }) {\n    super({\n      cause,\n      code: 'waas_load_failed',\n      docsUrl: null,\n      name: 'WaasLoadFailedError',\n      shortMessage:\n        'The embedded wallet failed to load after exhausting its retry attempts. Retrying the wallet operation triggers a fresh load.',\n    });\n    this.reason = 'load_attempts_exhausted';\n  }\n}\n","import { BaseError } from './base';\n\n/**\n * Thrown when the embedded (WaaS) wallet client is requested before the user\n * has completed onboarding — i.e. the JWT has not upgraded to `user:basic`\n * because MFA, KYC, recovery-codes acknowledgment, or device registration is\n * still pending.\n *\n * The WaaS iframe's init-time room-cache pre-warm fires `createRooms` using the\n * token captured at client construction (before any per-operation token\n * resync). Building the client during this window lets that pre-warm fire with\n * a pre-`user:basic` token, get a 401, and the iframe's unauthorized handler\n * force-logs-out the user. Throwing here surfaces a clear, recoverable reason\n * instead — wait for onboarding to complete and retry.\n */\nexport class WaasOnboardingIncompleteError extends BaseError {\n  constructor() {\n    super({\n      cause: null,\n      code: 'waas_onboarding_incomplete',\n      docsUrl: null,\n      name: 'WaasOnboardingIncompleteError',\n      shortMessage:\n        'Cannot create or access the embedded wallet until onboarding is complete (pending MFA, KYC, recovery-codes acknowledgment, or device registration).',\n    });\n  }\n}\n","import { BaseError } from './base';\n\n/**\n * Thrown when a WaaS ceremony operation (sign, export, reshare, create\n * wallet) receives a 403 `rbac_stale` response after the attempt has already\n * spent its one-time authorization — either the legacy MFA token or a\n * single-use elevated access token.\n *\n * The SDK cannot safely retry in that case: the restarted attempt would find\n * the approval already consumed and fail deeper in the stack with an\n * unrelated \"no MFA token\" error, hiding the permission change that actually\n * caused the failure. Surfacing this error instead tells the host exactly what\n * happened. Recover by re-running the step-up/MFA flow and retrying the\n * operation; the business-account role change has already taken effect, so the\n * retry is evaluated against the caller's current permissions.\n *\n * @example\n * ```ts\n * try {\n *   await signMessage({ message, walletAccount });\n * } catch (error) {\n *   if (error instanceof WaasRbacStaleRetryUnsafeError) {\n *     // The one-time approval was spent; re-verify before trying again.\n *     await promptStepUp();\n *     await signMessage({ message, walletAccount });\n *   }\n * }\n * ```\n * @see WaasLoadFailedError\n * @see signMessage\n */\nexport class WaasRbacStaleRetryUnsafeError extends BaseError {\n  constructor({ cause }: { cause: Error }) {\n    super({\n      cause,\n      code: 'waas_rbac_stale_retry_unsafe',\n      docsUrl: null,\n      name: 'WaasRbacStaleRetryUnsafeError',\n      shortMessage:\n        'The business account role change could not be retried automatically because a one-time authorization was already consumed. Re-authenticate and retry the operation.',\n    });\n  }\n}\n","import type { AuthMode } from '@dynamic-labs-wallet/browser-wallet-client';\nimport { preconnectWaasIframe as preconnectWaasIframeOrigin } from '@dynamic-labs-wallet/browser-wallet-client';\n\nimport { getCore } from '../../../client/core/getCore';\nimport type { DynamicClient } from '../../../client/types';\nimport { isCookieEnabled } from '../../projectSettings/isCookieEnabled';\nimport { DEFAULT_WAAS_BASE_API_URL } from '../constants';\nimport { isDynamicWaasEnabled } from '../isDynamicWaasEnabled';\n\n/**\n * Warms the browser's connection (DNS + TCP + TLS) to the embedded-wallet\n * iframe origin so the iframe mounted after authentication completes loads on\n * a hot connection. Called when an auth flow starts (OTP send/verify, social\n * callback). Safe to call repeatedly; no-op on React Native / SSR and when\n * Dynamic WaaS is not enabled.\n *\n * @param client - The Dynamic client instance.\n * @notInstrumented\n */\nexport const preconnectWaasIframe = (client: DynamicClient): void => {\n  const core = getCore(client);\n  try {\n    if (!isDynamicWaasEnabled(client)) return;\n\n    preconnectWaasIframeOrigin({\n      authMode: (isCookieEnabled(client) ? 'cookie' : 'header') as AuthMode,\n      baseApiUrl: (core.apiBaseUrl || DEFAULT_WAAS_BASE_API_URL).replace(\n        '/api/v0',\n        ''\n      ),\n    });\n  } catch (error) {\n    // Best-effort: never break the auth flow (also swallows the assertion\n    // from isDynamicWaasEnabled when project settings are not loaded yet).\n    core.logger.warn('[preconnectWaasIframe] skipped', error);\n  }\n};\n","import type { User } from '../../user/user.types';\n\n/**\n * Checks if device registration is required for the given user.\n *\n * This function determines if the user has the deviceRegistration\n * scope, indicating that device registration is required.\n *\n * @param user - The user to check.\n * @returns True if device registration is required, false otherwise.\n * @notInstrumented\n * @hook Exposed as a hook so consumers reactively know when this device must be registered, updated when the user changes.\n */\nexport const isDeviceRegistrationRequired = (user: User): boolean =>\n  Boolean(user.scope?.includes('device:register'));\n","import { MfaBackupCodeAcknowledgement } from '@dynamic-labs/sdk-api-core';\n\nimport { getDefaultClient } from '../../../client/defaultClient';\nimport { assertDefined } from '../../../utils/assertDefined';\n\n/**\n * Checks if the user is still pending acknowledgment of their MFA recovery codes.\n *\n * This function determines whether the user has been presented with recovery\n * codes that they have not yet acknowledged as saved or backed up.\n *\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns True if recovery codes are pending acknowledgment, false otherwise.\n * @notInstrumented\n * @hook Exposed as a hook so consumers reactively know when recovery codes await acknowledgment, updated when the user changes.\n */\nexport const isPendingRecoveryCodesAcknowledgment = (\n  client = getDefaultClient()\n): boolean => {\n  const user = client.user;\n\n  assertDefined(user, 'User not logged in');\n\n  return (\n    user.mfaBackupCodeAcknowledgement === MfaBackupCodeAcknowledgement.Pending\n  );\n};\n","import { getDefaultClient } from '../../../client/defaultClient';\nimport { assertDefined } from '../../../utils/assertDefined';\nimport { isDeviceRegistrationRequired } from '../../deviceRegistration/isDeviceRegistrationRequired';\nimport { isPendingRecoveryCodesAcknowledgment } from '../../mfa/isPendingRecoveryCodesAcknowledgment';\nimport { isUserMissingMfaAuth } from '../../mfa/isUserMissingMfaAuth';\n\n/**\n * Checks if the user has completed all onboarding requirements.\n *\n * This function verifies whether a user has fulfilled all necessary requirements\n * including KYC fields (Know Your Customer information), MFA setup\n * (Multi-Factor Authentication including recovery codes acknowledgment), and\n * device registration.\n *\n * A `false` result means the user still has an outstanding onboarding step, so\n * any feature that requires a fully onboarded (`user:basic`) user should hold\n * off until it returns `true`. Creating or accessing an embedded (WaaS) wallet\n * is one such feature — its backend calls reject a pre-`user:basic` token — but\n * this predicate is general and not specific to embedded wallets.\n *\n * @deprecated Use {@link checkUserScopes} instead. This function conflates\n * Dynamic-controlled requirements (MFA, device registration, required fields)\n * with the concept of \"onboarding complete\", which is app-specific. Replace\n * with `checkUserScopes({ user, scopes: ['user:basic'] })` to check whether\n * Dynamic's requirements are satisfied, and compose your own logic on top for\n * any app-specific onboarding steps.\n *\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns True if onboarding is complete (no pending requirements), false if there are pending requirements.\n * @notInstrumented\n * @hook Exposed as a hook so consumers reactively know when onboarding is complete, updated when the user changes.\n */\nexport const isUserOnboardingComplete = (\n  client = getDefaultClient()\n): boolean => {\n  const user = client.user;\n\n  assertDefined(user, 'User not logged in');\n\n  const hasMissingKycFields = Boolean(user.missingFields?.length);\n  const hasPendingMfaAuth = isUserMissingMfaAuth(client);\n  const hasPendingRecoveryCodes = isPendingRecoveryCodesAcknowledgment(client);\n  const hasPendingDeviceRegistration = isDeviceRegistrationRequired(user);\n\n  const userOnboardingComplete =\n    !hasMissingKycFields &&\n    !hasPendingMfaAuth &&\n    !hasPendingRecoveryCodes &&\n    !hasPendingDeviceRegistration;\n\n  return userOnboardingComplete;\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAwCA,IAAa,sBAAb,cAAyC,UAAU;CACjD,AAAS;CAET,YAAY,EAAE,SAA2B;AACvC,QAAM;GACJ;GACA,MAAM;GACN,SAAS;GACT,MAAM;GACN,cACE;GACH,CAAC;AACF,OAAK,SAAS;;;;;;;;;;;;;;;;;;;ACrClB,IAAa,gCAAb,cAAmD,UAAU;CAC3D,cAAc;AACZ,QAAM;GACJ,OAAO;GACP,MAAM;GACN,SAAS;GACT,MAAM;GACN,cACE;GACH,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;ACON,IAAa,gCAAb,cAAmD,UAAU;CAC3D,YAAY,EAAE,SAA2B;AACvC,QAAM;GACJ;GACA,MAAM;GACN,SAAS;GACT,MAAM;GACN,cACE;GACH,CAAC;;;;;;;;;;;;;;;;ACrBN,MAAaA,0BAAwB,WAAgC;CACnE,MAAM,OAAO,QAAQ,OAAO;AAC5B,KAAI;AACF,MAAI,CAAC,qBAAqB,OAAO,CAAE;AAEnC,uBAA2B;GACzB,UAAW,gBAAgB,OAAO,GAAG,WAAW;GAChD,aAAa,KAAK,cAAc,2BAA2B,QACzD,WACA,GACD;GACF,CAAC;UACK,OAAO;AAGd,OAAK,OAAO,KAAK,kCAAkC,MAAM;;;;;;;;;;;;;;;;;ACrB7D,MAAa,gCAAgC,SAC3C,QAAQ,KAAK,OAAO,SAAS,kBAAkB,CAAC;;;;;;;;;;;;;;;ACElD,MAAa,wCACX,SAAS,kBAAkB,KACf;CACZ,MAAM,OAAO,OAAO;AAEpB,eAAc,MAAM,qBAAqB;AAEzC,QACE,KAAK,iCAAiC,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;ACQvE,MAAa,4BACX,SAAS,kBAAkB,KACf;CACZ,MAAM,OAAO,OAAO;AAEpB,eAAc,MAAM,qBAAqB;CAEzC,MAAM,sBAAsB,QAAQ,KAAK,eAAe,OAAO;CAC/D,MAAM,oBAAoB,qBAAqB,OAAO;CACtD,MAAM,0BAA0B,qCAAqC,OAAO;CAC5E,MAAM,+BAA+B,6BAA6B,KAAK;AAQvE,QALE,CAAC,uBACD,CAAC,qBACD,CAAC,2BACD,CAAC"}
+{"version":3,"file":"isUserOnboardingComplete-COmYFW26.esm.js","names":["preconnectWaasIframe"],"sources":["../src/errors/WaasLoadFailedError.ts","../src/errors/WaasOnboardingIncompleteError.ts","../src/errors/WaasRbacStaleRetryUnsafeError.ts","../src/modules/waas/preconnectWaasIframe/preconnectWaasIframe.ts","../src/modules/deviceRegistration/isDeviceRegistrationRequired/isDeviceRegistrationRequired.ts","../src/modules/mfa/isPendingRecoveryCodesAcknowledgment/isPendingRecoveryCodesAcknowledgment.ts","../src/modules/user/isUserOnboardingComplete/isUserOnboardingComplete.ts"],"sourcesContent":["import { BaseError } from './base';\n\n/**\n * Why the embedded wallet load failed. Currently only retry exhaustion is\n * reported; the union exists so new reasons can be added without a breaking\n * change to consumer `instanceof` handling.\n *\n * @example\n * ```ts\n * const reason: WaasLoadFailedErrorReason = 'load_attempts_exhausted';\n * ```\n * @see WaasLoadFailedError\n * @see signMessage\n */\nexport type WaasLoadFailedErrorReason = 'load_attempts_exhausted';\n\n/**\n * Thrown when the embedded (WaaS) wallet's secure container failed to load\n * after exhausting all of its internal retry attempts.\n *\n * This failure is transient: the next wallet operation triggers a fresh load\n * cycle, so hosts can catch this error and re-attempt the operation at their\n * own cadence (for example, when connectivity returns or the app is\n * foregrounded). Other load failures (for example, a CSP block) are not\n * wrapped by this error and their shape is not guaranteed.\n *\n * @example\n * ```ts\n * try {\n *   await signMessage({ message, walletAccount });\n * } catch (error) {\n *   if (error instanceof WaasLoadFailedError) {\n *     // transient — retry the operation at your own cadence\n *     await signMessage({ message, walletAccount });\n *   }\n * }\n * ```\n * @see WaasLoadFailedErrorReason\n * @see signMessage\n */\nexport class WaasLoadFailedError extends BaseError {\n  readonly reason: WaasLoadFailedErrorReason;\n\n  constructor({ cause }: { cause: Error }) {\n    super({\n      cause,\n      code: 'waas_load_failed',\n      docsUrl: null,\n      name: 'WaasLoadFailedError',\n      shortMessage:\n        'The embedded wallet failed to load after exhausting its retry attempts. Retrying the wallet operation triggers a fresh load.',\n    });\n    this.reason = 'load_attempts_exhausted';\n  }\n}\n","import { BaseError } from './base';\n\n/**\n * Thrown when the embedded (WaaS) wallet client is requested before the user\n * has completed onboarding — i.e. the JWT has not upgraded to `user:basic`\n * because MFA, KYC, recovery-codes acknowledgment, or device registration is\n * still pending.\n *\n * The WaaS iframe's init-time room-cache pre-warm fires `createRooms` using the\n * token captured at client construction (before any per-operation token\n * resync). Building the client during this window lets that pre-warm fire with\n * a pre-`user:basic` token, get a 401, and the iframe's unauthorized handler\n * force-logs-out the user. Throwing here surfaces a clear, recoverable reason\n * instead — wait for onboarding to complete and retry.\n */\nexport class WaasOnboardingIncompleteError extends BaseError {\n  constructor() {\n    super({\n      cause: null,\n      code: 'waas_onboarding_incomplete',\n      docsUrl: null,\n      name: 'WaasOnboardingIncompleteError',\n      shortMessage:\n        'Cannot create or access the embedded wallet until onboarding is complete (pending MFA, KYC, recovery-codes acknowledgment, or device registration).',\n    });\n  }\n}\n","import { BaseError } from './base';\n\n/**\n * Thrown when a WaaS ceremony operation (sign, export, reshare, create\n * wallet) receives a 403 `rbac_stale` response after the attempt has already\n * spent its one-time authorization — either the legacy MFA token or a\n * single-use elevated access token.\n *\n * The SDK cannot safely retry in that case: the restarted attempt would find\n * the approval already consumed and fail deeper in the stack with an\n * unrelated \"no MFA token\" error, hiding the permission change that actually\n * caused the failure. Surfacing this error instead tells the host exactly what\n * happened. Recover by re-running the step-up/MFA flow and retrying the\n * operation; the business-account role change has already taken effect, so the\n * retry is evaluated against the caller's current permissions.\n *\n * @example\n * ```ts\n * try {\n *   await signMessage({ message, walletAccount });\n * } catch (error) {\n *   if (error instanceof WaasRbacStaleRetryUnsafeError) {\n *     // The one-time approval was spent; re-verify before trying again.\n *     await promptStepUp();\n *     await signMessage({ message, walletAccount });\n *   }\n * }\n * ```\n * @see WaasLoadFailedError\n * @see signMessage\n */\nexport class WaasRbacStaleRetryUnsafeError extends BaseError {\n  constructor({ cause }: { cause: Error }) {\n    super({\n      cause,\n      code: 'waas_rbac_stale_retry_unsafe',\n      docsUrl: null,\n      name: 'WaasRbacStaleRetryUnsafeError',\n      shortMessage:\n        'The business account role change could not be retried automatically because a one-time authorization was already consumed. Re-authenticate and retry the operation.',\n    });\n  }\n}\n","import type { AuthMode } from '@dynamic-labs-wallet/browser-wallet-client';\nimport { preconnectWaasIframe as preconnectWaasIframeOrigin } from '@dynamic-labs-wallet/browser-wallet-client';\n\nimport { getCore } from '../../../client/core/getCore';\nimport type { DynamicClient } from '../../../client/types';\nimport { isCookieEnabled } from '../../projectSettings/isCookieEnabled';\nimport { DEFAULT_WAAS_BASE_API_URL } from '../constants';\nimport { isDynamicWaasEnabled } from '../isDynamicWaasEnabled';\n\n/**\n * Warms the browser's connection (DNS + TCP + TLS) to the embedded-wallet\n * iframe origin so the iframe mounted after authentication completes loads on\n * a hot connection. Called when an auth flow starts (OTP send/verify, social\n * callback). Safe to call repeatedly; no-op on React Native / SSR and when\n * Dynamic WaaS is not enabled.\n *\n * @param client - The Dynamic client instance.\n * @notInstrumented\n */\nexport const preconnectWaasIframe = (client: DynamicClient): void => {\n  const core = getCore(client);\n  try {\n    if (!isDynamicWaasEnabled(client)) return;\n\n    preconnectWaasIframeOrigin({\n      authMode: (isCookieEnabled(client) ? 'cookie' : 'header') as AuthMode,\n      baseApiUrl: (core.apiBaseUrl || DEFAULT_WAAS_BASE_API_URL).replace(\n        '/api/v0',\n        ''\n      ),\n    });\n  } catch (error) {\n    // Best-effort: never break the auth flow (also swallows the assertion\n    // from isDynamicWaasEnabled when project settings are not loaded yet).\n    core.logger.warn('[preconnectWaasIframe] skipped', error);\n  }\n};\n","import type { User } from '../../user/user.types';\n\n/**\n * Checks if device registration is required for the given user.\n *\n * This function determines if the user has the deviceRegistration\n * scope, indicating that device registration is required.\n *\n * @param user - The user to check.\n * @returns True if device registration is required, false otherwise.\n * @notInstrumented\n * @hook Exposed as a hook so consumers reactively know when this device must be registered, updated when the user changes.\n */\nexport const isDeviceRegistrationRequired = (user: User): boolean =>\n  Boolean(user.scope?.includes('device:register'));\n","import { MfaBackupCodeAcknowledgement } from '@dynamic-labs/sdk-api-core';\n\nimport { getDefaultClient } from '../../../client/defaultClient';\nimport { assertDefined } from '../../../utils/assertDefined';\n\n/**\n * Checks if the user is still pending acknowledgment of their MFA recovery codes.\n *\n * This function determines whether the user has been presented with recovery\n * codes that they have not yet acknowledged as saved or backed up.\n *\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns True if recovery codes are pending acknowledgment, false otherwise.\n * @notInstrumented\n * @hook Exposed as a hook so consumers reactively know when recovery codes await acknowledgment, updated when the user changes.\n */\nexport const isPendingRecoveryCodesAcknowledgment = (\n  client = getDefaultClient()\n): boolean => {\n  const user = client.user;\n\n  assertDefined(user, 'User not logged in');\n\n  return (\n    user.mfaBackupCodeAcknowledgement === MfaBackupCodeAcknowledgement.Pending\n  );\n};\n","import { getDefaultClient } from '../../../client/defaultClient';\nimport { assertDefined } from '../../../utils/assertDefined';\nimport { isDeviceRegistrationRequired } from '../../deviceRegistration/isDeviceRegistrationRequired';\nimport { isPendingRecoveryCodesAcknowledgment } from '../../mfa/isPendingRecoveryCodesAcknowledgment';\nimport { isUserMissingMfaAuth } from '../../mfa/isUserMissingMfaAuth';\n\n/**\n * Checks if the user has completed all onboarding requirements.\n *\n * This function verifies whether a user has fulfilled all necessary requirements\n * including KYC fields (Know Your Customer information), MFA setup\n * (Multi-Factor Authentication including recovery codes acknowledgment), and\n * device registration.\n *\n * A `false` result means the user still has an outstanding onboarding step, so\n * any feature that requires a fully onboarded (`user:basic`) user should hold\n * off until it returns `true`. Creating or accessing an embedded (WaaS) wallet\n * is one such feature — its backend calls reject a pre-`user:basic` token — but\n * this predicate is general and not specific to embedded wallets.\n *\n * @deprecated Use {@link checkUserScopes} instead. This function conflates\n * Dynamic-controlled requirements (MFA, device registration, required fields)\n * with the concept of \"onboarding complete\", which is app-specific. Replace\n * with `checkUserScopes({ user, scopes: ['user:basic'] })` to check whether\n * Dynamic's requirements are satisfied, and compose your own logic on top for\n * any app-specific onboarding steps.\n *\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns True if onboarding is complete (no pending requirements), false if there are pending requirements.\n * @notInstrumented\n * @hook Exposed as a hook so consumers reactively know when onboarding is complete, updated when the user changes.\n */\nexport const isUserOnboardingComplete = (\n  client = getDefaultClient()\n): boolean => {\n  const user = client.user;\n\n  assertDefined(user, 'User not logged in');\n\n  const hasMissingKycFields = Boolean(user.missingFields?.length);\n  const hasPendingMfaAuth = isUserMissingMfaAuth(client);\n  const hasPendingRecoveryCodes = isPendingRecoveryCodesAcknowledgment(client);\n  const hasPendingDeviceRegistration = isDeviceRegistrationRequired(user);\n\n  const userOnboardingComplete =\n    !hasMissingKycFields &&\n    !hasPendingMfaAuth &&\n    !hasPendingRecoveryCodes &&\n    !hasPendingDeviceRegistration;\n\n  return userOnboardingComplete;\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAwCA,IAAa,sBAAb,cAAyC,UAAU;CACjD,AAAS;CAET,YAAY,EAAE,SAA2B;AACvC,QAAM;GACJ;GACA,MAAM;GACN,SAAS;GACT,MAAM;GACN,cACE;GACH,CAAC;AACF,OAAK,SAAS;;;;;;;;;;;;;;;;;;;ACrClB,IAAa,gCAAb,cAAmD,UAAU;CAC3D,cAAc;AACZ,QAAM;GACJ,OAAO;GACP,MAAM;GACN,SAAS;GACT,MAAM;GACN,cACE;GACH,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;ACON,IAAa,gCAAb,cAAmD,UAAU;CAC3D,YAAY,EAAE,SAA2B;AACvC,QAAM;GACJ;GACA,MAAM;GACN,SAAS;GACT,MAAM;GACN,cACE;GACH,CAAC;;;;;;;;;;;;;;;;ACrBN,MAAaA,0BAAwB,WAAgC;CACnE,MAAM,OAAO,QAAQ,OAAO;AAC5B,KAAI;AACF,MAAI,CAAC,qBAAqB,OAAO,CAAE;AAEnC,uBAA2B;GACzB,UAAW,gBAAgB,OAAO,GAAG,WAAW;GAChD,aAAa,KAAK,cAAc,2BAA2B,QACzD,WACA,GACD;GACF,CAAC;UACK,OAAO;AAGd,OAAK,OAAO,KAAK,kCAAkC,MAAM;;;;;;;;;;;;;;;;;ACrB7D,MAAa,gCAAgC,SAC3C,QAAQ,KAAK,OAAO,SAAS,kBAAkB,CAAC;;;;;;;;;;;;;;;ACElD,MAAa,wCACX,SAAS,kBAAkB,KACf;CACZ,MAAM,OAAO,OAAO;AAEpB,eAAc,MAAM,qBAAqB;AAEzC,QACE,KAAK,iCAAiC,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;ACQvE,MAAa,4BACX,SAAS,kBAAkB,KACf;CACZ,MAAM,OAAO,OAAO;AAEpB,eAAc,MAAM,qBAAqB;CAEzC,MAAM,sBAAsB,QAAQ,KAAK,eAAe,OAAO;CAC/D,MAAM,oBAAoB,qBAAqB,OAAO;CACtD,MAAM,0BAA0B,qCAAqC,OAAO;CAC5E,MAAM,+BAA+B,6BAA6B,KAAK;AAQvE,QALE,CAAC,uBACD,CAAC,qBACD,CAAC,2BACD,CAAC"}

package/dist/{isUserOnboardingComplete-CYpgo52t.native.esm.js → isUserOnboardingComplete-DYnRDLep.native.esm.js}

@@ -1,5 +1,5 @@
-import { C as DEFAULT_WAAS_BASE_API_URL, Ct as getCore, U as isUserMissingMfaAuth, bt as getDefaultClient, ht as assertDefined, mt as isCookieEnabled, wt as BaseError } from "./apiClient-BbjPoAwE.native.esm.js";
-import { n as isDynamicWaasEnabled } from "./migrateFromFireblocks-BLz9aHOY.native.esm.js";
+import { C as DEFAULT_WAAS_BASE_API_URL, Ct as getCore, U as isUserMissingMfaAuth, bt as getDefaultClient, ht as assertDefined, mt as isCookieEnabled, wt as BaseError } from "./apiClient-CpfEx6Uc.native.esm.js";
+import { n as isDynamicWaasEnabled } from "./migrateFromFireblocks-BwYnNAAh.native.esm.js";
 import { MfaBackupCodeAcknowledgement } from "@dynamic-labs/sdk-api-core";
 import { preconnectWaasIframe } from "@dynamic-labs-wallet/browser-wallet-client";
 
@@ -211,4 +211,4 @@ const isUserOnboardingComplete = (client = getDefaultClient()) => {
 
 //#endregion
 export { WaasRbacStaleRetryUnsafeError as a, preconnectWaasIframe$1 as i, isPendingRecoveryCodesAcknowledgment as n, WaasOnboardingIncompleteError as o, isDeviceRegistrationRequired as r, WaasLoadFailedError as s, isUserOnboardingComplete as t };
-//# sourceMappingURL=isUserOnboardingComplete-CYpgo52t.native.esm.js.map
+//# sourceMappingURL=isUserOnboardingComplete-DYnRDLep.native.esm.js.map

package/dist/{isUserOnboardingComplete-CYpgo52t.native.esm.js.map → isUserOnboardingComplete-DYnRDLep.native.esm.js.map}

@@ -1 +1 @@
-{"version":3,"file":"isUserOnboardingComplete-CYpgo52t.native.esm.js","names":["preconnectWaasIframe"],"sources":["../src/errors/WaasLoadFailedError.ts","../src/errors/WaasOnboardingIncompleteError.ts","../src/errors/WaasRbacStaleRetryUnsafeError.ts","../src/modules/waas/preconnectWaasIframe/preconnectWaasIframe.ts","../src/modules/deviceRegistration/isDeviceRegistrationRequired/isDeviceRegistrationRequired.ts","../src/modules/mfa/isPendingRecoveryCodesAcknowledgment/isPendingRecoveryCodesAcknowledgment.ts","../src/modules/user/isUserOnboardingComplete/isUserOnboardingComplete.ts"],"sourcesContent":["import { BaseError } from './base';\n\n/**\n * Why the embedded wallet load failed. Currently only retry exhaustion is\n * reported; the union exists so new reasons can be added without a breaking\n * change to consumer `instanceof` handling.\n *\n * @example\n * ```ts\n * const reason: WaasLoadFailedErrorReason = 'load_attempts_exhausted';\n * ```\n * @see WaasLoadFailedError\n * @see signMessage\n */\nexport type WaasLoadFailedErrorReason = 'load_attempts_exhausted';\n\n/**\n * Thrown when the embedded (WaaS) wallet's secure container failed to load\n * after exhausting all of its internal retry attempts.\n *\n * This failure is transient: the next wallet operation triggers a fresh load\n * cycle, so hosts can catch this error and re-attempt the operation at their\n * own cadence (for example, when connectivity returns or the app is\n * foregrounded). Other load failures (for example, a CSP block) are not\n * wrapped by this error and their shape is not guaranteed.\n *\n * @example\n * ```ts\n * try {\n *   await signMessage({ message, walletAccount });\n * } catch (error) {\n *   if (error instanceof WaasLoadFailedError) {\n *     // transient — retry the operation at your own cadence\n *     await signMessage({ message, walletAccount });\n *   }\n * }\n * ```\n * @see WaasLoadFailedErrorReason\n * @see signMessage\n */\nexport class WaasLoadFailedError extends BaseError {\n  readonly reason: WaasLoadFailedErrorReason;\n\n  constructor({ cause }: { cause: Error }) {\n    super({\n      cause,\n      code: 'waas_load_failed',\n      docsUrl: null,\n      name: 'WaasLoadFailedError',\n      shortMessage:\n        'The embedded wallet failed to load after exhausting its retry attempts. Retrying the wallet operation triggers a fresh load.',\n    });\n    this.reason = 'load_attempts_exhausted';\n  }\n}\n","import { BaseError } from './base';\n\n/**\n * Thrown when the embedded (WaaS) wallet client is requested before the user\n * has completed onboarding — i.e. the JWT has not upgraded to `user:basic`\n * because MFA, KYC, recovery-codes acknowledgment, or device registration is\n * still pending.\n *\n * The WaaS iframe's init-time room-cache pre-warm fires `createRooms` using the\n * token captured at client construction (before any per-operation token\n * resync). Building the client during this window lets that pre-warm fire with\n * a pre-`user:basic` token, get a 401, and the iframe's unauthorized handler\n * force-logs-out the user. Throwing here surfaces a clear, recoverable reason\n * instead — wait for onboarding to complete and retry.\n */\nexport class WaasOnboardingIncompleteError extends BaseError {\n  constructor() {\n    super({\n      cause: null,\n      code: 'waas_onboarding_incomplete',\n      docsUrl: null,\n      name: 'WaasOnboardingIncompleteError',\n      shortMessage:\n        'Cannot create or access the embedded wallet until onboarding is complete (pending MFA, KYC, recovery-codes acknowledgment, or device registration).',\n    });\n  }\n}\n","import { BaseError } from './base';\n\n/**\n * Thrown when a WaaS ceremony operation (sign, export, reshare, create\n * wallet) receives a 403 `rbac_stale` response after the attempt has already\n * spent its one-time authorization — either the legacy MFA token or a\n * single-use elevated access token.\n *\n * The SDK cannot safely retry in that case: the restarted attempt would find\n * the approval already consumed and fail deeper in the stack with an\n * unrelated \"no MFA token\" error, hiding the permission change that actually\n * caused the failure. Surfacing this error instead tells the host exactly what\n * happened. Recover by re-running the step-up/MFA flow and retrying the\n * operation; the business-account role change has already taken effect, so the\n * retry is evaluated against the caller's current permissions.\n *\n * @example\n * ```ts\n * try {\n *   await signMessage({ message, walletAccount });\n * } catch (error) {\n *   if (error instanceof WaasRbacStaleRetryUnsafeError) {\n *     // The one-time approval was spent; re-verify before trying again.\n *     await promptStepUp();\n *     await signMessage({ message, walletAccount });\n *   }\n * }\n * ```\n * @see WaasLoadFailedError\n * @see signMessage\n */\nexport class WaasRbacStaleRetryUnsafeError extends BaseError {\n  constructor({ cause }: { cause: Error }) {\n    super({\n      cause,\n      code: 'waas_rbac_stale_retry_unsafe',\n      docsUrl: null,\n      name: 'WaasRbacStaleRetryUnsafeError',\n      shortMessage:\n        'The business account role change could not be retried automatically because a one-time authorization was already consumed. Re-authenticate and retry the operation.',\n    });\n  }\n}\n","import type { AuthMode } from '@dynamic-labs-wallet/browser-wallet-client';\nimport { preconnectWaasIframe as preconnectWaasIframeOrigin } from '@dynamic-labs-wallet/browser-wallet-client';\n\nimport { getCore } from '../../../client/core/getCore';\nimport type { DynamicClient } from '../../../client/types';\nimport { isCookieEnabled } from '../../projectSettings/isCookieEnabled';\nimport { DEFAULT_WAAS_BASE_API_URL } from '../constants';\nimport { isDynamicWaasEnabled } from '../isDynamicWaasEnabled';\n\n/**\n * Warms the browser's connection (DNS + TCP + TLS) to the embedded-wallet\n * iframe origin so the iframe mounted after authentication completes loads on\n * a hot connection. Called when an auth flow starts (OTP send/verify, social\n * callback). Safe to call repeatedly; no-op on React Native / SSR and when\n * Dynamic WaaS is not enabled.\n *\n * @param client - The Dynamic client instance.\n * @notInstrumented\n */\nexport const preconnectWaasIframe = (client: DynamicClient): void => {\n  const core = getCore(client);\n  try {\n    if (!isDynamicWaasEnabled(client)) return;\n\n    preconnectWaasIframeOrigin({\n      authMode: (isCookieEnabled(client) ? 'cookie' : 'header') as AuthMode,\n      baseApiUrl: (core.apiBaseUrl || DEFAULT_WAAS_BASE_API_URL).replace(\n        '/api/v0',\n        ''\n      ),\n    });\n  } catch (error) {\n    // Best-effort: never break the auth flow (also swallows the assertion\n    // from isDynamicWaasEnabled when project settings are not loaded yet).\n    core.logger.warn('[preconnectWaasIframe] skipped', error);\n  }\n};\n","import type { User } from '../../user/user.types';\n\n/**\n * Checks if device registration is required for the given user.\n *\n * This function determines if the user has the deviceRegistration\n * scope, indicating that device registration is required.\n *\n * @param user - The user to check.\n * @returns True if device registration is required, false otherwise.\n * @notInstrumented\n * @hook Exposed as a hook so consumers reactively know when this device must be registered, updated when the user changes.\n */\nexport const isDeviceRegistrationRequired = (user: User): boolean =>\n  Boolean(user.scope?.includes('device:register'));\n","import { MfaBackupCodeAcknowledgement } from '@dynamic-labs/sdk-api-core';\n\nimport { getDefaultClient } from '../../../client/defaultClient';\nimport { assertDefined } from '../../../utils/assertDefined';\n\n/**\n * Checks if the user is still pending acknowledgment of their MFA recovery codes.\n *\n * This function determines whether the user has been presented with recovery\n * codes that they have not yet acknowledged as saved or backed up.\n *\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns True if recovery codes are pending acknowledgment, false otherwise.\n * @notInstrumented\n * @hook Exposed as a hook so consumers reactively know when recovery codes await acknowledgment, updated when the user changes.\n */\nexport const isPendingRecoveryCodesAcknowledgment = (\n  client = getDefaultClient()\n): boolean => {\n  const user = client.user;\n\n  assertDefined(user, 'User not logged in');\n\n  return (\n    user.mfaBackupCodeAcknowledgement === MfaBackupCodeAcknowledgement.Pending\n  );\n};\n","import { getDefaultClient } from '../../../client/defaultClient';\nimport { assertDefined } from '../../../utils/assertDefined';\nimport { isDeviceRegistrationRequired } from '../../deviceRegistration/isDeviceRegistrationRequired';\nimport { isPendingRecoveryCodesAcknowledgment } from '../../mfa/isPendingRecoveryCodesAcknowledgment';\nimport { isUserMissingMfaAuth } from '../../mfa/isUserMissingMfaAuth';\n\n/**\n * Checks if the user has completed all onboarding requirements.\n *\n * This function verifies whether a user has fulfilled all necessary requirements\n * including KYC fields (Know Your Customer information), MFA setup\n * (Multi-Factor Authentication including recovery codes acknowledgment), and\n * device registration.\n *\n * A `false` result means the user still has an outstanding onboarding step, so\n * any feature that requires a fully onboarded (`user:basic`) user should hold\n * off until it returns `true`. Creating or accessing an embedded (WaaS) wallet\n * is one such feature — its backend calls reject a pre-`user:basic` token — but\n * this predicate is general and not specific to embedded wallets.\n *\n * @deprecated Use {@link checkUserScopes} instead. This function conflates\n * Dynamic-controlled requirements (MFA, device registration, required fields)\n * with the concept of \"onboarding complete\", which is app-specific. Replace\n * with `checkUserScopes({ user, scopes: ['user:basic'] })` to check whether\n * Dynamic's requirements are satisfied, and compose your own logic on top for\n * any app-specific onboarding steps.\n *\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns True if onboarding is complete (no pending requirements), false if there are pending requirements.\n * @notInstrumented\n * @hook Exposed as a hook so consumers reactively know when onboarding is complete, updated when the user changes.\n */\nexport const isUserOnboardingComplete = (\n  client = getDefaultClient()\n): boolean => {\n  const user = client.user;\n\n  assertDefined(user, 'User not logged in');\n\n  const hasMissingKycFields = Boolean(user.missingFields?.length);\n  const hasPendingMfaAuth = isUserMissingMfaAuth(client);\n  const hasPendingRecoveryCodes = isPendingRecoveryCodesAcknowledgment(client);\n  const hasPendingDeviceRegistration = isDeviceRegistrationRequired(user);\n\n  const userOnboardingComplete =\n    !hasMissingKycFields &&\n    !hasPendingMfaAuth &&\n    !hasPendingRecoveryCodes &&\n    !hasPendingDeviceRegistration;\n\n  return userOnboardingComplete;\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAwCA,IAAa,sBAAb,cAAyC,UAAU;CACjD,AAAS;CAET,YAAY,EAAE,SAA2B;AACvC,QAAM;GACJ;GACA,MAAM;GACN,SAAS;GACT,MAAM;GACN,cACE;GACH,CAAC;AACF,OAAK,SAAS;;;;;;;;;;;;;;;;;;;ACrClB,IAAa,gCAAb,cAAmD,UAAU;CAC3D,cAAc;AACZ,QAAM;GACJ,OAAO;GACP,MAAM;GACN,SAAS;GACT,MAAM;GACN,cACE;GACH,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;ACON,IAAa,gCAAb,cAAmD,UAAU;CAC3D,YAAY,EAAE,SAA2B;AACvC,QAAM;GACJ;GACA,MAAM;GACN,SAAS;GACT,MAAM;GACN,cACE;GACH,CAAC;;;;;;;;;;;;;;;;ACrBN,MAAaA,0BAAwB,WAAgC;CACnE,MAAM,OAAO,QAAQ,OAAO;AAC5B,KAAI;AACF,MAAI,CAAC,qBAAqB,OAAO,CAAE;AAEnC,uBAA2B;GACzB,UAAW,gBAAgB,OAAO,GAAG,WAAW;GAChD,aAAa,KAAK,cAAc,2BAA2B,QACzD,WACA,GACD;GACF,CAAC;UACK,OAAO;AAGd,OAAK,OAAO,KAAK,kCAAkC,MAAM;;;;;;;;;;;;;;;;;ACrB7D,MAAa,gCAAgC,SAC3C,QAAQ,KAAK,OAAO,SAAS,kBAAkB,CAAC;;;;;;;;;;;;;;;ACElD,MAAa,wCACX,SAAS,kBAAkB,KACf;CACZ,MAAM,OAAO,OAAO;AAEpB,eAAc,MAAM,qBAAqB;AAEzC,QACE,KAAK,iCAAiC,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;ACQvE,MAAa,4BACX,SAAS,kBAAkB,KACf;CACZ,MAAM,OAAO,OAAO;AAEpB,eAAc,MAAM,qBAAqB;CAEzC,MAAM,sBAAsB,QAAQ,KAAK,eAAe,OAAO;CAC/D,MAAM,oBAAoB,qBAAqB,OAAO;CACtD,MAAM,0BAA0B,qCAAqC,OAAO;CAC5E,MAAM,+BAA+B,6BAA6B,KAAK;AAQvE,QALE,CAAC,uBACD,CAAC,qBACD,CAAC,2BACD,CAAC"}
+{"version":3,"file":"isUserOnboardingComplete-DYnRDLep.native.esm.js","names":["preconnectWaasIframe"],"sources":["../src/errors/WaasLoadFailedError.ts","../src/errors/WaasOnboardingIncompleteError.ts","../src/errors/WaasRbacStaleRetryUnsafeError.ts","../src/modules/waas/preconnectWaasIframe/preconnectWaasIframe.ts","../src/modules/deviceRegistration/isDeviceRegistrationRequired/isDeviceRegistrationRequired.ts","../src/modules/mfa/isPendingRecoveryCodesAcknowledgment/isPendingRecoveryCodesAcknowledgment.ts","../src/modules/user/isUserOnboardingComplete/isUserOnboardingComplete.ts"],"sourcesContent":["import { BaseError } from './base';\n\n/**\n * Why the embedded wallet load failed. Currently only retry exhaustion is\n * reported; the union exists so new reasons can be added without a breaking\n * change to consumer `instanceof` handling.\n *\n * @example\n * ```ts\n * const reason: WaasLoadFailedErrorReason = 'load_attempts_exhausted';\n * ```\n * @see WaasLoadFailedError\n * @see signMessage\n */\nexport type WaasLoadFailedErrorReason = 'load_attempts_exhausted';\n\n/**\n * Thrown when the embedded (WaaS) wallet's secure container failed to load\n * after exhausting all of its internal retry attempts.\n *\n * This failure is transient: the next wallet operation triggers a fresh load\n * cycle, so hosts can catch this error and re-attempt the operation at their\n * own cadence (for example, when connectivity returns or the app is\n * foregrounded). Other load failures (for example, a CSP block) are not\n * wrapped by this error and their shape is not guaranteed.\n *\n * @example\n * ```ts\n * try {\n *   await signMessage({ message, walletAccount });\n * } catch (error) {\n *   if (error instanceof WaasLoadFailedError) {\n *     // transient — retry the operation at your own cadence\n *     await signMessage({ message, walletAccount });\n *   }\n * }\n * ```\n * @see WaasLoadFailedErrorReason\n * @see signMessage\n */\nexport class WaasLoadFailedError extends BaseError {\n  readonly reason: WaasLoadFailedErrorReason;\n\n  constructor({ cause }: { cause: Error }) {\n    super({\n      cause,\n      code: 'waas_load_failed',\n      docsUrl: null,\n      name: 'WaasLoadFailedError',\n      shortMessage:\n        'The embedded wallet failed to load after exhausting its retry attempts. Retrying the wallet operation triggers a fresh load.',\n    });\n    this.reason = 'load_attempts_exhausted';\n  }\n}\n","import { BaseError } from './base';\n\n/**\n * Thrown when the embedded (WaaS) wallet client is requested before the user\n * has completed onboarding — i.e. the JWT has not upgraded to `user:basic`\n * because MFA, KYC, recovery-codes acknowledgment, or device registration is\n * still pending.\n *\n * The WaaS iframe's init-time room-cache pre-warm fires `createRooms` using the\n * token captured at client construction (before any per-operation token\n * resync). Building the client during this window lets that pre-warm fire with\n * a pre-`user:basic` token, get a 401, and the iframe's unauthorized handler\n * force-logs-out the user. Throwing here surfaces a clear, recoverable reason\n * instead — wait for onboarding to complete and retry.\n */\nexport class WaasOnboardingIncompleteError extends BaseError {\n  constructor() {\n    super({\n      cause: null,\n      code: 'waas_onboarding_incomplete',\n      docsUrl: null,\n      name: 'WaasOnboardingIncompleteError',\n      shortMessage:\n        'Cannot create or access the embedded wallet until onboarding is complete (pending MFA, KYC, recovery-codes acknowledgment, or device registration).',\n    });\n  }\n}\n","import { BaseError } from './base';\n\n/**\n * Thrown when a WaaS ceremony operation (sign, export, reshare, create\n * wallet) receives a 403 `rbac_stale` response after the attempt has already\n * spent its one-time authorization — either the legacy MFA token or a\n * single-use elevated access token.\n *\n * The SDK cannot safely retry in that case: the restarted attempt would find\n * the approval already consumed and fail deeper in the stack with an\n * unrelated \"no MFA token\" error, hiding the permission change that actually\n * caused the failure. Surfacing this error instead tells the host exactly what\n * happened. Recover by re-running the step-up/MFA flow and retrying the\n * operation; the business-account role change has already taken effect, so the\n * retry is evaluated against the caller's current permissions.\n *\n * @example\n * ```ts\n * try {\n *   await signMessage({ message, walletAccount });\n * } catch (error) {\n *   if (error instanceof WaasRbacStaleRetryUnsafeError) {\n *     // The one-time approval was spent; re-verify before trying again.\n *     await promptStepUp();\n *     await signMessage({ message, walletAccount });\n *   }\n * }\n * ```\n * @see WaasLoadFailedError\n * @see signMessage\n */\nexport class WaasRbacStaleRetryUnsafeError extends BaseError {\n  constructor({ cause }: { cause: Error }) {\n    super({\n      cause,\n      code: 'waas_rbac_stale_retry_unsafe',\n      docsUrl: null,\n      name: 'WaasRbacStaleRetryUnsafeError',\n      shortMessage:\n        'The business account role change could not be retried automatically because a one-time authorization was already consumed. Re-authenticate and retry the operation.',\n    });\n  }\n}\n","import type { AuthMode } from '@dynamic-labs-wallet/browser-wallet-client';\nimport { preconnectWaasIframe as preconnectWaasIframeOrigin } from '@dynamic-labs-wallet/browser-wallet-client';\n\nimport { getCore } from '../../../client/core/getCore';\nimport type { DynamicClient } from '../../../client/types';\nimport { isCookieEnabled } from '../../projectSettings/isCookieEnabled';\nimport { DEFAULT_WAAS_BASE_API_URL } from '../constants';\nimport { isDynamicWaasEnabled } from '../isDynamicWaasEnabled';\n\n/**\n * Warms the browser's connection (DNS + TCP + TLS) to the embedded-wallet\n * iframe origin so the iframe mounted after authentication completes loads on\n * a hot connection. Called when an auth flow starts (OTP send/verify, social\n * callback). Safe to call repeatedly; no-op on React Native / SSR and when\n * Dynamic WaaS is not enabled.\n *\n * @param client - The Dynamic client instance.\n * @notInstrumented\n */\nexport const preconnectWaasIframe = (client: DynamicClient): void => {\n  const core = getCore(client);\n  try {\n    if (!isDynamicWaasEnabled(client)) return;\n\n    preconnectWaasIframeOrigin({\n      authMode: (isCookieEnabled(client) ? 'cookie' : 'header') as AuthMode,\n      baseApiUrl: (core.apiBaseUrl || DEFAULT_WAAS_BASE_API_URL).replace(\n        '/api/v0',\n        ''\n      ),\n    });\n  } catch (error) {\n    // Best-effort: never break the auth flow (also swallows the assertion\n    // from isDynamicWaasEnabled when project settings are not loaded yet).\n    core.logger.warn('[preconnectWaasIframe] skipped', error);\n  }\n};\n","import type { User } from '../../user/user.types';\n\n/**\n * Checks if device registration is required for the given user.\n *\n * This function determines if the user has the deviceRegistration\n * scope, indicating that device registration is required.\n *\n * @param user - The user to check.\n * @returns True if device registration is required, false otherwise.\n * @notInstrumented\n * @hook Exposed as a hook so consumers reactively know when this device must be registered, updated when the user changes.\n */\nexport const isDeviceRegistrationRequired = (user: User): boolean =>\n  Boolean(user.scope?.includes('device:register'));\n","import { MfaBackupCodeAcknowledgement } from '@dynamic-labs/sdk-api-core';\n\nimport { getDefaultClient } from '../../../client/defaultClient';\nimport { assertDefined } from '../../../utils/assertDefined';\n\n/**\n * Checks if the user is still pending acknowledgment of their MFA recovery codes.\n *\n * This function determines whether the user has been presented with recovery\n * codes that they have not yet acknowledged as saved or backed up.\n *\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns True if recovery codes are pending acknowledgment, false otherwise.\n * @notInstrumented\n * @hook Exposed as a hook so consumers reactively know when recovery codes await acknowledgment, updated when the user changes.\n */\nexport const isPendingRecoveryCodesAcknowledgment = (\n  client = getDefaultClient()\n): boolean => {\n  const user = client.user;\n\n  assertDefined(user, 'User not logged in');\n\n  return (\n    user.mfaBackupCodeAcknowledgement === MfaBackupCodeAcknowledgement.Pending\n  );\n};\n","import { getDefaultClient } from '../../../client/defaultClient';\nimport { assertDefined } from '../../../utils/assertDefined';\nimport { isDeviceRegistrationRequired } from '../../deviceRegistration/isDeviceRegistrationRequired';\nimport { isPendingRecoveryCodesAcknowledgment } from '../../mfa/isPendingRecoveryCodesAcknowledgment';\nimport { isUserMissingMfaAuth } from '../../mfa/isUserMissingMfaAuth';\n\n/**\n * Checks if the user has completed all onboarding requirements.\n *\n * This function verifies whether a user has fulfilled all necessary requirements\n * including KYC fields (Know Your Customer information), MFA setup\n * (Multi-Factor Authentication including recovery codes acknowledgment), and\n * device registration.\n *\n * A `false` result means the user still has an outstanding onboarding step, so\n * any feature that requires a fully onboarded (`user:basic`) user should hold\n * off until it returns `true`. Creating or accessing an embedded (WaaS) wallet\n * is one such feature — its backend calls reject a pre-`user:basic` token — but\n * this predicate is general and not specific to embedded wallets.\n *\n * @deprecated Use {@link checkUserScopes} instead. This function conflates\n * Dynamic-controlled requirements (MFA, device registration, required fields)\n * with the concept of \"onboarding complete\", which is app-specific. Replace\n * with `checkUserScopes({ user, scopes: ['user:basic'] })` to check whether\n * Dynamic's requirements are satisfied, and compose your own logic on top for\n * any app-specific onboarding steps.\n *\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns True if onboarding is complete (no pending requirements), false if there are pending requirements.\n * @notInstrumented\n * @hook Exposed as a hook so consumers reactively know when onboarding is complete, updated when the user changes.\n */\nexport const isUserOnboardingComplete = (\n  client = getDefaultClient()\n): boolean => {\n  const user = client.user;\n\n  assertDefined(user, 'User not logged in');\n\n  const hasMissingKycFields = Boolean(user.missingFields?.length);\n  const hasPendingMfaAuth = isUserMissingMfaAuth(client);\n  const hasPendingRecoveryCodes = isPendingRecoveryCodesAcknowledgment(client);\n  const hasPendingDeviceRegistration = isDeviceRegistrationRequired(user);\n\n  const userOnboardingComplete =\n    !hasMissingKycFields &&\n    !hasPendingMfaAuth &&\n    !hasPendingRecoveryCodes &&\n    !hasPendingDeviceRegistration;\n\n  return userOnboardingComplete;\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAwCA,IAAa,sBAAb,cAAyC,UAAU;CACjD,AAAS;CAET,YAAY,EAAE,SAA2B;AACvC,QAAM;GACJ;GACA,MAAM;GACN,SAAS;GACT,MAAM;GACN,cACE;GACH,CAAC;AACF,OAAK,SAAS;;;;;;;;;;;;;;;;;;;ACrClB,IAAa,gCAAb,cAAmD,UAAU;CAC3D,cAAc;AACZ,QAAM;GACJ,OAAO;GACP,MAAM;GACN,SAAS;GACT,MAAM;GACN,cACE;GACH,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;ACON,IAAa,gCAAb,cAAmD,UAAU;CAC3D,YAAY,EAAE,SAA2B;AACvC,QAAM;GACJ;GACA,MAAM;GACN,SAAS;GACT,MAAM;GACN,cACE;GACH,CAAC;;;;;;;;;;;;;;;;ACrBN,MAAaA,0BAAwB,WAAgC;CACnE,MAAM,OAAO,QAAQ,OAAO;AAC5B,KAAI;AACF,MAAI,CAAC,qBAAqB,OAAO,CAAE;AAEnC,uBAA2B;GACzB,UAAW,gBAAgB,OAAO,GAAG,WAAW;GAChD,aAAa,KAAK,cAAc,2BAA2B,QACzD,WACA,GACD;GACF,CAAC;UACK,OAAO;AAGd,OAAK,OAAO,KAAK,kCAAkC,MAAM;;;;;;;;;;;;;;;;;ACrB7D,MAAa,gCAAgC,SAC3C,QAAQ,KAAK,OAAO,SAAS,kBAAkB,CAAC;;;;;;;;;;;;;;;ACElD,MAAa,wCACX,SAAS,kBAAkB,KACf;CACZ,MAAM,OAAO,OAAO;AAEpB,eAAc,MAAM,qBAAqB;AAEzC,QACE,KAAK,iCAAiC,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;ACQvE,MAAa,4BACX,SAAS,kBAAkB,KACf;CACZ,MAAM,OAAO,OAAO;AAEpB,eAAc,MAAM,qBAAqB;CAEzC,MAAM,sBAAsB,QAAQ,KAAK,eAAe,OAAO;CAC/D,MAAM,oBAAoB,qBAAqB,OAAO;CACtD,MAAM,0BAA0B,qCAAqC,OAAO;CAC5E,MAAM,+BAA+B,6BAA6B,KAAK;AAQvE,QALE,CAAC,uBACD,CAAC,qBACD,CAAC,2BACD,CAAC"}

package/dist/{isUserOnboardingComplete-BAL-3zu7.cjs → isUserOnboardingComplete-FbjleMQm.cjs}

@@ -1,5 +1,5 @@
-const require_logoutWithReason = require('./logoutWithReason-CFjm8dbR.cjs');
-const require_migrateFromFireblocks = require('./migrateFromFireblocks-BiZmnKp9.cjs');
+const require_logoutWithReason = require('./logoutWithReason-BKwWBsCT.cjs');
+const require_migrateFromFireblocks = require('./migrateFromFireblocks-ycJIYcrm.cjs');
 let _dynamic_labs_sdk_api_core = require("@dynamic-labs/sdk-api-core");
 let _dynamic_labs_wallet_browser_wallet_client = require("@dynamic-labs-wallet/browser-wallet-client");
 
@@ -252,4 +252,4 @@ Object.defineProperty(exports, 'preconnectWaasIframe', {
     return preconnectWaasIframe;
   }
 });
-//# sourceMappingURL=isUserOnboardingComplete-BAL-3zu7.cjs.map
+//# sourceMappingURL=isUserOnboardingComplete-FbjleMQm.cjs.map

package/dist/{isUserOnboardingComplete-BAL-3zu7.cjs.map → isUserOnboardingComplete-FbjleMQm.cjs.map}

@@ -1 +1 @@
-{"version":3,"file":"isUserOnboardingComplete-BAL-3zu7.cjs","names":["BaseError","BaseError","BaseError","getCore","isDynamicWaasEnabled","isCookieEnabled","DEFAULT_WAAS_BASE_API_URL","getDefaultClient","MfaBackupCodeAcknowledgement","getDefaultClient","isUserMissingMfaAuth"],"sources":["../src/errors/WaasLoadFailedError.ts","../src/errors/WaasOnboardingIncompleteError.ts","../src/errors/WaasRbacStaleRetryUnsafeError.ts","../src/modules/waas/preconnectWaasIframe/preconnectWaasIframe.ts","../src/modules/deviceRegistration/isDeviceRegistrationRequired/isDeviceRegistrationRequired.ts","../src/modules/mfa/isPendingRecoveryCodesAcknowledgment/isPendingRecoveryCodesAcknowledgment.ts","../src/modules/user/isUserOnboardingComplete/isUserOnboardingComplete.ts"],"sourcesContent":["import { BaseError } from './base';\n\n/**\n * Why the embedded wallet load failed. Currently only retry exhaustion is\n * reported; the union exists so new reasons can be added without a breaking\n * change to consumer `instanceof` handling.\n *\n * @example\n * ```ts\n * const reason: WaasLoadFailedErrorReason = 'load_attempts_exhausted';\n * ```\n * @see WaasLoadFailedError\n * @see signMessage\n */\nexport type WaasLoadFailedErrorReason = 'load_attempts_exhausted';\n\n/**\n * Thrown when the embedded (WaaS) wallet's secure container failed to load\n * after exhausting all of its internal retry attempts.\n *\n * This failure is transient: the next wallet operation triggers a fresh load\n * cycle, so hosts can catch this error and re-attempt the operation at their\n * own cadence (for example, when connectivity returns or the app is\n * foregrounded). Other load failures (for example, a CSP block) are not\n * wrapped by this error and their shape is not guaranteed.\n *\n * @example\n * ```ts\n * try {\n *   await signMessage({ message, walletAccount });\n * } catch (error) {\n *   if (error instanceof WaasLoadFailedError) {\n *     // transient — retry the operation at your own cadence\n *     await signMessage({ message, walletAccount });\n *   }\n * }\n * ```\n * @see WaasLoadFailedErrorReason\n * @see signMessage\n */\nexport class WaasLoadFailedError extends BaseError {\n  readonly reason: WaasLoadFailedErrorReason;\n\n  constructor({ cause }: { cause: Error }) {\n    super({\n      cause,\n      code: 'waas_load_failed',\n      docsUrl: null,\n      name: 'WaasLoadFailedError',\n      shortMessage:\n        'The embedded wallet failed to load after exhausting its retry attempts. Retrying the wallet operation triggers a fresh load.',\n    });\n    this.reason = 'load_attempts_exhausted';\n  }\n}\n","import { BaseError } from './base';\n\n/**\n * Thrown when the embedded (WaaS) wallet client is requested before the user\n * has completed onboarding — i.e. the JWT has not upgraded to `user:basic`\n * because MFA, KYC, recovery-codes acknowledgment, or device registration is\n * still pending.\n *\n * The WaaS iframe's init-time room-cache pre-warm fires `createRooms` using the\n * token captured at client construction (before any per-operation token\n * resync). Building the client during this window lets that pre-warm fire with\n * a pre-`user:basic` token, get a 401, and the iframe's unauthorized handler\n * force-logs-out the user. Throwing here surfaces a clear, recoverable reason\n * instead — wait for onboarding to complete and retry.\n */\nexport class WaasOnboardingIncompleteError extends BaseError {\n  constructor() {\n    super({\n      cause: null,\n      code: 'waas_onboarding_incomplete',\n      docsUrl: null,\n      name: 'WaasOnboardingIncompleteError',\n      shortMessage:\n        'Cannot create or access the embedded wallet until onboarding is complete (pending MFA, KYC, recovery-codes acknowledgment, or device registration).',\n    });\n  }\n}\n","import { BaseError } from './base';\n\n/**\n * Thrown when a WaaS ceremony operation (sign, export, reshare, create\n * wallet) receives a 403 `rbac_stale` response after the attempt has already\n * spent its one-time authorization — either the legacy MFA token or a\n * single-use elevated access token.\n *\n * The SDK cannot safely retry in that case: the restarted attempt would find\n * the approval already consumed and fail deeper in the stack with an\n * unrelated \"no MFA token\" error, hiding the permission change that actually\n * caused the failure. Surfacing this error instead tells the host exactly what\n * happened. Recover by re-running the step-up/MFA flow and retrying the\n * operation; the business-account role change has already taken effect, so the\n * retry is evaluated against the caller's current permissions.\n *\n * @example\n * ```ts\n * try {\n *   await signMessage({ message, walletAccount });\n * } catch (error) {\n *   if (error instanceof WaasRbacStaleRetryUnsafeError) {\n *     // The one-time approval was spent; re-verify before trying again.\n *     await promptStepUp();\n *     await signMessage({ message, walletAccount });\n *   }\n * }\n * ```\n * @see WaasLoadFailedError\n * @see signMessage\n */\nexport class WaasRbacStaleRetryUnsafeError extends BaseError {\n  constructor({ cause }: { cause: Error }) {\n    super({\n      cause,\n      code: 'waas_rbac_stale_retry_unsafe',\n      docsUrl: null,\n      name: 'WaasRbacStaleRetryUnsafeError',\n      shortMessage:\n        'The business account role change could not be retried automatically because a one-time authorization was already consumed. Re-authenticate and retry the operation.',\n    });\n  }\n}\n","import type { AuthMode } from '@dynamic-labs-wallet/browser-wallet-client';\nimport { preconnectWaasIframe as preconnectWaasIframeOrigin } from '@dynamic-labs-wallet/browser-wallet-client';\n\nimport { getCore } from '../../../client/core/getCore';\nimport type { DynamicClient } from '../../../client/types';\nimport { isCookieEnabled } from '../../projectSettings/isCookieEnabled';\nimport { DEFAULT_WAAS_BASE_API_URL } from '../constants';\nimport { isDynamicWaasEnabled } from '../isDynamicWaasEnabled';\n\n/**\n * Warms the browser's connection (DNS + TCP + TLS) to the embedded-wallet\n * iframe origin so the iframe mounted after authentication completes loads on\n * a hot connection. Called when an auth flow starts (OTP send/verify, social\n * callback). Safe to call repeatedly; no-op on React Native / SSR and when\n * Dynamic WaaS is not enabled.\n *\n * @param client - The Dynamic client instance.\n * @notInstrumented\n */\nexport const preconnectWaasIframe = (client: DynamicClient): void => {\n  const core = getCore(client);\n  try {\n    if (!isDynamicWaasEnabled(client)) return;\n\n    preconnectWaasIframeOrigin({\n      authMode: (isCookieEnabled(client) ? 'cookie' : 'header') as AuthMode,\n      baseApiUrl: (core.apiBaseUrl || DEFAULT_WAAS_BASE_API_URL).replace(\n        '/api/v0',\n        ''\n      ),\n    });\n  } catch (error) {\n    // Best-effort: never break the auth flow (also swallows the assertion\n    // from isDynamicWaasEnabled when project settings are not loaded yet).\n    core.logger.warn('[preconnectWaasIframe] skipped', error);\n  }\n};\n","import type { User } from '../../user/user.types';\n\n/**\n * Checks if device registration is required for the given user.\n *\n * This function determines if the user has the deviceRegistration\n * scope, indicating that device registration is required.\n *\n * @param user - The user to check.\n * @returns True if device registration is required, false otherwise.\n * @notInstrumented\n * @hook Exposed as a hook so consumers reactively know when this device must be registered, updated when the user changes.\n */\nexport const isDeviceRegistrationRequired = (user: User): boolean =>\n  Boolean(user.scope?.includes('device:register'));\n","import { MfaBackupCodeAcknowledgement } from '@dynamic-labs/sdk-api-core';\n\nimport { getDefaultClient } from '../../../client/defaultClient';\nimport { assertDefined } from '../../../utils/assertDefined';\n\n/**\n * Checks if the user is still pending acknowledgment of their MFA recovery codes.\n *\n * This function determines whether the user has been presented with recovery\n * codes that they have not yet acknowledged as saved or backed up.\n *\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns True if recovery codes are pending acknowledgment, false otherwise.\n * @notInstrumented\n * @hook Exposed as a hook so consumers reactively know when recovery codes await acknowledgment, updated when the user changes.\n */\nexport const isPendingRecoveryCodesAcknowledgment = (\n  client = getDefaultClient()\n): boolean => {\n  const user = client.user;\n\n  assertDefined(user, 'User not logged in');\n\n  return (\n    user.mfaBackupCodeAcknowledgement === MfaBackupCodeAcknowledgement.Pending\n  );\n};\n","import { getDefaultClient } from '../../../client/defaultClient';\nimport { assertDefined } from '../../../utils/assertDefined';\nimport { isDeviceRegistrationRequired } from '../../deviceRegistration/isDeviceRegistrationRequired';\nimport { isPendingRecoveryCodesAcknowledgment } from '../../mfa/isPendingRecoveryCodesAcknowledgment';\nimport { isUserMissingMfaAuth } from '../../mfa/isUserMissingMfaAuth';\n\n/**\n * Checks if the user has completed all onboarding requirements.\n *\n * This function verifies whether a user has fulfilled all necessary requirements\n * including KYC fields (Know Your Customer information), MFA setup\n * (Multi-Factor Authentication including recovery codes acknowledgment), and\n * device registration.\n *\n * A `false` result means the user still has an outstanding onboarding step, so\n * any feature that requires a fully onboarded (`user:basic`) user should hold\n * off until it returns `true`. Creating or accessing an embedded (WaaS) wallet\n * is one such feature — its backend calls reject a pre-`user:basic` token — but\n * this predicate is general and not specific to embedded wallets.\n *\n * @deprecated Use {@link checkUserScopes} instead. This function conflates\n * Dynamic-controlled requirements (MFA, device registration, required fields)\n * with the concept of \"onboarding complete\", which is app-specific. Replace\n * with `checkUserScopes({ user, scopes: ['user:basic'] })` to check whether\n * Dynamic's requirements are satisfied, and compose your own logic on top for\n * any app-specific onboarding steps.\n *\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns True if onboarding is complete (no pending requirements), false if there are pending requirements.\n * @notInstrumented\n * @hook Exposed as a hook so consumers reactively know when onboarding is complete, updated when the user changes.\n */\nexport const isUserOnboardingComplete = (\n  client = getDefaultClient()\n): boolean => {\n  const user = client.user;\n\n  assertDefined(user, 'User not logged in');\n\n  const hasMissingKycFields = Boolean(user.missingFields?.length);\n  const hasPendingMfaAuth = isUserMissingMfaAuth(client);\n  const hasPendingRecoveryCodes = isPendingRecoveryCodesAcknowledgment(client);\n  const hasPendingDeviceRegistration = isDeviceRegistrationRequired(user);\n\n  const userOnboardingComplete =\n    !hasMissingKycFields &&\n    !hasPendingMfaAuth &&\n    !hasPendingRecoveryCodes &&\n    !hasPendingDeviceRegistration;\n\n  return userOnboardingComplete;\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAwCA,IAAa,sBAAb,cAAyCA,mCAAU;CACjD,AAAS;CAET,YAAY,EAAE,SAA2B;AACvC,QAAM;GACJ;GACA,MAAM;GACN,SAAS;GACT,MAAM;GACN,cACE;GACH,CAAC;AACF,OAAK,SAAS;;;;;;;;;;;;;;;;;;;ACrClB,IAAa,gCAAb,cAAmDC,mCAAU;CAC3D,cAAc;AACZ,QAAM;GACJ,OAAO;GACP,MAAM;GACN,SAAS;GACT,MAAM;GACN,cACE;GACH,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;ACON,IAAa,gCAAb,cAAmDC,mCAAU;CAC3D,YAAY,EAAE,SAA2B;AACvC,QAAM;GACJ;GACA,MAAM;GACN,SAAS;GACT,MAAM;GACN,cACE;GACH,CAAC;;;;;;;;;;;;;;;;ACrBN,MAAa,wBAAwB,WAAgC;CACnE,MAAM,OAAOC,iCAAQ,OAAO;AAC5B,KAAI;AACF,MAAI,CAACC,mDAAqB,OAAO,CAAE;AAEnC,uEAA2B;GACzB,UAAWC,yCAAgB,OAAO,GAAG,WAAW;GAChD,aAAa,KAAK,cAAcC,oDAA2B,QACzD,WACA,GACD;GACF,CAAC;UACK,OAAO;AAGd,OAAK,OAAO,KAAK,kCAAkC,MAAM;;;;;;;;;;;;;;;;;ACrB7D,MAAa,gCAAgC,SAC3C,QAAQ,KAAK,OAAO,SAAS,kBAAkB,CAAC;;;;;;;;;;;;;;;ACElD,MAAa,wCACX,SAASC,2CAAkB,KACf;CACZ,MAAM,OAAO,OAAO;AAEpB,wCAAc,MAAM,qBAAqB;AAEzC,QACE,KAAK,iCAAiCC,wDAA6B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;ACQvE,MAAa,4BACX,SAASC,2CAAkB,KACf;CACZ,MAAM,OAAO,OAAO;AAEpB,wCAAc,MAAM,qBAAqB;CAEzC,MAAM,sBAAsB,QAAQ,KAAK,eAAe,OAAO;CAC/D,MAAM,oBAAoBC,8CAAqB,OAAO;CACtD,MAAM,0BAA0B,qCAAqC,OAAO;CAC5E,MAAM,+BAA+B,6BAA6B,KAAK;AAQvE,QALE,CAAC,uBACD,CAAC,qBACD,CAAC,2BACD,CAAC"}
+{"version":3,"file":"isUserOnboardingComplete-FbjleMQm.cjs","names":["BaseError","BaseError","BaseError","getCore","isDynamicWaasEnabled","isCookieEnabled","DEFAULT_WAAS_BASE_API_URL","getDefaultClient","MfaBackupCodeAcknowledgement","getDefaultClient","isUserMissingMfaAuth"],"sources":["../src/errors/WaasLoadFailedError.ts","../src/errors/WaasOnboardingIncompleteError.ts","../src/errors/WaasRbacStaleRetryUnsafeError.ts","../src/modules/waas/preconnectWaasIframe/preconnectWaasIframe.ts","../src/modules/deviceRegistration/isDeviceRegistrationRequired/isDeviceRegistrationRequired.ts","../src/modules/mfa/isPendingRecoveryCodesAcknowledgment/isPendingRecoveryCodesAcknowledgment.ts","../src/modules/user/isUserOnboardingComplete/isUserOnboardingComplete.ts"],"sourcesContent":["import { BaseError } from './base';\n\n/**\n * Why the embedded wallet load failed. Currently only retry exhaustion is\n * reported; the union exists so new reasons can be added without a breaking\n * change to consumer `instanceof` handling.\n *\n * @example\n * ```ts\n * const reason: WaasLoadFailedErrorReason = 'load_attempts_exhausted';\n * ```\n * @see WaasLoadFailedError\n * @see signMessage\n */\nexport type WaasLoadFailedErrorReason = 'load_attempts_exhausted';\n\n/**\n * Thrown when the embedded (WaaS) wallet's secure container failed to load\n * after exhausting all of its internal retry attempts.\n *\n * This failure is transient: the next wallet operation triggers a fresh load\n * cycle, so hosts can catch this error and re-attempt the operation at their\n * own cadence (for example, when connectivity returns or the app is\n * foregrounded). Other load failures (for example, a CSP block) are not\n * wrapped by this error and their shape is not guaranteed.\n *\n * @example\n * ```ts\n * try {\n *   await signMessage({ message, walletAccount });\n * } catch (error) {\n *   if (error instanceof WaasLoadFailedError) {\n *     // transient — retry the operation at your own cadence\n *     await signMessage({ message, walletAccount });\n *   }\n * }\n * ```\n * @see WaasLoadFailedErrorReason\n * @see signMessage\n */\nexport class WaasLoadFailedError extends BaseError {\n  readonly reason: WaasLoadFailedErrorReason;\n\n  constructor({ cause }: { cause: Error }) {\n    super({\n      cause,\n      code: 'waas_load_failed',\n      docsUrl: null,\n      name: 'WaasLoadFailedError',\n      shortMessage:\n        'The embedded wallet failed to load after exhausting its retry attempts. Retrying the wallet operation triggers a fresh load.',\n    });\n    this.reason = 'load_attempts_exhausted';\n  }\n}\n","import { BaseError } from './base';\n\n/**\n * Thrown when the embedded (WaaS) wallet client is requested before the user\n * has completed onboarding — i.e. the JWT has not upgraded to `user:basic`\n * because MFA, KYC, recovery-codes acknowledgment, or device registration is\n * still pending.\n *\n * The WaaS iframe's init-time room-cache pre-warm fires `createRooms` using the\n * token captured at client construction (before any per-operation token\n * resync). Building the client during this window lets that pre-warm fire with\n * a pre-`user:basic` token, get a 401, and the iframe's unauthorized handler\n * force-logs-out the user. Throwing here surfaces a clear, recoverable reason\n * instead — wait for onboarding to complete and retry.\n */\nexport class WaasOnboardingIncompleteError extends BaseError {\n  constructor() {\n    super({\n      cause: null,\n      code: 'waas_onboarding_incomplete',\n      docsUrl: null,\n      name: 'WaasOnboardingIncompleteError',\n      shortMessage:\n        'Cannot create or access the embedded wallet until onboarding is complete (pending MFA, KYC, recovery-codes acknowledgment, or device registration).',\n    });\n  }\n}\n","import { BaseError } from './base';\n\n/**\n * Thrown when a WaaS ceremony operation (sign, export, reshare, create\n * wallet) receives a 403 `rbac_stale` response after the attempt has already\n * spent its one-time authorization — either the legacy MFA token or a\n * single-use elevated access token.\n *\n * The SDK cannot safely retry in that case: the restarted attempt would find\n * the approval already consumed and fail deeper in the stack with an\n * unrelated \"no MFA token\" error, hiding the permission change that actually\n * caused the failure. Surfacing this error instead tells the host exactly what\n * happened. Recover by re-running the step-up/MFA flow and retrying the\n * operation; the business-account role change has already taken effect, so the\n * retry is evaluated against the caller's current permissions.\n *\n * @example\n * ```ts\n * try {\n *   await signMessage({ message, walletAccount });\n * } catch (error) {\n *   if (error instanceof WaasRbacStaleRetryUnsafeError) {\n *     // The one-time approval was spent; re-verify before trying again.\n *     await promptStepUp();\n *     await signMessage({ message, walletAccount });\n *   }\n * }\n * ```\n * @see WaasLoadFailedError\n * @see signMessage\n */\nexport class WaasRbacStaleRetryUnsafeError extends BaseError {\n  constructor({ cause }: { cause: Error }) {\n    super({\n      cause,\n      code: 'waas_rbac_stale_retry_unsafe',\n      docsUrl: null,\n      name: 'WaasRbacStaleRetryUnsafeError',\n      shortMessage:\n        'The business account role change could not be retried automatically because a one-time authorization was already consumed. Re-authenticate and retry the operation.',\n    });\n  }\n}\n","import type { AuthMode } from '@dynamic-labs-wallet/browser-wallet-client';\nimport { preconnectWaasIframe as preconnectWaasIframeOrigin } from '@dynamic-labs-wallet/browser-wallet-client';\n\nimport { getCore } from '../../../client/core/getCore';\nimport type { DynamicClient } from '../../../client/types';\nimport { isCookieEnabled } from '../../projectSettings/isCookieEnabled';\nimport { DEFAULT_WAAS_BASE_API_URL } from '../constants';\nimport { isDynamicWaasEnabled } from '../isDynamicWaasEnabled';\n\n/**\n * Warms the browser's connection (DNS + TCP + TLS) to the embedded-wallet\n * iframe origin so the iframe mounted after authentication completes loads on\n * a hot connection. Called when an auth flow starts (OTP send/verify, social\n * callback). Safe to call repeatedly; no-op on React Native / SSR and when\n * Dynamic WaaS is not enabled.\n *\n * @param client - The Dynamic client instance.\n * @notInstrumented\n */\nexport const preconnectWaasIframe = (client: DynamicClient): void => {\n  const core = getCore(client);\n  try {\n    if (!isDynamicWaasEnabled(client)) return;\n\n    preconnectWaasIframeOrigin({\n      authMode: (isCookieEnabled(client) ? 'cookie' : 'header') as AuthMode,\n      baseApiUrl: (core.apiBaseUrl || DEFAULT_WAAS_BASE_API_URL).replace(\n        '/api/v0',\n        ''\n      ),\n    });\n  } catch (error) {\n    // Best-effort: never break the auth flow (also swallows the assertion\n    // from isDynamicWaasEnabled when project settings are not loaded yet).\n    core.logger.warn('[preconnectWaasIframe] skipped', error);\n  }\n};\n","import type { User } from '../../user/user.types';\n\n/**\n * Checks if device registration is required for the given user.\n *\n * This function determines if the user has the deviceRegistration\n * scope, indicating that device registration is required.\n *\n * @param user - The user to check.\n * @returns True if device registration is required, false otherwise.\n * @notInstrumented\n * @hook Exposed as a hook so consumers reactively know when this device must be registered, updated when the user changes.\n */\nexport const isDeviceRegistrationRequired = (user: User): boolean =>\n  Boolean(user.scope?.includes('device:register'));\n","import { MfaBackupCodeAcknowledgement } from '@dynamic-labs/sdk-api-core';\n\nimport { getDefaultClient } from '../../../client/defaultClient';\nimport { assertDefined } from '../../../utils/assertDefined';\n\n/**\n * Checks if the user is still pending acknowledgment of their MFA recovery codes.\n *\n * This function determines whether the user has been presented with recovery\n * codes that they have not yet acknowledged as saved or backed up.\n *\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns True if recovery codes are pending acknowledgment, false otherwise.\n * @notInstrumented\n * @hook Exposed as a hook so consumers reactively know when recovery codes await acknowledgment, updated when the user changes.\n */\nexport const isPendingRecoveryCodesAcknowledgment = (\n  client = getDefaultClient()\n): boolean => {\n  const user = client.user;\n\n  assertDefined(user, 'User not logged in');\n\n  return (\n    user.mfaBackupCodeAcknowledgement === MfaBackupCodeAcknowledgement.Pending\n  );\n};\n","import { getDefaultClient } from '../../../client/defaultClient';\nimport { assertDefined } from '../../../utils/assertDefined';\nimport { isDeviceRegistrationRequired } from '../../deviceRegistration/isDeviceRegistrationRequired';\nimport { isPendingRecoveryCodesAcknowledgment } from '../../mfa/isPendingRecoveryCodesAcknowledgment';\nimport { isUserMissingMfaAuth } from '../../mfa/isUserMissingMfaAuth';\n\n/**\n * Checks if the user has completed all onboarding requirements.\n *\n * This function verifies whether a user has fulfilled all necessary requirements\n * including KYC fields (Know Your Customer information), MFA setup\n * (Multi-Factor Authentication including recovery codes acknowledgment), and\n * device registration.\n *\n * A `false` result means the user still has an outstanding onboarding step, so\n * any feature that requires a fully onboarded (`user:basic`) user should hold\n * off until it returns `true`. Creating or accessing an embedded (WaaS) wallet\n * is one such feature — its backend calls reject a pre-`user:basic` token — but\n * this predicate is general and not specific to embedded wallets.\n *\n * @deprecated Use {@link checkUserScopes} instead. This function conflates\n * Dynamic-controlled requirements (MFA, device registration, required fields)\n * with the concept of \"onboarding complete\", which is app-specific. Replace\n * with `checkUserScopes({ user, scopes: ['user:basic'] })` to check whether\n * Dynamic's requirements are satisfied, and compose your own logic on top for\n * any app-specific onboarding steps.\n *\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns True if onboarding is complete (no pending requirements), false if there are pending requirements.\n * @notInstrumented\n * @hook Exposed as a hook so consumers reactively know when onboarding is complete, updated when the user changes.\n */\nexport const isUserOnboardingComplete = (\n  client = getDefaultClient()\n): boolean => {\n  const user = client.user;\n\n  assertDefined(user, 'User not logged in');\n\n  const hasMissingKycFields = Boolean(user.missingFields?.length);\n  const hasPendingMfaAuth = isUserMissingMfaAuth(client);\n  const hasPendingRecoveryCodes = isPendingRecoveryCodesAcknowledgment(client);\n  const hasPendingDeviceRegistration = isDeviceRegistrationRequired(user);\n\n  const userOnboardingComplete =\n    !hasMissingKycFields &&\n    !hasPendingMfaAuth &&\n    !hasPendingRecoveryCodes &&\n    !hasPendingDeviceRegistration;\n\n  return userOnboardingComplete;\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAwCA,IAAa,sBAAb,cAAyCA,mCAAU;CACjD,AAAS;CAET,YAAY,EAAE,SAA2B;AACvC,QAAM;GACJ;GACA,MAAM;GACN,SAAS;GACT,MAAM;GACN,cACE;GACH,CAAC;AACF,OAAK,SAAS;;;;;;;;;;;;;;;;;;;ACrClB,IAAa,gCAAb,cAAmDC,mCAAU;CAC3D,cAAc;AACZ,QAAM;GACJ,OAAO;GACP,MAAM;GACN,SAAS;GACT,MAAM;GACN,cACE;GACH,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;ACON,IAAa,gCAAb,cAAmDC,mCAAU;CAC3D,YAAY,EAAE,SAA2B;AACvC,QAAM;GACJ;GACA,MAAM;GACN,SAAS;GACT,MAAM;GACN,cACE;GACH,CAAC;;;;;;;;;;;;;;;;ACrBN,MAAa,wBAAwB,WAAgC;CACnE,MAAM,OAAOC,iCAAQ,OAAO;AAC5B,KAAI;AACF,MAAI,CAACC,mDAAqB,OAAO,CAAE;AAEnC,uEAA2B;GACzB,UAAWC,yCAAgB,OAAO,GAAG,WAAW;GAChD,aAAa,KAAK,cAAcC,oDAA2B,QACzD,WACA,GACD;GACF,CAAC;UACK,OAAO;AAGd,OAAK,OAAO,KAAK,kCAAkC,MAAM;;;;;;;;;;;;;;;;;ACrB7D,MAAa,gCAAgC,SAC3C,QAAQ,KAAK,OAAO,SAAS,kBAAkB,CAAC;;;;;;;;;;;;;;;ACElD,MAAa,wCACX,SAASC,2CAAkB,KACf;CACZ,MAAM,OAAO,OAAO;AAEpB,wCAAc,MAAM,qBAAqB;AAEzC,QACE,KAAK,iCAAiCC,wDAA6B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;ACQvE,MAAa,4BACX,SAASC,2CAAkB,KACf;CACZ,MAAM,OAAO,OAAO;AAEpB,wCAAc,MAAM,qBAAqB;CAEzC,MAAM,sBAAsB,QAAQ,KAAK,eAAe,OAAO;CAC/D,MAAM,oBAAoBC,8CAAqB,OAAO;CACtD,MAAM,0BAA0B,qCAAqC,OAAO;CAC5E,MAAM,+BAA+B,6BAA6B,KAAK;AAQvE,QALE,CAAC,uBACD,CAAC,qBACD,CAAC,2BACD,CAAC"}

package/dist/{logoutWithReason-CFjm8dbR.cjs → logoutWithReason-BKwWBsCT.cjs}

@@ -31,7 +31,7 @@ zod_mini = __toESM(zod_mini);
 
 //#region package.json
 var name = "@dynamic-labs-sdk/client";
-var version = "1.33.1";
+var version = "1.33.3";
 
 //#endregion
 //#region src/modules/auth/consts.ts
@@ -289,7 +289,7 @@ const getSessionKeys = (client) => {
 
 //#endregion
 //#region src/generated/dependencyCatalog.ts
-const dependencyCatalog = { "@dynamic-labs/sdk-api-core": "0.38.0" };
+const dependencyCatalog = { "@dynamic-labs/sdk-api-core": "0.40.0" };
 
 //#endregion
 //#region src/constants.ts
@@ -2263,60 +2263,66 @@ const retryOnFail = async ({ delay = 0, fn, maxRetries }) => {
 };
 
 //#endregion
-//#region src/modules/auth/isSignedIn/isSignedIn.ts
-/**
-* Checks if the user is currently signed in to the Dynamic client.
-*
-* The client is considered to be in a signed in state if a user has
-* authenticated or if the client has at least one wallet connected.
-*
-* @deprecated What counts as "signed in" is your app's business logic, not the
-* SDK's. This helper bakes in one opinion (a user OR any connected wallet),
-* which rarely matches every app and forces a dependency on us for every
-* variation. Compose your own check from the underlying primitives instead —
-* e.g. `Boolean(client.user) || isAnyWalletAccountConnected(client)` — and
-* layer in whatever your app requires (device registration, completed
-* onboarding, satisfied MFA, a required embedded wallet, …). See the
-* "Check if signed in" guide:
-* https://www.dynamic.xyz/docs/javascript/user-session-management
-*
-* @example
-* ```ts
-* if (isSignedIn()) {
-*   console.log('User is authenticated or has a wallet connected');
-* }
-* ```
-*
-* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
-* @returns True if the user is signed in, false otherwise.
-* @see logout
-* @see isAnyWalletAccountConnected
-* @notInstrumented
-*/
-const isSignedIn = (client = getDefaultClient()) => Boolean(client.user || getWalletAccounts(client).length > 0);
+//#region src/modules/wallets/unverifiedWalletAccounts/schema.ts
+const unverifiedWalletAccountSchema = zod_mini.object({
+	address: zod_mini.string(),
+	addressesWithTypes: zod_mini.optional(zod_mini.array(zod_mini.object({
+		address: zod_mini.string(),
+		publicKey: zod_mini.optional(zod_mini.string()),
+		type: zod_mini.custom((val) => typeof val === "string")
+	}))),
+	chain: zod_mini.custom((val) => typeof val === "string"),
+	hardwareWalletVendor: zod_mini.optional(zod_mini.custom((val) => typeof val === "string")),
+	id: zod_mini.string(),
+	lastSelectedAt: zod_mini.nullable(zod_mini.date()),
+	walletProviderKey: zod_mini.string()
+});
 
 //#endregion
-//#region src/modules/projectSettings/fetchProjectSettings/projectSettingsExpirationScheme.ts
-/**
-* The schema to track the expiration time of the project settings.
-*/
-const projectSettingsExpirationStorageKeySchema = createStorageKeySchema({
-	key: "projectSettingsExpiration",
-	schema: zod_mini.number()
+//#region src/modules/wallets/walletProvider/walletProviderKeyMap/schema.ts
+const walletProviderKeyMapSchema = zod_mini.record(zod_mini.string(), zod_mini.string());
+
+//#endregion
+//#region src/modules/storageSync/schema.ts
+const stateStorageKeySchema = createStorageKeySchema({
+	key: "state",
+	schema: zod_mini.object({
+		apiVersion: zod_mini.string(),
+		projectSettings: zod_mini.custom(),
+		unverifiedWalletAccounts: zod_mini.array(unverifiedWalletAccountSchema),
+		user: zod_mini.custom(),
+		walletProviderKeyMap: walletProviderKeyMapSchema
+	})
+});
+const sessionStorageKeySchema = createStorageKeySchema({
+	config: { storageTier: "secure" },
+	key: "session",
+	schema: zod_mini.object({
+		captchaToken: zod_mini.nullable(zod_mini.string()),
+		elevatedAccessTokens: zod_mini.array(zod_mini.object({
+			expiresAt: zod_mini.number(),
+			scopes: zod_mini.array(zod_mini.string()),
+			singleUse: zod_mini.nullable(zod_mini.boolean()),
+			token: zod_mini.string()
+		})),
+		legacyToken: zod_mini.nullable(zod_mini.string()),
+		mfaToken: zod_mini.nullable(zod_mini.string()),
+		sessionExpiration: zod_mini.number(),
+		sessionKeys: zod_mini.nullable(zod_mini.string()),
+		token: zod_mini.nullable(zod_mini.string())
+	})
 });
 
 //#endregion
 //#region src/modules/projectSettings/fetchProjectSettings/fetchProjectSettings.ts
 /**
-* Expiration time of the project settings in milliseconds.
-*/
-const PROJECT_SETTINGS_EXPIRATION_TIME = 1e3 * 60 * 5;
-/**
 * Fetches and updates the project settings from the API.
 *
 * This function retrieves the latest project configuration settings
 * from Dynamic's servers, including authentication options, enabled chains,
-* and security configurations. The settings are cached for performance.
+* and security configurations. It always performs a live fetch. If the API
+* call fails, it falls back to the last known-good settings from storage,
+* provided they were saved by a matching SDK API version.
 *
 * @example
 * ```ts
@@ -2326,6 +2332,7 @@ const PROJECT_SETTINGS_EXPIRATION_TIME = 1e3 * 60 * 5;
 *
 * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
 * @returns A promise that resolves to the updated project settings.
+* @throws {Error} Rethrows the original fetch error when no matching-version cached settings exist.
 * @see createDynamicClient
 * @see initializeClient
 * @notInstrumented
@@ -2333,8 +2340,6 @@ const PROJECT_SETTINGS_EXPIRATION_TIME = 1e3 * 60 * 5;
 */
 const fetchProjectSettings = async (client = getDefaultClient()) => {
 	const core = getCore(client);
-	const currentExpiration = await core.storage.getItem(projectSettingsExpirationStorageKeySchema);
-	if (Boolean(client.projectSettings) && !(currentExpiration && currentExpiration < Date.now()) && isSignedIn(client)) return client.projectSettings;
 	const apiClient = createApiClient({}, client);
 	core.logger.debug("[fetchProjectSettings] Fetching project settings...");
 	const doFetch = async () => apiClient.getEnvironmentSettings({
@@ -2344,9 +2349,16 @@ const fetchProjectSettings = async (client = getDefaultClient()) => {
 	const projectSettings = await retryOnFail({
 		fn: doFetch,
 		maxRetries: 2
+	}).catch(async (error) => {
+		const cachedState = await core.storage.getItem(stateStorageKeySchema).catch(() => null);
+		if (cachedState?.apiVersion === SDK_API_CORE_VERSION && cachedState.projectSettings) {
+			core.logger.error("[fetchProjectSettings] Failed to fetch project settings, falling back to cached settings", error);
+			return cachedState.projectSettings;
+		}
+		core.logger.error("[fetchProjectSettings] Failed to fetch project settings and no cached settings are available", error);
+		throw error;
 	});
 	core.state.set({ projectSettings: projectSettings ?? null });
-	await core.storage.setItem(projectSettingsExpirationStorageKeySchema, Date.now() + PROJECT_SETTINGS_EXPIRATION_TIME);
 	return projectSettings;
 };
 
@@ -2854,12 +2866,6 @@ Object.defineProperty(exports, 'isCookieEnabled', {
     return isCookieEnabled;
   }
 });
-Object.defineProperty(exports, 'isSignedIn', {
-  enumerable: true,
-  get: function () {
-    return isSignedIn;
-  }
-});
 Object.defineProperty(exports, 'isUserMissingMfaAuth', {
   enumerable: true,
   get: function () {
@@ -2944,6 +2950,12 @@ Object.defineProperty(exports, 'scrubParameters', {
     return scrubParameters;
   }
 });
+Object.defineProperty(exports, 'sessionStorageKeySchema', {
+  enumerable: true,
+  get: function () {
+    return sessionStorageKeySchema;
+  }
+});
 Object.defineProperty(exports, 'setDefaultClient', {
   enumerable: true,
   get: function () {
@@ -2956,6 +2968,12 @@ Object.defineProperty(exports, 'splitWalletProviderKey', {
     return splitWalletProviderKey;
   }
 });
+Object.defineProperty(exports, 'stateStorageKeySchema', {
+  enumerable: true,
+  get: function () {
+    return stateStorageKeySchema;
+  }
+});
 Object.defineProperty(exports, 'updateAuthFromVerifyResponse', {
   enumerable: true,
   get: function () {
@@ -2980,4 +2998,4 @@ Object.defineProperty(exports, 'version', {
     return version;
   }
 });
-//# sourceMappingURL=logoutWithReason-CFjm8dbR.cjs.map
+//# sourceMappingURL=logoutWithReason-BKwWBsCT.cjs.map