import { _t as getCore, at as isCookieEnabled, gt as BaseError, l as DEFAULT_WAAS_BASE_API_URL, ot as assertDefined, p as isUserMissingMfaAuth, pt as getDefaultClient } from "./updateAuthFromVerifyResponse-D1w-Aw9P.native.esm.js";
import { t as isDynamicWaasEnabled } from "./isDynamicWaasEnabled-BXe0VyI4.native.esm.js";
import { MfaBackupCodeAcknowledgement } from "@dynamic-labs/sdk-api-core";
import { preconnectWaasIframe } from "@dynamic-labs-wallet/browser-wallet-client";

//#region src/errors/WaasOnboardingIncompleteError.ts
/**
* Thrown when the embedded (WaaS) wallet client is requested before the user
* has completed onboarding — i.e. the JWT has not upgraded to `user:basic`
* because MFA, KYC, recovery-codes acknowledgment, or device registration is
* still pending.
*
* The WaaS iframe's init-time room-cache pre-warm fires `createRooms` using the
* token captured at client construction (before any per-operation token
* resync). Building the client during this window lets that pre-warm fire with
* a pre-`user:basic` token, get a 401, and the iframe's unauthorized handler
* force-logs-out the user. Throwing here surfaces a clear, recoverable reason
* instead — wait for onboarding to complete and retry.
*/
var WaasOnboardingIncompleteError = class extends BaseError {
	constructor() {
		super({
			cause: null,
			code: "waas_onboarding_incomplete",
			docsUrl: null,
			name: "WaasOnboardingIncompleteError",
			shortMessage: "Cannot create or access the embedded wallet until onboarding is complete (pending MFA, KYC, recovery-codes acknowledgment, or device registration)."
		});
	}
};

//#endregion
//#region src/modules/waas/preconnectWaasIframe/preconnectWaasIframe.ts
/**
* Warms the browser's connection (DNS + TCP + TLS) to the embedded-wallet
* iframe origin so the iframe mounted after authentication completes loads on
* a hot connection. Called when an auth flow starts (OTP send/verify, social
* callback). Safe to call repeatedly; no-op on React Native / SSR and when
* Dynamic WaaS is not enabled.
*
* @param client - The Dynamic client instance.
* @notInstrumented
*/
const preconnectWaasIframe$1 = (client) => {
	const core = getCore(client);
	try {
		if (!isDynamicWaasEnabled(client)) return;
		preconnectWaasIframe({
			authMode: isCookieEnabled(client) ? "cookie" : "header",
			baseApiUrl: (core.apiBaseUrl || DEFAULT_WAAS_BASE_API_URL).replace("/api/v0", "")
		});
	} catch (error) {
		core.logger.warn("[preconnectWaasIframe] skipped", error);
	}
};

//#endregion
//#region src/modules/deviceRegistration/isDeviceRegistrationRequired/isDeviceRegistrationRequired.ts
/**
* Checks if device registration is required for the given user.
*
* This function determines if the user has the deviceRegistration
* scope, indicating that device registration is required.
*
* @param user - The user to check.
* @returns True if device registration is required, false otherwise.
* @notInstrumented
*/
const isDeviceRegistrationRequired = (user) => Boolean(user.scope?.includes("device:register"));

//#endregion
//#region src/modules/mfa/isPendingRecoveryCodesAcknowledgment/isPendingRecoveryCodesAcknowledgment.ts
/**
* Checks if the user is still pending acknowledgment of their MFA recovery codes.
*
* This function determines whether the user has been presented with recovery
* codes that they have not yet acknowledged as saved or backed up.
*
* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
* @returns True if recovery codes are pending acknowledgment, false otherwise.
* @notInstrumented
*/
const isPendingRecoveryCodesAcknowledgment = (client = getDefaultClient()) => {
	const user = client.user;
	assertDefined(user, "User not logged in");
	return user.mfaBackupCodeAcknowledgement === MfaBackupCodeAcknowledgement.Pending;
};

//#endregion
//#region src/modules/user/isUserOnboardingComplete/isUserOnboardingComplete.ts
/**
* Checks if the user has completed all onboarding requirements.
*
* This function verifies whether a user has fulfilled all necessary requirements
* including KYC fields (Know Your Customer information), MFA setup
* (Multi-Factor Authentication including recovery codes acknowledgment), and
* device registration.
*
* A `false` result means the user still has an outstanding onboarding step, so
* any feature that requires a fully onboarded (`user:basic`) user should hold
* off until it returns `true`. Creating or accessing an embedded (WaaS) wallet
* is one such feature — its backend calls reject a pre-`user:basic` token — but
* this predicate is general and not specific to embedded wallets.
*
* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
* @returns True if onboarding is complete (no pending requirements), false if there are pending requirements.
* @notInstrumented
*/
const isUserOnboardingComplete = (client = getDefaultClient()) => {
	const user = client.user;
	assertDefined(user, "User not logged in");
	const hasMissingKycFields = Boolean(user.missingFields?.length);
	const hasPendingMfaAuth = isUserMissingMfaAuth(client);
	const hasPendingRecoveryCodes = isPendingRecoveryCodesAcknowledgment(client);
	const hasPendingDeviceRegistration = isDeviceRegistrationRequired(user);
	return !hasMissingKycFields && !hasPendingMfaAuth && !hasPendingRecoveryCodes && !hasPendingDeviceRegistration;
};

//#endregion
export { WaasOnboardingIncompleteError as a, preconnectWaasIframe$1 as i, isPendingRecoveryCodesAcknowledgment as n, isDeviceRegistrationRequired as r, isUserOnboardingComplete as t };
//# sourceMappingURL=isUserOnboardingComplete-Cr-YTpcU.native.esm.js.map