@coinbase/cdp-api-client 0.0.116 → 0.0.118

package/dist/esm/index3.js

@@ -1,2 +1,2 @@
-import { __require as r } from "./index17.js";
+import { __require as r } from "./index12.js";
 r();

package/dist/esm/index4.js

@@ -1,4 +1,4 @@
-const o = "0.0.116";
+const o = "0.0.118";
 export {
   o as VERSION
 };

package/dist/esm/index6.js

@@ -1,94 +1,94 @@
-import { Analytics as o } from "./index2.js";
+import { Analytics as i } from "./index2.js";
 import "./index3.js";
-import c from "axios";
+import p from "axios";
 import { ERROR_DOCS_PAGE_URL as h } from "./index9.js";
-import { UnknownApiError as R, HttpErrorType as u, isOpenAPIError as A, APIError as d, UnknownError as k } from "./index7.js";
-const w = () => typeof window < "u" && typeof document < "u";
-let a = c.create({
+import { UnknownApiError as g, HttpErrorType as d, isOpenAPIError as y, APIError as l, UnknownError as T } from "./index7.js";
+const v = () => typeof window < "u" && typeof document < "u";
+let n = p.create({
   baseURL: "https://api.cdp.coinbase.com/platform"
-}), i = null;
-const O = (t) => {
-  if (a = c.create({
+}), c = null;
+const N = (t) => {
+  if (n = p.create({
     baseURL: t.basePath || "https://api.cdp.coinbase.com/platform",
     // Only enable cookies in browser environments where they're supported
-    withCredentials: w()
-  }), a.interceptors.request.use(async (r) => {
-    const e = U(r), s = f(r);
-    if (!i || v(s.pathname) || _(s.pathname) && !await i.isSignedIn() || !I(s.pathname))
+    withCredentials: v()
+  }), n.interceptors.request.use(async (r) => {
+    const e = C(r), s = w(r);
+    if (!c || _(s.pathname) || A(s.pathname) && !await c.isSignedIn() || !O(s.pathname))
       return r;
-    const n = await i.getXWalletAuth({
+    const a = await c.getXWalletAuth({
       requestMethod: e,
       requestHost: s.host,
       requestPath: s.pathname,
       requestData: r.data
     });
-    return n && (r.headers["X-Wallet-Auth"] = n), r;
-  }), a.interceptors.request.use(async (r) => {
-    const e = f(r);
-    if (!i || v(e.pathname) || _(e.pathname) && !await i.isSignedIn())
+    return a && (r.headers["X-Wallet-Auth"] = a), r;
+  }), n.interceptors.request.use(async (r) => {
+    const e = w(r);
+    if (!c || _(e.pathname) || A(e.pathname) && !await c.isSignedIn())
       return r;
-    const s = await i.getToken();
+    const s = await c.getToken();
     return s && s !== "" && (r.headers.Authorization = `Bearer ${s}`), r;
-  }), !w()) {
+  }), !v()) {
     const r = t.platform ? `CDP/reactnative/${t.platform}` : "CDP/reactnative";
-    a.interceptors.request.use(async (e) => {
+    n.interceptors.request.use(async (e) => {
       let s = e.headers["User-Agent"];
       return s = s ? `${s} ${r}` : r, e.headers["User-Agent"] = s, e;
     });
   }
-  t.refreshTokenStorage && P(t.refreshTokenStorage), t.appAttestation && y(t.appAttestation, t.platform), t.debugging && (a.interceptors.request.use((r) => (console.log("Request:", r), r)), a.interceptors.response.use((r) => (console.log("Response:", r), r)));
-}, D = (t) => {
-  i = t;
-}, y = (t, r) => {
-  a.interceptors.request.use(async (e) => {
-    const s = f(e);
-    if (!q(s.pathname) || !t.isEnabled())
+  t.refreshTokenStorage && U(t.refreshTokenStorage, t.retryTokenReads ?? !1), t.appAttestation && P(t.appAttestation, t.platform), t.debugging && (n.interceptors.request.use((r) => (console.log("Request:", r), r)), n.interceptors.response.use((r) => (console.log("Response:", r), r)));
+}, z = (t) => {
+  c = t;
+}, P = (t, r) => {
+  n.interceptors.request.use(async (e) => {
+    const s = w(e);
+    if (!x(s.pathname) || !t.isEnabled())
       return e;
     try {
       if (r === "ios") {
-        const n = s.pathname.match(/\/projects\/([^/]+)\//);
-        if (!n || !n[1])
+        const a = s.pathname.match(/\/projects\/([^/]+)\//);
+        if (!a || !a[1])
           return e;
-        const g = `/v2/embedded-wallet-api/projects/${n[1]}/attestation/challenge`, l = (await a.post(g)).data.challenge;
-        if (!l)
+        const u = `/v2/embedded-wallet-api/projects/${a[1]}/attestation/challenge`, m = (await n.post(u)).data.challenge;
+        if (!m)
           return console.warn("Failed to fetch assertion challenge"), e;
-        const p = await t.generateAssertion(l);
-        if (!p)
+        const f = await t.generateAssertion(m);
+        if (!f)
           return e;
-        e.headers["X-App-Attestation-Assertion"] = p.assertion, e.headers["X-App-Attestation-Key-ID"] = p.keyId, e.headers["X-App-Attestation-Challenge"] = l;
+        e.headers["X-App-Attestation-Assertion"] = f.assertion, e.headers["X-App-Attestation-Key-ID"] = f.keyId, e.headers["X-App-Attestation-Challenge"] = m;
       } else {
-        const n = await t.generateAssertion(JSON.stringify(e.data));
-        if (!n)
+        const a = await t.generateAssertion(JSON.stringify(e.data));
+        if (!a)
           return e;
-        e.headers["X-Integrity-Token"] = n.assertion, e.headers["X-Package-Name"] = t.appIdentifier;
+        e.headers["X-Integrity-Token"] = a.assertion, e.headers["X-Package-Name"] = t.appIdentifier;
       }
       return e;
-    } catch (n) {
+    } catch (a) {
       throw new Error(
-        `App attestation required but assertion generation failed: ${n instanceof Error ? n.message : String(n)}`
+        `App attestation required but assertion generation failed: ${a instanceof Error ? a.message : String(a)}`
       );
     }
   });
-}, E = (t, r) => ({
+}, S = (t, r) => ({
   ...t,
   headers: {
     ...t.headers || {},
     "X-Idempotency-Key": r
   }
-}), z = async (t, r) => {
-  $(t), r && r !== "" && (t = E(t, r));
+}), H = async (t, r) => {
+  j(t), r && r !== "" && (t = S(t, r));
   try {
-    return (await a(t)).data;
+    return (await n(t)).data;
   } catch (e) {
-    if (c.isAxiosError(e) && !e.response)
-      throw new R(
-        u.unknown,
+    if (p.isAxiosError(e) && !e.response)
+      throw new g(
+        d.unknown,
         e.cause instanceof Error ? e.cause.message : e.message,
         e.cause
       );
-    if (c.isAxiosError(e) && e.response) {
-      if (A(e.response.data))
-        throw new d(
+    if (p.isAxiosError(e) && e.response) {
+      if (y(e.response.data))
+        throw new l(
           e.response.status,
           e.response.data.errorType,
           e.response.data.errorMessage,
@@ -100,54 +100,54 @@ const O = (t) => {
         const s = e.response.status;
         switch (s) {
           case 401:
-            throw new d(
+            throw new l(
               s,
-              u.unauthorized,
+              d.unauthorized,
               "Unauthorized.",
               void 0,
               `${h}#unauthorized`,
               e.cause
             );
           case 404:
-            throw new d(
+            throw new l(
               s,
-              u.not_found,
+              d.not_found,
               "API not found.",
               void 0,
               `${h}#not_found`,
               e.cause
             );
           case 502:
-            throw new d(
+            throw new l(
               s,
-              u.bad_gateway,
+              d.bad_gateway,
               "Bad gateway.",
               void 0,
               `${h}`,
               e.cause
             );
           case 503:
-            throw new d(
+            throw new l(
               s,
-              u.service_unavailable,
+              d.service_unavailable,
               "Service unavailable. Please try again later.",
               void 0,
               `${h}`,
               e.cause
             );
           default: {
-            let n = "";
+            let a = "";
             if (e.response.data)
               try {
-                n = JSON.stringify(e.response.data);
+                a = JSON.stringify(e.response.data);
               } catch {
-                n = String(e.response.data);
+                a = String(e.response.data);
               }
-            const m = n ? `An unexpected error occurred: ${n}` : "An unexpected error occurred.";
-            throw new d(
+            const o = a ? `An unexpected error occurred: ${a}` : "An unexpected error occurred.";
+            throw new l(
               s,
-              u.unexpected_error,
-              m,
+              d.unexpected_error,
+              o,
               void 0,
               `${h}`,
               e.cause
@@ -156,99 +156,124 @@ const O = (t) => {
         }
       }
     }
-    throw new k("Something went wrong.", e instanceof Error ? e : void 0);
+    throw new T("Something went wrong.", e instanceof Error ? e : void 0);
   }
-}, P = (t) => {
-  a.interceptors.response.use(
-    async (r) => {
+}, k = 4, b = [25, 50, 100], E = async (t) => {
+  if (t.getRefreshTokenWithOutcome) {
+    const { token: r, outcome: e, errorMessage: s } = await t.getRefreshTokenWithOutcome();
+    return { token: r, outcome: e, errorMessage: s };
+  }
+  return { token: await t.getRefreshToken() };
+}, $ = async (t) => {
+  let r = null, e, s;
+  for (let a = 0; a < k; a++) {
+    const o = await E(t);
+    if (r = o.token, e = o.outcome, s = o.errorMessage, r)
+      return {
+        token: r,
+        attempt: a,
+        outcome: e,
+        errorMessage: s
+      };
+    const u = b[a];
+    u !== void 0 && await new Promise((R) => setTimeout(R, u));
+  }
+  return {
+    token: r,
+    attempt: k - 1,
+    outcome: e,
+    errorMessage: s
+  };
+}, U = (t, r) => {
+  n.interceptors.response.use(
+    async (e) => {
       try {
-        if (b(r)) {
-          o.sendSessionRefreshEvent({
+        if (q(e)) {
+          i.sendSessionRefreshEvent({
             name: "refresh_token_response"
           });
-          const e = r.data?.refreshToken;
-          e && (o.sendSessionRefreshEvent({
+          const s = e.data?.refreshToken;
+          s && (i.sendSessionRefreshEvent({
             name: "refresh_token_received"
           }), await Promise.race([
-            t.setRefreshToken(e),
+            t.setRefreshToken(s),
             new Promise(
-              (s, n) => setTimeout(() => n(new Error("setRefreshToken timed out after 5000ms")), 5e3)
+              (a, o) => setTimeout(() => o(new Error("setRefreshToken timed out after 5000ms")), 5e3)
             )
-          ]), o.sendSessionRefreshEvent({
+          ]), i.sendSessionRefreshEvent({
             name: "refresh_token_stored"
           }));
         }
-      } catch (e) {
-        const s = e instanceof Error ? e.message : String(e);
-        o.sendSessionRefreshEvent({
+      } catch (s) {
+        const a = s instanceof Error ? s.message : String(s);
+        i.sendSessionRefreshEvent({
           name: "refresh_token_store_failed",
-          error_message: s
-        }), console.warn("Failed to store refresh token:", e);
+          error_message: a
+        }), console.warn("Failed to store refresh token:", s);
       }
-      return r;
+      return e;
     },
-    (r) => Promise.reject(r)
-  ), a.interceptors.request.use(async (r) => {
+    (e) => Promise.reject(e)
+  ), n.interceptors.request.use(async (e) => {
     try {
-      if (T(r.url)) {
-        const e = await t.getRefreshToken();
-        e || setTimeout(() => {
-          t.getRefreshToken().then((s) => {
-            s && o.sendSessionRefreshEvent({
-              name: "refresh_token_received_after_missing"
-            });
-          }).catch((s) => {
-            const n = s instanceof Error ? s.message : String(s);
-            o.sendSessionRefreshEvent({
-              name: "refresh_token_retrieve_failed_after_missing",
-              error_message: n
-            });
-          });
-        }, 10), e ? (o.sendSessionRefreshEvent({
-          name: "refresh_token_retrieved"
-        }), r.data = {
-          ...r.data,
-          refreshToken: e
-        }) : o.sendSessionRefreshEvent({
-          name: "refresh_token_missing"
+      if (M(e.url)) {
+        const {
+          token: s,
+          attempt: a,
+          outcome: o,
+          errorMessage: u
+        } = r ? await $(t) : { ...await E(t), attempt: 0 };
+        s ? (i.sendSessionRefreshEvent({
+          name: "refresh_token_retrieved",
+          attempt: a,
+          read_outcome: o,
+          error_message: u
+        }), e.data = {
+          ...e.data,
+          refreshToken: s
+        }) : i.sendSessionRefreshEvent({
+          name: "refresh_token_missing",
+          attempt: a,
+          read_outcome: o,
+          error_message: u
         });
       }
-      S(r.url) && (o.sendSessionRefreshEvent({
+      I(e.url) && (i.sendSessionRefreshEvent({
         name: "refresh_token_removing_token"
       }), await t.removeRefreshToken());
-    } catch (e) {
-      const s = e instanceof Error ? e.message : String(e);
-      o.sendSessionRefreshEvent({
+    } catch (s) {
+      const a = s instanceof Error ? s.message : String(s);
+      i.sendSessionRefreshEvent({
         name: "refresh_token_retrieve_failed",
-        error_message: s
-      }), console.warn("Failed to retrieve refresh token:", e);
+        error_message: a
+      }), console.warn("Failed to retrieve refresh token:", s);
     }
-    return r;
+    return e;
   });
-}, S = (t) => t ? /^\/v2\/embedded-wallet-api\/projects\/[^/]+\/auth\/logout$/.test(t) : !1, T = (t) => t ? /^\/v2\/embedded-wallet-api\/projects\/[^/]+\/auth\/(refresh|logout)$/.test(t) : !1, b = (t) => {
+}, I = (t) => t ? /^\/v2\/embedded-wallet-api\/projects\/[^/]+\/auth\/logout$/.test(t) : !1, M = (t) => t ? /^\/v2\/embedded-wallet-api\/projects\/[^/]+\/auth\/(refresh|logout)$/.test(t) : !1, q = (t) => {
   const r = t.config.url;
   return r ? /^\/v2\/embedded-wallet-api\/projects\/[^/]+\/auth\/(verify\/(email|sms|siwe|oauth\/.*)|refresh)$/.test(
     r
   ) : !1;
-}, $ = (t) => {
-  if (!a.getUri() || a.getUri() === "")
+}, j = (t) => {
+  if (!n.getUri() || n.getUri() === "")
     throw new Error("CDP client URI not configured. Call configure() first.");
   if (!t.url || t.url === "")
     throw new Error("AxiosRequestConfig URL is empty. This should never happen.");
   if (!t.method || t.method === "")
     throw new Error("AxiosRequestConfig method is empty. This should never happen.");
-}, U = (t) => t.method?.toString().toUpperCase() || "GET", f = (t) => {
+}, C = (t) => t.method?.toString().toUpperCase() || "GET", w = (t) => {
   if (!t.url)
     throw new Error("URL is required for authentication");
-  const r = a.getUri() + t.url;
+  const r = n.getUri() + t.url;
   return new URL(r);
-}, v = (t) => {
-  const r = /^\/platform\/v2\/embedded-wallet-api\/projects\/[^/]+\/auth\/(refresh|logout)$/, e = /^\/platform\/v2\/embedded-wallet-api\/projects\/[^/]+\/auth\/(mfa)$/, s = /^\/platform\/v2\/embedded-wallet-api\/projects\/[^/]+\/config$/, n = /^\/platform\/v2\/embedded-wallet-api\/projects\/[^/]+\/attestation\/(challenge|register)$/;
-  return r.test(t) || e.test(t) || s.test(t) || n.test(t);
-}, I = (t) => !/^\/platform\/v2\/embedded-wallet-api\/projects\/[^/]+\/auth\/custom\/authenticate$/.test(t), _ = (t) => {
+}, _ = (t) => {
+  const r = /^\/platform\/v2\/embedded-wallet-api\/projects\/[^/]+\/auth\/(refresh|logout)$/, e = /^\/platform\/v2\/embedded-wallet-api\/projects\/[^/]+\/auth\/(mfa)$/, s = /^\/platform\/v2\/embedded-wallet-api\/projects\/[^/]+\/config$/, a = /^\/platform\/v2\/embedded-wallet-api\/projects\/[^/]+\/attestation\/(challenge|register)$/;
+  return r.test(t) || e.test(t) || s.test(t) || a.test(t);
+}, O = (t) => !/^\/platform\/v2\/embedded-wallet-api\/projects\/[^/]+\/auth\/custom\/authenticate$/.test(t), A = (t) => {
   const r = /^\/platform\/v2\/embedded-wallet-api\/projects\/[^/]+\/auth\/(init)$/, e = /^\/platform\/v2\/embedded-wallet-api\/projects\/[^/]+\/auth\/verify\//;
   return r.test(t) || e.test(t);
-}, q = (t) => [
+}, x = (t) => [
   // Auth flows: prevent account takeover on mobile clients
   /\/auth\/verify\//,
   // VerifyEmailAuthentication, VerifySmsAuthentication, VerifyOAuthCode, VerifyOAuthEndUserIdentity
@@ -256,7 +281,7 @@ const O = (t) => {
   // RefreshAccessToken
 ].some((e) => e.test(t));
 export {
-  z as cdpApiClient,
-  O as configureCdpApiClient,
-  D as setAuthManager
+  H as cdpApiClient,
+  N as configureCdpApiClient,
+  z as setAuthManager
 };

package/dist/types/index.d.ts

@@ -203,6 +203,13 @@ export declare type CdpOptions = {
      * relying on HTTP cookies.
      */
     refreshTokenStorage?: RefreshTokenStorage;
+    /**
+     * Whether to retry reading the refresh token when the initial read is empty.
+     * Enable on native platforms whose secure storage can transiently return empty
+     * on the first read after a cold start or app resume; leave off for web, where
+     * reads are synchronous and have no such race. Defaults to false.
+     */
+    retryTokenReads?: boolean;
     /**
      * Optional app attestation for native mobile platforms.
      * When provided, adds assertion headers to sensitive API calls to prove app integrity.
@@ -2533,6 +2540,19 @@ export declare type RefreshAccessTokenResult = NonNullable<Awaited<ReturnType<ty
 export declare interface RefreshTokenStorage {
     /** Retrieves the stored refresh token. */
     getRefreshToken(): Promise<string | null>;
+    /**
+     * Retrieves the stored refresh token with read outcome metadata.
+     *
+     * @returns Promise that resolves to the stored token and read outcome.
+     */
+    getRefreshTokenWithOutcome?(): Promise<{
+        /** The stored refresh token, or null if not found or on error. */
+        token: string | null;
+        /** The outcome of the read: found, not found, or error. */
+        outcome: "found" | "not_found" | "error";
+        /** The error message when the read failed. */
+        errorMessage?: string;
+    }>;
     /** Stores a refresh token securely. */
     setRefreshToken(token: string): Promise<void>;
     /** Removes the stored refresh token. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coinbase/cdp-api-client",
-  "version": "0.0.116",
+  "version": "0.0.118",
   "type": "module",
   "files": [
     "dist/**",