@coinbase/cdp-api-client 0.0.121 → 0.0.123

package/dist/types/index.d.ts

@@ -15,6 +15,14 @@ export declare interface AndroidAppAttestationConfig {
     googleProjectNumber?: string;
 }
 
+/**
+ * Android Play Integrity Standard API payload for verifying a signed challenge.
+ */
+export declare interface AndroidIntegrityPayload {
+    /** Play Integrity token (JWT) obtained from `StandardIntegrityManager.requestToken()`, proving this request originates from a genuine, unmodified installation of the partner app. The token must have been requested with `requestHash = base64url(SHA256(challenge))`, where `challenge` is the opaque token issued by the [Create Onramp Mobile Challenge](#operation/createOnrampMobileChallenge) endpoint. */
+    integrityToken: string;
+}
+
 /**
  * Extended API error that encompasses both OpenAPI errors and other API-related errors
  */
@@ -643,6 +651,63 @@ export declare type CreateEvmEip7702DelegationWithEndUserAccountParams = {
 
 export declare type CreateEvmEip7702DelegationWithEndUserAccountResult = NonNullable<Awaited<ReturnType<typeof createEvmEip7702DelegationWithEndUserAccount>>>;
 
+/**
+ * Issues a one-time challenge for the iOS App Attest device-key **registration** step. The partner app passes the challenge to `DCAppAttestService.attestKey(keyId, clientDataHash: SHA256(challenge))` and submits the resulting attestation to [Register Onramp iOS Attestation](#operation/registerOnrampIosAttestation).
+
+ This is distinct from [Create Onramp Mobile Challenge](#operation/createOnrampMobileChallenge), which issues the per-transaction session challenge. Registration is a one-time, per-device-install operation; iOS-only (Android validates Play Integrity inline per request and has no registration step).
+ * @summary Create an onramp iOS attestation challenge
+ */
+export declare const createOnrampIosAttestationChallenge: (projectId: ProjectId, options?: SecondParameter_2<typeof cdpApiClient<IosAttestationChallenge>>) => Promise<IosAttestationChallenge>;
+
+export declare type CreateOnrampIosAttestationChallengeResult = NonNullable<Awaited<ReturnType<typeof createOnrampIosAttestationChallenge>>>;
+
+/**
+ * Issues a challenge for initiating an onramp flow from a partner mobile app. The challenge is signed by the partner app using platform attestation (iOS App Attest or Android Play Integrity) and submitted to the [Create Onramp Mobile Session](#operation/createOnrampMobileSession) endpoint to obtain a ready-to-use onramp URL, without requiring the partner app to authenticate with a CDP API key.
+
+ The `projectId` identifies the partner mobile app and must be on the Coinbase-maintained allowlist. The `redirectUrl` is required so the Coinbase app knows where to return the user after completing or dismissing the transaction.
+ * @summary Create an onramp mobile challenge
+ */
+export declare const createOnrampMobileChallenge: (createOnrampMobileChallengeBody: CreateOnrampMobileChallengeBody, options?: SecondParameter_2<typeof cdpApiClient<OnrampMobileChallenge>>) => Promise<OnrampMobileChallenge>;
+
+export declare type CreateOnrampMobileChallengeBody = OnrampSessionRequest & CreateOnrampMobileChallengeBodyAllOf & Required<Pick<OnrampSessionRequest & CreateOnrampMobileChallengeBodyAllOf, "redirectUrl">>;
+
+export declare type CreateOnrampMobileChallengeBodyAllOf = {
+    projectId: ProjectId;
+};
+
+export declare type CreateOnrampMobileChallengeResult = NonNullable<Awaited<ReturnType<typeof createOnrampMobileChallenge>>>;
+
+/**
+ * Verifies the platform attestation for a challenge issued by [Create Onramp Mobile Challenge](#operation/createOnrampMobileChallenge) and returns a ready-to-use onramp URL. The URL embeds the session token as a query parameter so the Coinbase app can populate the handoff screen immediately on launch.
+
+ This endpoint is idempotent on the challenge token: if the same challenge is submitted again (e.g. due to a lost response), the server returns the original session URL rather than an error.
+
+ Provide exactly one platform payload: `ios` (App Attest assertion) or `android` (Play Integrity token).
+ * @summary Create an onramp mobile session
+ */
+export declare const createOnrampMobileSession: (createOnrampMobileSessionRequest: CreateOnrampMobileSessionRequest, options?: SecondParameter_2<typeof cdpApiClient<CreateOnrampMobileSession201>>) => Promise<CreateOnrampMobileSession201>;
+
+export declare type CreateOnrampMobileSession201 = {
+    session: OnrampSession;
+};
+
+/**
+ * Request body for creating an onramp mobile session.
+ */
+export declare type CreateOnrampMobileSessionRequest = (unknown & {
+    /** The challenge returned by the [Create Onramp Mobile Challenge](#operation/createOnrampMobileChallenge) endpoint. Must be passed back exactly as received — do not decode or modify. */
+    challenge: OnrampMobileChallengeToken;
+    ios?: IosAssertionPayload;
+    android?: AndroidIntegrityPayload;
+}) | (unknown & {
+    /** The challenge returned by the [Create Onramp Mobile Challenge](#operation/createOnrampMobileChallenge) endpoint. Must be passed back exactly as received — do not decode or modify. */
+    challenge: OnrampMobileChallengeToken;
+    ios?: IosAssertionPayload;
+    android?: AndroidIntegrityPayload;
+});
+
+export declare type CreateOnrampMobileSessionResult = NonNullable<Awaited<ReturnType<typeof createOnrampMobileSession>>>;
+
 /**
  * Request parameters for creating a Spend Permission.
  */
@@ -702,6 +767,31 @@ export declare type CreateSpendPermissionWithEndUserAccountResult = NonNullable<
  */
 export declare type DelegationForbiddenErrorResponse = Error_2;
 
+/**
+ * Deletes a single enrolled passkey by its credential ID.
+
+ **Last Method Protection:** If deleting this passkey would leave the end user with no enrolled MFA methods of any type (no other passkeys, TOTP, or SMS) and the project has `requireVerificationOnLogin: true`, the request is rejected with a 403 to prevent account lockout.
+ * @summary Delete a passkey
+ */
+export declare const deletePasskey: (userId: string, credentialId: string, params?: DeletePasskeyParams, options?: SecondParameter<typeof cdpApiClient<void>>) => Promise<void>;
+
+export declare type DeletePasskeyParams = {
+    /**
+     * The ID of the CDP Project. Required for end users authenticated using custom auth (i.e. a non-CDP JWT provider).
+     * @pattern ^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$
+     */
+    projectID?: ProjectIDOptionalParameter;
+};
+
+export declare type DeletePasskeyResult = NonNullable<Awaited<ReturnType<typeof deletePasskey>>>;
+
+/**
+ * A human-readable description.
+ * @minLength 0
+ * @maxLength 500
+ */
+export declare type Description = string;
+
 /**
  * Information about an end user who authenticates using a JWT issued by the developer.
  */
@@ -924,6 +1014,16 @@ export declare interface EndUserEvmAccount {
     address: string;
     /** The date and time when the account was created, in ISO 8601 format. */
     createdAt: string;
+    /**
+     * The date and time when the account's private key was first exported, in ISO 8601 format. This is set on the first export and preserved on subsequent exports; it is not updated on re-export.
+     * @nullable
+     */
+    exportedAt?: string | null;
+    /**
+     * The date and time when the account's key was ejected (marked for deletion), in ISO 8601 format. Populated when the account has been ejected. The account record remains queryable after this timestamp is set; it reflects when ejection was requested, not when the key material is purged.
+     * @nullable
+     */
+    ejectedAt?: string | null;
 }
 
 /**
@@ -1084,6 +1184,16 @@ export declare interface EndUserSolanaAccount {
     address: string;
     /** The date and time when the account was created, in ISO 8601 format. */
     createdAt: string;
+    /**
+     * The date and time when the account's private key was first exported, in ISO 8601 format. This is set on the first export and preserved on subsequent exports; it is not updated on re-export.
+     * @nullable
+     */
+    exportedAt?: string | null;
+    /**
+     * The date and time when the account's key was ejected (marked for deletion), in ISO 8601 format. Populated when the account has been ejected. The account record remains queryable after this timestamp is set; it reflects when ejection was requested, not when the key material is purged.
+     * @nullable
+     */
+    ejectedAt?: string | null;
 }
 
 /**
@@ -1309,6 +1419,8 @@ export declare interface EvmUserOperation {
     transactionHash?: string;
     /** The list of receipts associated with the user operation. */
     receipts?: UserOperationReceipt[];
+    /** The timestamp at which the prepared user operation expires. */
+    expiresAt?: string;
 }
 
 /**
@@ -1846,9 +1958,11 @@ export declare const initiateMfaEnrollment: (userId: string, mfaMethod: "totp" |
  * Initiates MFA enrollment for an end user for given method.
  For TOTP, this endpoint generates a TOTP secret and returns an otpauth:// URL that can be scanned with an authenticator app like Google Authenticator. This endpoint returns both an authUrl (for QR code generation) and the raw secret (for manual entry). The secret must be verified within 5 minutes by calling the submit endpoint.
  For SMS, this endpoint sends a 6-digit OTP code to the provided phone number. You can use any phone number for SMS MFA, even if it differs from your SMS authentication phone number. The OTP code must be verified within 5 minutes.
+ For passkey (WebAuthn), this endpoint returns credential creation options to pass to navigator.credentials.create() in the browser. The resulting attestation credential must be submitted to the submit endpoint. Passkey MFA is supported in web environments only.
+ Passkey requests must carry an `Origin` header that is one of the project's configured CORS origins and is either `https://` or `http://localhost`; otherwise the request is rejected with a 400. The WebAuthn Relying Party ID is the exact host of that origin, so the resulting credential can only be used from that same host.
  * @summary Initiate MFA enrollment
  */
-export declare const initiateMfaEnrollment2: (userId: string, mfaMethod: "totp" | "sms", initiateMfaEnrollmentRequest: InitiateMfaEnrollmentRequest, params?: InitiateMfaEnrollment2Params, options?: SecondParameter<typeof cdpApiClient<InitiateMfaEnrollmentResponseWrapper>>) => Promise<InitiateMfaEnrollmentResponseWrapper>;
+export declare const initiateMfaEnrollment2: (userId: string, mfaMethod: "totp" | "sms" | "passkey", initiateMfaEnrollmentRequest: InitiateMfaEnrollmentRequest, params?: InitiateMfaEnrollment2Params, options?: SecondParameter<typeof cdpApiClient<InitiateMfaEnrollmentResponseWrapper>>) => Promise<InitiateMfaEnrollmentResponseWrapper>;
 
 export declare type InitiateMfaEnrollment2Params = {
     /**
@@ -1868,15 +1982,30 @@ export declare type InitiateMfaEnrollmentParams = {
     projectID?: ProjectIDOptionalParameter;
 };
 
+/**
+ * Response after initiating passkey MFA enrollment. Contains the WebAuthn credential creation options (PublicKeyCredentialCreationOptions) to pass directly to navigator.credentials.create() in the browser. The payload is an opaque object produced by the WebAuthn server; the SDK should not modify it beyond the standard base64url decoding of binary fields.
+ */
+export declare interface InitiateMfaEnrollmentPasskeyResponse {
+    /** The WebAuthn PublicKeyCredentialCreationOptions object (the `publicKey` member of the credential creation request). Passed opaquely to the browser WebAuthn API. */
+    creationOptions: InitiateMfaEnrollmentPasskeyResponseCreationOptions;
+}
+
+/**
+ * The WebAuthn PublicKeyCredentialCreationOptions object (the `publicKey` member of the credential creation request). Passed opaquely to the browser WebAuthn API.
+ */
+export declare type InitiateMfaEnrollmentPasskeyResponseCreationOptions = {
+    [key: string]: unknown;
+};
+
 /**
  * Request body for initiating MFA enrollment.
  */
-export declare type InitiateMfaEnrollmentRequest = InitiateTotpMfaEnrollment | InitiateSmsMfaEnrollment;
+export declare type InitiateMfaEnrollmentRequest = InitiateTotpMfaEnrollment | InitiateSmsMfaEnrollment | InitiatePasskeyMfaEnrollment;
 
 /**
  * A wrapper for the response of an initiate MFA enrollment operation.
  */
-export declare type InitiateMfaEnrollmentResponseWrapper = InitiateMfaEnrollmentTotpResponse | InitiateMfaEnrollmentSmsResponse;
+export declare type InitiateMfaEnrollmentResponseWrapper = InitiateMfaEnrollmentTotpResponse | InitiateMfaEnrollmentSmsResponse | InitiateMfaEnrollmentPasskeyResponse;
 
 export declare type InitiateMfaEnrollmentResult = NonNullable<Awaited<ReturnType<typeof initiateMfaEnrollment>>>;
 
@@ -1901,10 +2030,18 @@ export declare interface InitiateMfaEnrollmentTotpResponse {
 /**
  * Initiates an MFA verification flow for operations requiring MFA. This endpoint should be called when a user attempts a sensitive operation (like transaction signing) but doesn't have a valid MFA-verified session.
  For SMS, generates and sends a 6-digit OTP to the enrolled phone number. For TOTP, user generates code from their authenticator app.
- The mfaMethod parameter is required to specify which method to use for verification.
+ For passkey (WebAuthn), returns credential request options (in the response body) to pass to navigator.credentials.get() in the browser; the resulting assertion must be submitted to the submit endpoint. Only the passkey method returns a response body here; TOTP and SMS return `{}`.
+ Passkey requests must carry an `Origin` header that is one of the project's configured CORS origins and is either `https://` or `http://localhost`; otherwise the request is rejected with a 400. Only passkeys enrolled from that exact host are offered, so a user with passkeys on other hosts only receives a 404 here and must enroll a passkey for this origin.
  * @summary Initiate MFA verification
  */
-export declare const initiateMfaVerification: (userId: string, mfaMethod: "totp" | "sms", params?: InitiateMfaVerificationParams, options?: SecondParameter<typeof cdpApiClient<void>>) => Promise<void>;
+export declare const initiateMfaVerification: (userId: string, mfaMethod: "totp" | "sms" | "passkey", params?: InitiateMfaVerificationParams, options?: SecondParameter<typeof cdpApiClient<InitiateMfaVerificationResponseWrapper>>) => Promise<InitiateMfaVerificationResponseWrapper>;
+
+/**
+ * Empty response for TOTP/SMS verification initiation.
+ */
+export declare interface InitiateMfaVerificationEmptyResponse {
+    [key: string]: unknown;
+}
 
 export declare type InitiateMfaVerificationParams = {
     /**
@@ -1914,6 +2051,26 @@ export declare type InitiateMfaVerificationParams = {
     projectID?: ProjectIDOptionalParameter;
 };
 
+/**
+ * Response after initiating passkey MFA verification. Contains the WebAuthn credential request options (PublicKeyCredentialRequestOptions) to pass directly to navigator.credentials.get() in the browser. Only the passkey method returns a body from the verify-initiate operation; TOTP and SMS return `{}`.
+ */
+export declare interface InitiateMfaVerificationPasskeyResponse {
+    /** The WebAuthn PublicKeyCredentialRequestOptions object (the `publicKey` member of the credential request). Passed opaquely to the browser WebAuthn API. */
+    requestOptions: InitiateMfaVerificationPasskeyResponseRequestOptions;
+}
+
+/**
+ * The WebAuthn PublicKeyCredentialRequestOptions object (the `publicKey` member of the credential request). Passed opaquely to the browser WebAuthn API.
+ */
+export declare type InitiateMfaVerificationPasskeyResponseRequestOptions = {
+    [key: string]: unknown;
+};
+
+/**
+ * A wrapper for the response of an initiate MFA verification operation. Passkey verification returns WebAuthn credential request options; TOTP and SMS return `{}`.
+ */
+export declare type InitiateMfaVerificationResponseWrapper = InitiateMfaVerificationPasskeyResponse | InitiateMfaVerificationEmptyResponse;
+
 export declare type InitiateMfaVerificationResult = NonNullable<Awaited<ReturnType<typeof initiateMfaVerification>>>;
 
 /**
@@ -1944,6 +2101,23 @@ export declare interface InitiateOAuthAuthenticationResponse {
     authUrl: Url;
 }
 
+/**
+ * Request to initiate passkey (WebAuthn) MFA enrollment. Returns WebAuthn credential creation options for the browser to pass to navigator.credentials.create(). Passkey MFA is supported in web environments only.
+ */
+export declare interface InitiatePasskeyMfaEnrollment {
+    /** The type of MFA method. */
+    type: InitiatePasskeyMfaEnrollmentType;
+}
+
+/**
+ * The type of MFA method.
+ */
+export declare type InitiatePasskeyMfaEnrollmentType = (typeof InitiatePasskeyMfaEnrollmentType)[keyof typeof InitiatePasskeyMfaEnrollmentType];
+
+export declare const InitiatePasskeyMfaEnrollmentType: {
+    readonly passkey: "passkey";
+};
+
 /**
  * The request body for an end user to initiate Sign In With Ethereum (EIP-4361) authentication. The server generates a nonce and returns a pre-formatted SIWE message for the end user to sign with their Ethereum wallet.
  */
@@ -2085,6 +2259,16 @@ export declare interface IOSAppAttestationConfig {
     identifier?: string;
 }
 
+/**
+ * iOS App Attest assertion payload for verifying a signed challenge.
+ */
+export declare interface IosAssertionPayload {
+    /** The key identifier of the iOS App Attest key previously registered via the attestation registration endpoint. This is the `keyId` returned by `DCAppAttestService.generateKey()`. */
+    keyId: string;
+    /** Base64-encoded App Attest assertion generated by `DCAppAttestService.generateAssertion(keyId, clientDataHash: SHA256(challenge))`. */
+    assertion: string;
+}
+
 /**
  * A cryptographic challenge for iOS App Attest attestation. Used only by iOS clients - Android uses a different flow with Play Integrity Standard API tokens.
  */
@@ -2111,11 +2295,7 @@ export declare interface IosAttestationPayload {
      * @pattern ^[A-Za-z0-9+/]+=*$
      */
     attestation: string;
-    /**
-     * The iOS bundle identifier of the application.
-     * @pattern ^[a-zA-Z0-9.-]+$
-     */
-    bundleId: string;
+    bundleId: IosBundleId;
 }
 
 /**
@@ -2153,6 +2333,12 @@ export declare const IosAttestationRegistrationResponsePlatform: {
     readonly ios: "ios";
 };
 
+/**
+ * iOS application bundle identifier (`CFBundleIdentifier`), as configured in the app's Xcode project / Info.plist, or shown for the App ID in Apple Developer. Must contain only alphanumeric characters (A–Z, a–z, 0–9), hyphens (-), and periods (.), typically in reverse-DNS form (e.g. `com.example.app`). Underscores are not permitted.
+ * @pattern ^[a-zA-Z0-9.-]+$
+ */
+export declare type IosBundleId = string;
+
 /**
  * Type guard to check if an object is an OpenAPIError
  *
@@ -2183,6 +2369,22 @@ export declare const isRefreshTokenUnavailableError: (error: unknown) => error i
  */
 export declare const isTransientTokenReadError: (error: RefreshTokenUnavailableError) => boolean;
 
+/**
+ * Lists the passkey (WebAuthn) credentials enrolled by the end user. Never returns the COSE public key or other sensitive credential material.
+ * @summary List passkeys
+ */
+export declare const listPasskeys: (userId: string, params?: ListPasskeysParams, options?: SecondParameter<typeof cdpApiClient<PasskeyListResponse>>) => Promise<PasskeyListResponse>;
+
+export declare type ListPasskeysParams = {
+    /**
+     * The ID of the CDP Project. Required for end users authenticated using custom auth (i.e. a non-CDP JWT provider).
+     * @pattern ^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$
+     */
+    projectID?: ProjectIDOptionalParameter;
+};
+
+export declare type ListPasskeysResult = NonNullable<Awaited<ReturnType<typeof listPasskeys>>>;
+
 export declare interface ListResponse {
     /** The token for the next page of items, if any. */
     nextPageToken?: string;
@@ -2246,6 +2448,7 @@ export declare interface MfaConfig {
     enabled: boolean;
     totpConfig: TotpConfig;
     smsConfig?: SmsConfig;
+    passkeyConfig?: PasskeyConfig;
     /** The duration in seconds for which a single MFA verification remains valid. After this period, the user must re-authenticate with MFA. */
     verificationWindowSeconds: number;
     /** Whether applications should prompt users for MFA enrollment during the login flow if they are not already enrolled. */
@@ -2259,12 +2462,7 @@ export declare interface MfaConfig {
 }
 
 /**
- * The MFA enrollment or verification flow expired.
- */
-export declare type MfaFlowExpiredErrorResponse = Error_2;
-
-/**
- * The MFA code provided is invalid or expired.
+ * The MFA submission (code or WebAuthn credential) is invalid or expired.
  */
 export declare type MfaInvalidCodeErrorResponse = Error_2;
 
@@ -2276,6 +2474,7 @@ export declare type MfaMethod = (typeof MfaMethod)[keyof typeof MfaMethod];
 export declare const MfaMethod: {
     readonly totp: "totp";
     readonly sms: "sms";
+    readonly passkey: "passkey";
 };
 
 /**
@@ -2291,6 +2490,8 @@ export declare interface MFAMethods {
     totp?: MFAMethodsTotp;
     /** An object containing information about the end user's SMS MFA enrollment. */
     sms?: MFAMethodsSms;
+    /** The end user's enrolled passkey (WebAuthn) credentials. A user may enroll multiple passkeys, so this is a list. Omitted or empty when the user has no passkeys enrolled. Never includes COSE public-key material. */
+    passkey?: PasskeySummary[];
 }
 
 /**
@@ -2310,12 +2511,7 @@ export declare type MFAMethodsTotp = {
 };
 
 /**
- * The user has not enrolled in MFA method.
- */
-export declare type MfaNotEnrolledErrorResponse = Error_2;
-
-/**
- * The blockchain network for the payment. Supported networks depend on the account type. See [API and Network Support](https://docs.cdp.coinbase.com/api-reference/payment-apis/supported-networks-assets#by-asset-and-network) for more details.
+ * The blockchain network for the payment. Supported networks depend on the account type.
  */
 export declare type Network = (typeof Network)[keyof typeof Network];
 
@@ -2368,23 +2564,103 @@ export declare const OAuth2ProviderType: {
 };
 
 /**
- * The OTP email logo for a project.
+ * A server-issued challenge for platform attestation in an App2App onramp handoff.
+ */
+export declare interface OnrampMobileChallenge {
+    /** An opaque server-issued token to be used with platform attestation (iOS App Attest or Android Play Integrity Standard). Treat it as an opaque string — do not attempt to parse its contents. Pass this value along with the attestation payload to the [Create Onramp Mobile Session](#operation/createOnrampMobileSession) endpoint to complete the App2App handoff.
+
+     **iOS**: pass this value directly to `DCAppAttestService.generateAssertion(keyId, clientDataHash: SHA256(challenge))`.
+
+     **Android**: compute `requestHash = base64url(SHA256(challenge))` and pass it to `StandardIntegrityManager.requestToken(requestHash)`. */
+    challenge: OnrampMobileChallengeToken;
+    /** The time at which the challenge expires. Challenges are short-lived; submit the attestation to [Create Onramp Mobile Session](#operation/createOnrampMobileSession) before this time or request a new challenge. */
+    expiresAt: string;
+}
+
+/**
+ * An opaque server-issued token used in the App2App onramp handoff. Treat it as an opaque string — do not attempt to parse or decode its contents.
+ * @minLength 16
+ * @maxLength 2048
+ */
+export declare type OnrampMobileChallengeToken = string;
+
+/**
+ * The type of payment method used to generate the onramp quote.
+ */
+export declare type OnrampQuotePaymentMethodTypeId = (typeof OnrampQuotePaymentMethodTypeId)[keyof typeof OnrampQuotePaymentMethodTypeId];
+
+export declare const OnrampQuotePaymentMethodTypeId: {
+    readonly CARD: "CARD";
+    readonly ACH: "ACH";
+    readonly APPLE_PAY: "APPLE_PAY";
+    readonly PAYPAL: "PAYPAL";
+    readonly FIAT_WALLET: "FIAT_WALLET";
+    readonly CRYPTO_WALLET: "CRYPTO_WALLET";
+};
+
+/**
+ * An onramp session containing a ready-to-use onramp URL.
+ */
+export declare interface OnrampSession {
+    /** Ready-to-use onramp URL. */
+    onrampUrl: Url;
+}
+
+/**
+ * Common request parameters shared by [Create Onramp Session](#operation/createOnrampSession) and [Create Onramp Mobile Challenge](#operation/createOnrampMobileChallenge).
+ */
+export declare interface OnrampSessionRequest {
+    /** The ticker (e.g. `BTC`, `USDC`, `SOL`) or the Coinbase UUID (e.g. `d85dce9b-5b73-5c3c-8978-522ce1d1c1b4`) of the crypto asset to be purchased.
+
+     Use the [Onramp Buy Options API](https://docs.cdp.coinbase.com/api-reference/rest-api/onramp-offramp/get-buy-options) to discover the supported purchase currencies for your user's location. */
+    purchaseCurrency: string;
+    /** The name of the crypto network the purchased currency will be sent on.
+
+     Use the [Onramp Buy Options API](https://docs.cdp.coinbase.com/api-reference/rest-api/onramp-offramp/get-buy-options) to discover the supported networks for your user's location. */
+    destinationNetwork: string;
+    /** The address the purchased crypto will be sent to. */
+    destinationAddress: BlockchainAddress;
+    /** A string representing the amount of fiat the user wishes to pay in exchange for crypto. When using this parameter, the returned quote will be inclusive of fees i.e. the user will pay this exact amount of the payment currency. */
+    paymentAmount?: string;
+    /** A string representing the amount of crypto the user wishes to purchase. When using this parameter, the returned quote will be exclusive of fees i.e. the user will receive this exact amount of the purchase currency. */
+    purchaseAmount?: string;
+    /** The fiat currency to be converted to crypto. */
+    paymentCurrency?: string;
+    paymentMethod?: OnrampQuotePaymentMethodTypeId;
+    /** The ISO 3166-1 two letter country code (e.g. US). */
+    country?: string;
+    /** The ISO 3166-2 two letter state code (e.g. NY). Only required for US. */
+    subdivision?: string;
+    /** URI to redirect the user to after they complete or dismiss the transaction. Embedded in the returned onramp URL as a query parameter. */
+    redirectUrl?: Uri;
+    /** The IP address of the end user requesting the onramp transaction. */
+    clientIp?: string;
+    /** A unique string that represents the user in your app. This can be used to link individual transactions together so you can retrieve the transaction history for your users. Prefix this string with "sandbox-" (e.g. "sandbox-user-1234") to perform a sandbox transaction which will allow you to test your integration without any real transfer of funds.
+
+     This value can be used with the [Onramp User Transactions API](https://docs.cdp.coinbase.com/api-reference/rest-api/onramp-offramp/get-onramp-transactions-by-id) to retrieve all transactions created by the user. */
+    partnerUserRef?: string;
+}
+
+/**
+ * An OTP email logo upload and its moderation state.
  */
 export declare interface OtpEmailLogo {
-    /** The unique identifier of the logo asset. */
-    logoId: string;
-    /** The public URL for the logo image. */
-    logoUrl?: Url;
-    /** The moderation status of the logo. If pending, poll getProjectConfig until the status resolves to approved or rejected. If rejected, upload a new image. */
-    moderationStatus: OtpEmailLogoModerationStatus;
+    /** Moderation status of this logo. An approved logo is live and populates url. A pending logo is still undergoing moderation. A rejected logo failed moderation and populates rejectionReason.
+     */
+    status: OtpEmailLogoStatus;
+    /** The URL of the logo. Present only when status is approved; omitted otherwise. */
+    url?: Url;
+    /** Reason the upload was rejected. Present only when status is rejected; omitted otherwise. */
+    rejectionReason?: string;
 }
 
 /**
- * The moderation status of the logo. If pending, poll getProjectConfig until the status resolves to approved or rejected. If rejected, upload a new image.
+ * Moderation status of this logo. An approved logo is live and populates url. A pending logo is still undergoing moderation. A rejected logo failed moderation and populates rejectionReason.
+
  */
-export declare type OtpEmailLogoModerationStatus = (typeof OtpEmailLogoModerationStatus)[keyof typeof OtpEmailLogoModerationStatus];
+export declare type OtpEmailLogoStatus = (typeof OtpEmailLogoStatus)[keyof typeof OtpEmailLogoStatus];
 
-export declare const OtpEmailLogoModerationStatus: {
+export declare const OtpEmailLogoStatus: {
     readonly approved: "approved";
     readonly pending: "pending";
     readonly rejected: "rejected";
@@ -2400,6 +2676,86 @@ export declare type PageSizeParameter = number;
  */
 export declare type PageTokenParameter = string;
 
+/**
+ * Passkey-specific MFA configuration. There is no project-level Relying Party ID: the RP ID is derived per ceremony from the request `Origin`, and each enrolled credential records the host it is scoped to (see `PasskeySummary.rpId`).
+ */
+export declare interface PasskeyConfig {
+    /** Whether passkey MFA is enabled. */
+    enabled: boolean;
+    userVerification?: PasskeyUserVerification;
+}
+
+/**
+ * The list of passkeys enrolled by an end user.
+ */
+export declare interface PasskeyListResponse {
+    /** The enrolled passkey credentials. */
+    passkeys: PasskeySummary[];
+}
+
+/**
+ * Read-only echo of the project's passkey (WebAuthn) MFA configuration, exposed on the project config so SDKs can decide whether to offer passkey ceremonies. Use `getProjectConfig` for that decision: when that response omits this block, passkey MFA is unavailable for the project and clients should treat it as disabled. Project-config write echoes may omit the block regardless of project state, so call `getProjectConfig` when current availability matters. When the block is present, `enabled` is authoritative rather than its mere presence. The Relying Party ID is deliberately not exposed: it is derived per ceremony from the request `Origin` (the origin's exact host), so the client already knows it.
+ */
+export declare interface PasskeyProjectConfig {
+    /** Whether passkey MFA is enabled for this project. */
+    enabled: boolean;
+}
+
+/**
+ * Summary of an enrolled passkey credential. Never includes the COSE public key or any other sensitive credential material.
+ */
+export declare interface PasskeySummary {
+    /**
+     * The base64url-encoded WebAuthn credential ID, uniquely identifying the passkey. Used as the path parameter when deleting a passkey.
+     * @maxLength 1500
+     * @pattern ^[A-Za-z0-9_-]+={0,2}$
+     */
+    credentialId: string;
+    /**
+     * The human-friendly name assigned to the passkey at enrollment, if any.
+     * @maxLength 100
+     */
+    name?: string;
+    /** The authenticator's AAGUID (Authenticator Attestation GUID), identifying the authenticator model. May be all-zero when the authenticator does not report one. */
+    aaguid?: string;
+    /** The transports the authenticator reported for this credential. */
+    transports?: PasskeySummaryTransportsItem[];
+    /** Whether the credential is currently backed up (e.g. synced to a cloud keychain / multi-device passkey). Reflects the authenticator's WebAuthn backup-state (BS) flag. */
+    backedUp?: boolean;
+    /** When the passkey was enrolled, in ISO 8601 format. */
+    enrolledAt: string;
+    /** When the passkey was last used for verification, in ISO 8601 format. Absent if the passkey has not been used since enrollment. */
+    lastUsedAt?: string;
+    /** The WebAuthn Relying Party ID this passkey is scoped to: the exact host of the origin it was enrolled from, canonicalized and without a port. Always present. The passkey can only be used from that same host, so a user who needs a passkey on another host must enroll one there as well. */
+    rpId: string;
+}
+
+/**
+ * A WebAuthn authenticator transport hint, from the closed set defined by the WebAuthn `AuthenticatorTransport` values. `smart-card` and `cable` are the verbatim WebAuthn wire values and are kebab-case by exception (§2.6), matching those values exactly.
+ */
+export declare type PasskeySummaryTransportsItem = (typeof PasskeySummaryTransportsItem)[keyof typeof PasskeySummaryTransportsItem];
+
+export declare const PasskeySummaryTransportsItem: {
+    readonly usb: "usb";
+    readonly nfc: "nfc";
+    readonly ble: "ble";
+    readonly internal: "internal";
+    readonly hybrid: "hybrid";
+    readonly "smart-card": "smart-card";
+    readonly cable: "cable";
+};
+
+/**
+ * The WebAuthn user-verification requirement applied during passkey ceremonies for this project. Defaults to `preferred` when omitted.
+ */
+export declare type PasskeyUserVerification = (typeof PasskeyUserVerification)[keyof typeof PasskeyUserVerification];
+
+export declare const PasskeyUserVerification: {
+    readonly required: "required";
+    readonly preferred: "preferred";
+    readonly discouraged: "discouraged";
+};
+
 /**
  * The ERC-7677 `context` object forwarded to the paymaster service as part of the `paymasterService` capability. The fields in this object are defined by the paymaster service provider; CDP forwards them to the paymaster unchanged. This field is only valid when a paymaster is configured for the request. Providing `paymasterContext` without a paymaster configured results in an `invalid_request` error.
  */
@@ -2435,9 +2791,13 @@ export declare interface ProjectConfig {
     iCloudAutoLinkingEnabled?: boolean;
     /** Whether delegated signing is enabled for this project. When enabled, end users can delegate transaction signing to the project. */
     delegatedSigningEnabled?: boolean;
+    /** The verified cookie domain for this project, if one is active. When present, the SDK should route all auth requests through https://{activeCookieDomain}/v2/embedded-wallet-api/... so that first-party HttpOnly session cookies are scoped to the developer's domain. Absent when no cookie domain is registered or the registered domain is not yet active. */
+    activeCookieDomain?: string;
     appAttestation?: AppAttestationProjectConfig;
-    /** The project's OTP email logo. */
-    logo?: OtpEmailLogo;
+    passkey?: PasskeyProjectConfig;
+    /** The project's OTP email logos, sorted by upload time from oldest to newest. When the latest upload is approved, only that logo is returned. When the latest upload is pending or rejected, the previously approved logo is also returned when one exists.
+     */
+    logos?: OtpEmailLogo[];
 }
 
 /**
@@ -2451,6 +2811,11 @@ export declare type ProjectId = string;
  */
 export declare type ProjectIDOptionalParameter = string;
 
+/**
+ * Rate limit exceeded.
+ */
+export declare type RateLimitExceededResponse = Error_2;
+
 /**
  * Receives the OAuth callback from an identity provider. This endpoint is intended only for use as a callback URL during OAuth2 provider flows and should not be called directly by client applications. This is an unauthenticated endpoint.
  * @summary Receive OAuth callback from identity provider
@@ -2675,6 +3040,20 @@ export declare const registerAttestation: (projectId: ProjectId, iosAttestationR
 
 export declare type RegisterAttestationResult = NonNullable<Awaited<ReturnType<typeof registerAttestation>>>;
 
+/**
+ * Verifies an iOS App Attest attestation payload and registers the device's public key for future assertion validation. The server checks that the attestation is genuine and signed by Apple, that the bundle ID is in the partner's allowed mobile clients list, and that the challenge issued by [Create Onramp iOS Attestation Challenge](#operation/createOnrampIosAttestationChallenge) is fresh and unused.
+
+ This is a one-time, per-device-install operation; iOS-only (Android validates Play Integrity inline per request and has no registration step). For security, all client-side verification failures are returned as an opaque `400 invalid_request` — the response never reveals which specific check failed.
+
+ The Apple App Attest `keyId` is supplied only in the request body (`ios.keyId`). Do not put `keyId` in the URL — App Attest key IDs are standard base64 and frequently contain `/`, which breaks path routing at the edge.
+
+ Idempotency is provided by `ios.keyId` itself: the server upserts the device public key on `(app, keyId)`, so repeating registration for the same key replaces the stored public key rather than creating a duplicate. This endpoint does not accept `X-Idempotency-Key` — `ios.keyId` is the natural idempotency key for the registration resource. The challenge remains single-use and is claimed on first receipt.
+ * @summary Register a device key for iOS App Attest
+ */
+export declare const registerOnrampIosAttestation: (projectId: ProjectId, iosAttestationRegistrationRequest: IosAttestationRegistrationRequest, options?: SecondParameter_2<typeof cdpApiClient<IosAttestationRegistrationResponse>>) => Promise<IosAttestationRegistrationResponse>;
+
+export declare type RegisterOnrampIosAttestationResult = NonNullable<Awaited<ReturnType<typeof registerOnrampIosAttestation>>>;
+
 /**
  * Registers a Temporary Wallet Secret for a given end user. This secret is generated on the client-side by the end user's device/browser, typically with the CDP User Wallet SDK, and is used to authenticate requests related to signing.
 
@@ -2843,6 +3222,8 @@ export declare type RevokeSpendPermissionWithEndUserAccountResult = NonNullable<
 
 declare type SecondParameter<T extends (...args: never) => unknown> = Parameters<T>[1];
 
+declare type SecondParameter_2<T extends (...args: never) => unknown> = Parameters<T>[1];
+
 /**
  * Sends USDC from an end user's EVM account (EOA or Smart Account) to a recipient address on a supported EVM network. This endpoint simplifies USDC transfers by automatically handling contract resolution, decimal conversion, gas estimation, and transaction encoding.
  The `amount` field accepts human-readable amounts as decimal strings (e.g., "1.5", "25.50").
@@ -3170,6 +3551,14 @@ export declare type ServiceUnavailableErrorResponse = Error_2;
  */
 export declare const setAuthManager: (manager: AuthManager) => void;
 
+/**
+ * Updates the active cookie domain used for first-party auth routing.
+ * Call after fetching project config to enable (non-null) or disable (null) cookie domain routing.
+ *
+ * @param domain - The active cookie domain, or null to route through the default CDP URL.
+ */
+export declare const setCookieDomain: (domain: string | null) => void;
+
 /**
  * Signs a 32-byte sighash using the child key derived from the end user's Bitcoin HD (Hierarchical Deterministic) account at the given child path. The child path [change, address_index] must correspond to the same path used to derive the address that controls the UTXO being spent. One call is required per UTXO input in the transaction.
  * @summary Sign a Bitcoin hash with an end user account
@@ -3493,6 +3882,50 @@ export declare type SignSolanaTransactionWithEndUserAccountParams = {
 
 export declare type SignSolanaTransactionWithEndUserAccountResult = NonNullable<Awaited<ReturnType<typeof signSolanaTransactionWithEndUserAccount>>>;
 
+/**
+ * Signs an x402 payment payload using the end user's given Solana account.
+ Accepts the full x402 payment required response body from a resource server plus an index into the accepts array selecting which payment option to sign. The paymentRequired envelope's x402Version, resource, and extensions are carried through into the signed payment payload; only the selected accept entry becomes paymentPayload.accepted.
+ Returns a signed payment payload that can be base64-encoded and sent in the PAYMENT-SIGNATURE header of the resource request.
+ If acceptsIndex is out of range for paymentRequired.accepts, or the selected accept is not a Solana network payment option, the request fails with 422.
+ * @summary Sign x402 payment via end user Solana account
+ */
+export declare const signSolanaX402PaymentWithEndUserAccount: (userId: string, signSolanaX402PaymentWithEndUserAccountBody: SignSolanaX402PaymentWithEndUserAccountBody, params?: SignSolanaX402PaymentWithEndUserAccountParams, options?: SecondParameter<typeof cdpApiClient<SignSolanaX402PaymentWithEndUserAccount200>>) => Promise<SignSolanaX402PaymentWithEndUserAccount200>;
+
+export declare type SignSolanaX402PaymentWithEndUserAccount200 = {
+    /** The signed x402 payment payload. Base64-encode this and send it in the PAYMENT-SIGNATURE header of the resource request. */
+    paymentPayload: X402PaymentPayload;
+};
+
+export declare type SignSolanaX402PaymentWithEndUserAccountBody = {
+    /** The complete x402 payment required response body from the resource server. Top-level fields (x402Version, resource, error, extensions) are preserved in the signed payment payload; acceptsIndex selects which entry from accepts is signed as paymentPayload.accepted. */
+    paymentRequired: X402PaymentRequired;
+    /**
+     * Zero-based index into paymentRequired.accepts selecting which payment option to sign. Must be less than the length of accepts. The entry at this index must be a Solana network payment option for this endpoint.
+     * @minimum 0
+     */
+    acceptsIndex: number;
+    /**
+     * The base58 encoded address of the end user's Solana account to sign with.
+     * @pattern ^[1-9A-HJ-NP-Za-km-z]{32,44}$
+     */
+    address: string;
+    /**
+     * Required when not using delegated signing. The ID of the Temporary Wallet Secret that was used to sign the X-Wallet-Auth Header.
+     * @pattern ^[a-zA-Z0-9-]{1,100}$
+     */
+    walletSecretId?: string;
+};
+
+export declare type SignSolanaX402PaymentWithEndUserAccountParams = {
+    /**
+     * The ID of the CDP Project. Required for end users authenticated using custom auth (i.e. a non-CDP JWT provider).
+     * @pattern ^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$
+     */
+    projectID?: ProjectIDOptionalParameter;
+};
+
+export declare type SignSolanaX402PaymentWithEndUserAccountResult = NonNullable<Awaited<ReturnType<typeof signSolanaX402PaymentWithEndUserAccount>>>;
+
 /**
  * Information about an end user who authenticates using Sign In With Ethereum (EIP-4361).
  */
@@ -3601,11 +4034,23 @@ export declare interface SpendPermissionResponseObject {
     network: SpendPermissionNetwork;
 }
 
+/**
+ * Submit a 6-digit MFA code for a TOTP or SMS method.
+ */
+export declare interface SubmitMfaCode {
+    /**
+     * The 6-digit MFA code from the authenticator app or SMS.
+     * @pattern ^\d{6}$
+     */
+    mfaCode: string;
+}
+
 /**
  * Submits an MFA code to complete the enrollment process. On success, the MFA configuration is persisted to the end user.
+ For passkey, the request must carry the same `Origin` header the enrollment was initiated from — the ceremony is bound to that exact origin (scheme, host, and port). A missing, disallowed, or differing `Origin` restarts the ceremony rather than silently changing the Relying Party ID.
  * @summary Submit MFA enrollment
  */
-export declare const submitMfaEnrollment: (userId: string, mfaMethod: "totp" | "sms", submitMfaEnrollmentBody: SubmitMfaEnrollmentBody, params?: SubmitMfaEnrollmentParams, options?: SecondParameter<typeof cdpApiClient<SubmitMfaEnrollment200>>) => Promise<SubmitMfaEnrollment200>;
+export declare const submitMfaEnrollment: (userId: string, mfaMethod: "totp" | "sms" | "passkey", submitMfaEnrollmentRequest: SubmitMfaEnrollmentRequest, params?: SubmitMfaEnrollmentParams, options?: SecondParameter<typeof cdpApiClient<SubmitMfaEnrollment200>>) => Promise<SubmitMfaEnrollment200>;
 
 /**
  * Response after successful MFA enrollment with updated end user.
@@ -3614,17 +4059,6 @@ export declare type SubmitMfaEnrollment200 = {
     endUser: EndUser;
 };
 
-/**
- * Request to submit MFA code and complete enrollment.
- */
-export declare type SubmitMfaEnrollmentBody = {
-    /**
-     * The 6-digit MFA code from the authenticator app.
-     * @pattern ^\d{6}$
-     */
-    mfaCode: string;
-};
-
 export declare type SubmitMfaEnrollmentParams = {
     /**
      * The ID of the CDP Project. Required for end users authenticated using custom auth (i.e. a non-CDP JWT provider).
@@ -3633,24 +4067,19 @@ export declare type SubmitMfaEnrollmentParams = {
     projectID?: ProjectIDOptionalParameter;
 };
 
+/**
+ * Request body to complete MFA enrollment. For TOTP and SMS, submit the 6-digit code. For passkey, submit the WebAuthn attestation credential returned by navigator.credentials.create().
+ */
+export declare type SubmitMfaEnrollmentRequest = SubmitMfaCode | SubmitPasskeyRegistration;
+
 export declare type SubmitMfaEnrollmentResult = NonNullable<Awaited<ReturnType<typeof submitMfaEnrollment>>>;
 
 /**
  * Submits an MFA code to complete the verification process.
+ For passkey, the request must carry the same `Origin` header the verification was initiated from — the ceremony is bound to that exact origin (scheme, host, and port). A missing, disallowed, or differing `Origin` restarts the ceremony rather than silently changing the Relying Party ID.
  * @summary Submit MFA verification
  */
-export declare const submitMfaVerification: (userId: string, mfaMethod: "totp" | "sms", submitMfaVerificationBody: SubmitMfaVerificationBody, params?: SubmitMfaVerificationParams, options?: SecondParameter<typeof cdpApiClient<void>>) => Promise<void>;
-
-/**
- * Request to submit MFA code for verification.
- */
-export declare type SubmitMfaVerificationBody = {
-    /**
-     * The 6-digit MFA code from the authenticator app.
-     * @pattern ^\d{6}$
-     */
-    mfaCode: string;
-};
+export declare const submitMfaVerification: (userId: string, mfaMethod: "totp" | "sms" | "passkey", submitMfaVerificationRequest: SubmitMfaVerificationRequest, params?: SubmitMfaVerificationParams, options?: SecondParameter<typeof cdpApiClient<void>>) => Promise<void>;
 
 export declare type SubmitMfaVerificationParams = {
     /**
@@ -3660,14 +4089,76 @@ export declare type SubmitMfaVerificationParams = {
     projectID?: ProjectIDOptionalParameter;
 };
 
+/**
+ * Request body to complete MFA verification. For TOTP and SMS, submit the 6-digit code. For passkey, submit the WebAuthn assertion credential returned by navigator.credentials.get().
+ */
+export declare type SubmitMfaVerificationRequest = SubmitMfaCode | SubmitPasskeyVerification;
+
 export declare type SubmitMfaVerificationResult = NonNullable<Awaited<ReturnType<typeof submitMfaVerification>>>;
 
 /**
- * Information about an end user who authenticates using Telegram.
+ * Submit a WebAuthn attestation credential to complete passkey enrollment. The `credential` object is the result of navigator.credentials.create(), serialized to JSON, and is parsed opaquely by the WebAuthn server.
  */
-export declare interface TelegramAuthentication {
-    type: OAuth2ProviderType;
-    /** The Telegram ID for the end user. */
+export declare interface SubmitPasskeyRegistration {
+    /** The type of MFA method. */
+    type: SubmitPasskeyRegistrationType;
+    /** The WebAuthn registration credential (PublicKeyCredential with an AuthenticatorAttestationResponse), serialized to JSON. Passed opaquely to the WebAuthn server for verification. */
+    credential: SubmitPasskeyRegistrationCredential;
+    /**
+     * An optional human-friendly name for the passkey (e.g. the device or browser), shown when listing enrolled passkeys.
+     * @maxLength 100
+     */
+    name?: string;
+}
+
+/**
+ * The WebAuthn registration credential (PublicKeyCredential with an AuthenticatorAttestationResponse), serialized to JSON. Passed opaquely to the WebAuthn server for verification.
+ */
+export declare type SubmitPasskeyRegistrationCredential = {
+    [key: string]: unknown;
+};
+
+/**
+ * The type of MFA method.
+ */
+export declare type SubmitPasskeyRegistrationType = (typeof SubmitPasskeyRegistrationType)[keyof typeof SubmitPasskeyRegistrationType];
+
+export declare const SubmitPasskeyRegistrationType: {
+    readonly passkey: "passkey";
+};
+
+/**
+ * Submit a WebAuthn assertion credential to complete passkey verification. The `credential` object is the result of navigator.credentials.get(), serialized to JSON, and is parsed opaquely by the WebAuthn server.
+ */
+export declare interface SubmitPasskeyVerification {
+    /** The type of MFA method. */
+    type: SubmitPasskeyVerificationType;
+    /** The WebAuthn assertion credential (PublicKeyCredential with an AuthenticatorAssertionResponse), serialized to JSON. Passed opaquely to the WebAuthn server for verification. */
+    credential: SubmitPasskeyVerificationCredential;
+}
+
+/**
+ * The WebAuthn assertion credential (PublicKeyCredential with an AuthenticatorAssertionResponse), serialized to JSON. Passed opaquely to the WebAuthn server for verification.
+ */
+export declare type SubmitPasskeyVerificationCredential = {
+    [key: string]: unknown;
+};
+
+/**
+ * The type of MFA method.
+ */
+export declare type SubmitPasskeyVerificationType = (typeof SubmitPasskeyVerificationType)[keyof typeof SubmitPasskeyVerificationType];
+
+export declare const SubmitPasskeyVerificationType: {
+    readonly passkey: "passkey";
+};
+
+/**
+ * Information about an end user who authenticates using Telegram.
+ */
+export declare interface TelegramAuthentication {
+    type: OAuth2ProviderType;
+    /** The Telegram ID for the end user. */
     id: number;
     /** The Telegram user's first name. */
     firstName?: string;
@@ -3973,6 +4464,703 @@ export declare interface VerifySmsAuthenticationRequest {
 
 export declare type VerifySmsAuthenticationResult = NonNullable<Awaited<ReturnType<typeof verifySmsAuthentication>>>;
 
+/**
+ * Immutable configuration for an x402 batch-settlement payment channel. The EIP-712 hash of this struct produces the `channelId` used by all batch-settlement payloads.
+ */
+export declare interface X402BatchSettlementChannelConfig {
+    /**
+     * The 0x-prefixed, checksum EVM address of the payer (channel funder).
+     * @pattern ^0x[0-9a-fA-F]{40}$
+     */
+    payer: string;
+    /**
+     * The 0x-prefixed, checksum EVM address authorized to sign vouchers on behalf of the payer.
+     * @pattern ^0x[0-9a-fA-F]{40}$
+     */
+    payerAuthorizer: string;
+    /**
+     * The 0x-prefixed, checksum EVM address of the receiver (resource server / merchant).
+     * @pattern ^0x[0-9a-fA-F]{40}$
+     */
+    receiver: string;
+    /**
+     * The 0x-prefixed, checksum EVM address authorized to sign claim batches on behalf of the receiver (typically the facilitator).
+     * @pattern ^0x[0-9a-fA-F]{40}$
+     */
+    receiverAuthorizer: string;
+    /**
+     * The 0x-prefixed, checksum EVM address of the ERC-20 payment token.
+     * @pattern ^0x[0-9a-fA-F]{40}$
+     */
+    token: string;
+    /**
+     * The non-cooperative withdraw delay in seconds. Must be between 900 (15 minutes) and 2,592,000 (30 days).
+     * @minimum 900
+     * @maximum 2592000
+     */
+    withdrawDelay: number;
+    /**
+     * A 32-byte salt used to differentiate channels between the same payer/receiver pair.
+     * @pattern ^0x[0-9a-fA-F]{64}$
+     */
+    salt: string;
+}
+
+/**
+ * A single voucher claim within a batched on-chain claim transaction. Used by `x402BatchSettlementClaimPayload.claims` and by the server-enriched shape of `x402BatchSettlementRefundPayload.claims`.
+ NOTE: the nested `voucher` here has a **different shape** from the top-level `x402BatchSettlementVoucher` schema. The top-level voucher is the signed cumulative-ceiling message sent by a client (`{channelId, maxClaimableAmount, signature}`). This nested `voucher` mirrors the on-chain claim struct (`{channel: ChannelConfig, maxClaimableAmount}`) that participates in the EIP-712 hash, with `signature` and `totalClaimed` as siblings rather than nested fields. The field names match the upstream x402 protocol and the on-chain Solidity struct; they cannot be renamed without breaking wire and EIP-712 compatibility.
+ */
+export declare interface X402BatchSettlementClaim {
+    /** The voucher to claim, identified by the channel config it was signed against and its cumulative ceiling. Field shape mirrors the on-chain claim struct. */
+    voucher: X402BatchSettlementClaimVoucher;
+    /**
+     * The voucher signature from `payerAuthorizer`.
+     * @pattern ^0x[0-9a-fA-F]+$
+     */
+    signature: string;
+    /**
+     * The cumulative amount already claimed from this channel as of this claim.
+     * @pattern ^[0-9]+$
+     */
+    totalClaimed: string;
+}
+
+/**
+ * Server-to-facilitator request to batch on-chain claims of accumulated vouchers. `claimAuthorizerSignature` is optional; when absent the facilitator auto-signs with its receiver-authorizer key.
+ */
+export declare interface X402BatchSettlementClaimPayload {
+    type: X402BatchSettlementClaimPayloadType;
+    /** The list of voucher claims to batch in a single on-chain `claim` call. */
+    claims: X402BatchSettlementClaim[];
+    /**
+     * Optional EIP-712 signature from the receiver authorizer over the claim batch. When omitted, the facilitator auto-signs.
+     * @pattern ^0x[0-9a-fA-F]+$
+     */
+    claimAuthorizerSignature?: string;
+}
+
+export declare type X402BatchSettlementClaimPayloadType = (typeof X402BatchSettlementClaimPayloadType)[keyof typeof X402BatchSettlementClaimPayloadType];
+
+export declare const X402BatchSettlementClaimPayloadType: {
+    readonly claim: "claim";
+};
+
+/**
+ * The voucher to claim, identified by the channel config it was signed against and its cumulative ceiling. Field shape mirrors the on-chain claim struct.
+ */
+export declare type X402BatchSettlementClaimVoucher = {
+    channel: X402BatchSettlementChannelConfig;
+    /**
+     * The cumulative maximum claimable amount (uint128 as decimal string) signed by the payer authorizer.
+     * @pattern ^[0-9]+$
+     */
+    maxClaimableAmount: string;
+};
+
+/**
+ * Sent on the first request to fund a channel via an ERC-3009 receiveWithAuthorization deposit.
+ */
+export declare interface X402BatchSettlementDepositPayload {
+    type: X402BatchSettlementDepositPayloadType;
+    channelConfig: X402BatchSettlementChannelConfig;
+    voucher: X402BatchSettlementVoucher;
+    /** The deposit amount and asset-transfer authorization that funds the channel. */
+    deposit: X402BatchSettlementDepositPayloadDeposit;
+}
+
+/**
+ * The deposit amount and asset-transfer authorization that funds the channel.
+ */
+export declare type X402BatchSettlementDepositPayloadDeposit = {
+    /**
+     * The deposit amount in atomic units of `channelConfig.token`.
+     * @pattern ^[0-9]+$
+     */
+    amount: string;
+    /** The asset-transfer authorization for the deposit. Currently only ERC-3009 is supported. */
+    authorization: X402BatchSettlementDepositPayloadDepositAuthorization;
+};
+
+/**
+ * The asset-transfer authorization for the deposit. Currently only ERC-3009 is supported.
+ */
+export declare type X402BatchSettlementDepositPayloadDepositAuthorization = {
+    /** An ERC-3009 receiveWithAuthorization message authorizing the channel-funding transfer. */
+    erc3009Authorization?: X402BatchSettlementDepositPayloadDepositAuthorizationErc3009Authorization;
+};
+
+/**
+ * An ERC-3009 receiveWithAuthorization message authorizing the channel-funding transfer.
+ */
+export declare type X402BatchSettlementDepositPayloadDepositAuthorizationErc3009Authorization = {
+    /** The unix timestamp after which the authorization is valid. */
+    validAfter: string;
+    /** The unix timestamp before which the authorization is valid. */
+    validBefore: string;
+    /**
+     * The 32-byte ERC-3009 nonce/salt for replay protection.
+     * @pattern ^0x[0-9a-fA-F]{64}$
+     */
+    salt: string;
+    /**
+     * The EIP-712 hex-encoded signature of the ERC-3009 authorization.
+     * @pattern ^0x[0-9a-fA-F]+$
+     */
+    signature: string;
+};
+
+export declare type X402BatchSettlementDepositPayloadType = (typeof X402BatchSettlementDepositPayloadType)[keyof typeof X402BatchSettlementDepositPayloadType];
+
+export declare const X402BatchSettlementDepositPayloadType: {
+    readonly deposit: "deposit";
+};
+
+/**
+ * The x402 protocol batch-settlement scheme payload for EVM networks. The `batch-settlement` scheme uses pre-funded payment channels with off-chain cumulative-ceiling vouchers, allowing servers to batch-claim accumulated value in a single on-chain transaction. The payload is a discriminated union on the `type` field with five variants:
+
+ - `deposit`: client-initiated channel funding via ERC-3009.
+ - `voucher`: client-side cumulative voucher against an already-funded channel.
+ - `refund`: cooperative refund request. The client emits a minimal shape (just channelConfig + voucher, with an optional `amount`); a mediating server enriches it with `amount`, `refundNonce`, and `claims` before forwarding to the facilitator. Authorizer signatures are optional — the facilitator auto-signs when absent.
+ - `claim`: server-to-facilitator request to batch on-chain voucher claims.
+ - `settle`: server-to-facilitator request to transfer claimed funds to the receiver.
+
+ For more details, see [batch-settlement specs](https://github.com/x402-foundation/x402/tree/main/specs/schemes/batch-settlement).
+ */
+export declare type X402BatchSettlementEvmPayload = X402BatchSettlementDepositPayload | X402BatchSettlementVoucherPayload | X402BatchSettlementRefundPayload | X402BatchSettlementClaimPayload | X402BatchSettlementSettlePayload;
+
+/**
+ * A cooperative refund request. The client emits the minimal shape (just `channelConfig` and `voucher`, with an optional `amount`). A mediating server enriches the payload with `amount`, `refundNonce`, and `claims` before forwarding to the facilitator. Authorizer signatures are optional — the facilitator auto-signs when absent. Field presence determines which shape was sent; the facilitator dispatches accordingly.
+ */
+export declare interface X402BatchSettlementRefundPayload {
+    type: X402BatchSettlementRefundPayloadType;
+    channelConfig: X402BatchSettlementChannelConfig;
+    voucher: X402BatchSettlementVoucher;
+    /**
+     * The refund amount in atomic units of `channelConfig.token`. Optional in the client-emitted shape (defaults to the full remaining channel balance). Required when the payload is enriched by a mediating server.
+     * @pattern ^[0-9]+$
+     */
+    amount?: string;
+    /**
+     * The on-chain refund nonce for replay protection (uint256 as decimal string). Only present on the server-enriched shape.
+     * @pattern ^[0-9]+$
+     */
+    refundNonce?: string;
+    /** Voucher claims to include atomically with the refund. Only present on the server-enriched shape. */
+    claims?: X402BatchSettlementClaim[];
+    /**
+     * Optional EIP-712 signature from the receiver authorizer over the refund. When omitted, the facilitator auto-signs.
+     * @pattern ^0x[0-9a-fA-F]+$
+     */
+    refundAuthorizerSignature?: string;
+    /**
+     * Optional EIP-712 signature from the receiver authorizer over the included claims. When omitted, the facilitator auto-signs.
+     * @pattern ^0x[0-9a-fA-F]+$
+     */
+    claimAuthorizerSignature?: string;
+}
+
+export declare type X402BatchSettlementRefundPayloadType = (typeof X402BatchSettlementRefundPayloadType)[keyof typeof X402BatchSettlementRefundPayloadType];
+
+export declare const X402BatchSettlementRefundPayloadType: {
+    readonly refund: "refund";
+};
+
+/**
+ * Server-to-facilitator request to transfer claimed funds for a `(receiver, token)` pair to the receiver wallet.
+ */
+export declare interface X402BatchSettlementSettlePayload {
+    type: X402BatchSettlementSettlePayloadType;
+    /**
+     * The 0x-prefixed, checksum EVM address of the receiver to settle to.
+     * @pattern ^0x[0-9a-fA-F]{40}$
+     */
+    receiver: string;
+    /**
+     * The 0x-prefixed, checksum EVM address of the token to settle.
+     * @pattern ^0x[0-9a-fA-F]{40}$
+     */
+    token: string;
+}
+
+export declare type X402BatchSettlementSettlePayloadType = (typeof X402BatchSettlementSettlePayloadType)[keyof typeof X402BatchSettlementSettlePayloadType];
+
+export declare const X402BatchSettlementSettlePayloadType: {
+    readonly settle: "settle";
+};
+
+/**
+ * A signed cumulative-ceiling voucher for an x402 batch-settlement channel. `maxClaimableAmount` is monotonically increasing across requests in the same channel; the receiver may claim any amount up to this ceiling.
+ */
+export declare interface X402BatchSettlementVoucher {
+    /**
+     * The 32-byte EIP-712 hash of the `channelConfig` for this voucher's channel.
+     * @pattern ^0x[0-9a-fA-F]{64}$
+     */
+    channelId: string;
+    /**
+     * The cumulative maximum amount (uint128 as decimal string) the receiver is authorized to claim from this channel as of this voucher.
+     * @pattern ^[0-9]+$
+     */
+    maxClaimableAmount: string;
+    /**
+     * The EIP-712 hex-encoded signature of the voucher by `payerAuthorizer`.
+     * @pattern ^0x[0-9a-fA-F]+$
+     */
+    signature: string;
+}
+
+/**
+ * Sent on subsequent requests against an already-funded channel; carries only the latest cumulative voucher.
+ */
+export declare interface X402BatchSettlementVoucherPayload {
+    type: X402BatchSettlementVoucherPayloadType;
+    channelConfig: X402BatchSettlementChannelConfig;
+    voucher: X402BatchSettlementVoucher;
+}
+
+export declare type X402BatchSettlementVoucherPayloadType = (typeof X402BatchSettlementVoucherPayloadType)[keyof typeof X402BatchSettlementVoucherPayloadType];
+
+export declare const X402BatchSettlementVoucherPayloadType: {
+    readonly voucher: "voucher";
+};
+
+/**
+ * The x402 protocol exact scheme payload for EVM networks. The scheme is implemented using ERC-3009. For more details, please see [EVM Exact Scheme Details](https://github.com/coinbase/x402/blob/main/specs/schemes/exact/scheme_exact_evm.md).
+ */
+export declare interface X402ExactEvmPayload {
+    /**
+     * The EIP-712 hex-encoded signature of the ERC-3009 authorization message. Smart account signatures may be longer than 65 bytes.
+     * @pattern ^0x[0-9a-fA-F]{130,}$
+     */
+    signature: string;
+    /** The authorization data for the ERC-3009 authorization message. */
+    authorization: X402ExactEvmPayloadAuthorization;
+}
+
+/**
+ * The authorization data for the ERC-3009 authorization message.
+ */
+export declare type X402ExactEvmPayloadAuthorization = {
+    /**
+     * The 0x-prefixed, checksum EVM address of the sender of the payment.
+     * @pattern ^0x[0-9a-fA-F]{40}$
+     */
+    from: string;
+    /**
+     * The 0x-prefixed, checksum EVM address of the recipient of the payment.
+     * @pattern ^0x[0-9a-fA-F]{40}$
+     */
+    to: string;
+    /** The value of the payment, in atomic units of the payment asset. */
+    value: string;
+    /** The unix timestamp after which the payment is valid. */
+    validAfter: string;
+    /** The unix timestamp before which the payment is valid. */
+    validBefore: string;
+    /**
+     * The hex-encoded nonce of the payment (bytes32).
+     * @pattern ^0x[0-9a-fA-F]{64}$
+     */
+    nonce: string;
+};
+
+/**
+ * The x402 protocol exact scheme payload for EVM networks using Permit2. Permit2 is a universal token approval mechanism that works with any ERC-20 token, unlike ERC-3009 which requires token-level support.
+ */
+export declare interface X402ExactEvmPermit2Payload {
+    /**
+     * The EIP-712 hex-encoded signature of the Permit2 PermitWitnessTransferFrom message. Smart account signatures may be longer than 65 bytes.
+     * @pattern ^0x[0-9a-fA-F]{130,}$
+     */
+    signature: string;
+    /** The authorization data for the Permit2 PermitWitnessTransferFrom message. */
+    permit2Authorization: X402ExactEvmPermit2PayloadPermit2Authorization;
+}
+
+/**
+ * The authorization data for the Permit2 PermitWitnessTransferFrom message.
+ */
+export declare type X402ExactEvmPermit2PayloadPermit2Authorization = {
+    /**
+     * The 0x-prefixed, checksum EVM address of the sender of the payment.
+     * @pattern ^0x[0-9a-fA-F]{40}$
+     */
+    from: string;
+    /** The token permissions for the transfer. */
+    permitted: X402ExactEvmPermit2PayloadPermit2AuthorizationPermitted;
+    /**
+     * The 0x-prefixed, checksum EVM address of the spender (x402 Permit2 proxy contract).
+     * @pattern ^0x[0-9a-fA-F]{40}$
+     */
+    spender: string;
+    /**
+     * The Permit2 nonce as a decimal string (uint256).
+     * @pattern ^[0-9]+$
+     */
+    nonce: string;
+    /** The unix timestamp before which the permit is valid. */
+    deadline: string;
+    /** The witness data containing payment details. */
+    witness: X402ExactEvmPermit2PayloadPermit2AuthorizationWitness;
+};
+
+/**
+ * The token permissions for the transfer.
+ */
+export declare type X402ExactEvmPermit2PayloadPermit2AuthorizationPermitted = {
+    /**
+     * The 0x-prefixed, checksum EVM address of the token to transfer.
+     * @pattern ^0x[0-9a-fA-F]{40}$
+     */
+    token: string;
+    /** The amount to transfer in atomic units. */
+    amount: string;
+};
+
+/**
+ * The witness data containing payment details.
+ */
+export declare type X402ExactEvmPermit2PayloadPermit2AuthorizationWitness = {
+    /**
+     * The 0x-prefixed, checksum EVM address of the recipient.
+     * @pattern ^0x[0-9a-fA-F]{40}$
+     */
+    to: string;
+    /** The unix timestamp after which the payment is valid. */
+    validAfter: string;
+    /**
+     * Optional hex-encoded extra data.
+     * @pattern ^0x[0-9a-fA-F]*$
+     */
+    extra?: string;
+};
+
+/**
+ * The x402 protocol exact scheme payload for Solana networks. For more details, please see [Solana Exact Scheme Details](https://github.com/coinbase/x402/blob/main/specs/schemes/exact/scheme_exact_svm.md).
+ */
+export declare interface X402ExactSolanaPayload {
+    /** The base64-encoded Solana transaction. */
+    transaction: string;
+}
+
+/**
+ * The x402 protocol payment payload that the client attaches to x402-paid API requests to the resource server in the PAYMENT-SIGNATURE header.
+ For EVM networks, smart account signatures can be longer than 65 bytes.
+ */
+export declare type X402PaymentPayload = X402V2PaymentPayload | X402V1PaymentPayload;
+
+/**
+ * The x402 protocol payment required response body, returned by a resource server when a request lacks valid payment. Contains the accepted payment options, optional resource metadata, and an optional error message from the resource server.
+ */
+export declare interface X402PaymentRequired {
+    /** The x402 protocol version. */
+    x402Version: X402Version;
+    /**
+     * The list of payment options the resource server accepts. At least one option must be present.
+     * @minItems 1
+     * @maxItems 16
+     */
+    accepts: X402PaymentRequirements[];
+    /** Optional metadata about the resource being paid for. */
+    resource?: X402ResourceInfo;
+    /** An optional error message from the resource server describing why payment is required. */
+    error?: string;
+    /** Optional protocol extensions. Unknown keys are forwarded as-is into the signed payment payload. */
+    extensions?: X402PaymentRequiredExtensions;
+}
+
+/**
+ * Optional protocol extensions. Unknown keys are forwarded as-is into the signed payment payload.
+ */
+export declare type X402PaymentRequiredExtensions = {
+    [key: string]: unknown;
+};
+
+/**
+ * The x402 protocol payment requirements that the resource server expects the client's payment payload to meet.
+ */
+export declare type X402PaymentRequirements = X402V2PaymentRequirements | X402V1PaymentRequirements;
+
+/**
+ * Describes the resource being accessed in x402 protocol.
+ */
+export declare interface X402ResourceInfo {
+    /** The URL of the resource. */
+    url?: string;
+    /** A human-readable description of the resource. */
+    description?: Description;
+    /** The MIME type of the resource response. */
+    mimeType?: string;
+}
+
+/**
+ * The x402 protocol upto scheme payload for EVM networks using Permit2. The `upto` scheme authorizes a maximum amount and lets the facilitator settle for the actual amount used. Structurally identical to `x402ExactEvmPermit2Payload` except `permit2Authorization.witness` carries an additional `facilitator` address that binds the authorization to a specific facilitator (the one announced via `extra.facilitatorAddress` in the payment requirements). For more details, see [EVM Upto Scheme Details](https://github.com/x402-foundation/x402/blob/main/specs/schemes/upto/scheme_upto_evm.md).
+ */
+export declare interface X402UptoEvmPermit2Payload {
+    /**
+     * The EIP-712 hex-encoded signature of the Permit2 PermitWitnessTransferFrom message. Smart account signatures may be longer than 65 bytes.
+     * @pattern ^0x[0-9a-fA-F]{130,}$
+     */
+    signature: string;
+    /** The authorization data for the Permit2 PermitWitnessTransferFrom message. The `permitted.amount` is the maximum the client authorizes; the actual settled amount is decided by the resource server at settle time and MUST be less than or equal to it. */
+    permit2Authorization: X402UptoEvmPermit2PayloadPermit2Authorization;
+}
+
+/**
+ * The authorization data for the Permit2 PermitWitnessTransferFrom message. The `permitted.amount` is the maximum the client authorizes; the actual settled amount is decided by the resource server at settle time and MUST be less than or equal to it.
+ */
+export declare type X402UptoEvmPermit2PayloadPermit2Authorization = {
+    /**
+     * The 0x-prefixed, checksum EVM address of the sender of the payment.
+     * @pattern ^0x[0-9a-fA-F]{40}$
+     */
+    from: string;
+    /** The token permissions for the transfer. */
+    permitted: X402UptoEvmPermit2PayloadPermit2AuthorizationPermitted;
+    /**
+     * The 0x-prefixed, checksum EVM address of the spender (the x402 Upto Permit2 proxy contract).
+     * @pattern ^0x[0-9a-fA-F]{40}$
+     */
+    spender: string;
+    /**
+     * The Permit2 nonce as a decimal string (uint256).
+     * @pattern ^[0-9]+$
+     */
+    nonce: string;
+    /** The unix timestamp before which the permit is valid. */
+    deadline: string;
+    /** The witness data containing payment details. Includes a `facilitator` field to bind the authorization to a specific facilitator address. */
+    witness: X402UptoEvmPermit2PayloadPermit2AuthorizationWitness;
+};
+
+/**
+ * The token permissions for the transfer.
+ */
+export declare type X402UptoEvmPermit2PayloadPermit2AuthorizationPermitted = {
+    /**
+     * The 0x-prefixed, checksum EVM address of the token to transfer.
+     * @pattern ^0x[0-9a-fA-F]{40}$
+     */
+    token: string;
+    /** The maximum amount the client authorizes to transfer in atomic units. */
+    amount: string;
+};
+
+/**
+ * The witness data containing payment details. Includes a `facilitator` field to bind the authorization to a specific facilitator address.
+ */
+export declare type X402UptoEvmPermit2PayloadPermit2AuthorizationWitness = {
+    /**
+     * The 0x-prefixed, checksum EVM address of the recipient.
+     * @pattern ^0x[0-9a-fA-F]{40}$
+     */
+    to: string;
+    /**
+     * The 0x-prefixed, checksum EVM address of the facilitator authorized to settle this payment. MUST match the `facilitatorAddress` advertised in the payment requirements `extra` field.
+     * @pattern ^0x[0-9a-fA-F]{40}$
+     */
+    facilitator: string;
+    /** The unix timestamp after which the payment is valid. */
+    validAfter: string;
+};
+
+/**
+ * The x402 v1 network identifier. x402 v1 uses human-readable network names. Supported networks: Base mainnet and testnet, Solana mainnet and devnet.
+ */
+export declare type X402V1Network = (typeof X402V1Network)[keyof typeof X402V1Network];
+
+export declare const X402V1Network: {
+    readonly base: "base";
+    readonly "base-sepolia": "base-sepolia";
+    readonly solana: "solana";
+    readonly "solana-devnet": "solana-devnet";
+};
+
+/**
+ * The x402 v1 protocol payment payload. Uses human-readable network names and requires `scheme` and `network` alongside the inner `payload` object.
+ */
+export declare interface X402V1PaymentPayload {
+    /** The x402 protocol version. Must be `1` for this payload shape. */
+    x402Version: X402Version;
+    /** The scheme of the payment protocol to use. Currently, the only supported scheme is `exact`. */
+    scheme: X402V1PaymentPayloadScheme;
+    /** The network of the blockchain to send payment on. */
+    network: X402V1Network;
+    /** The payload of the payment depending on the x402Version, scheme, and network. */
+    payload: X402V1PaymentPayloadPayload;
+}
+
+/**
+ * The payload of the payment depending on the x402Version, scheme, and network.
+ */
+export declare type X402V1PaymentPayloadPayload = X402ExactEvmPayload | X402ExactEvmPermit2Payload | X402ExactSolanaPayload;
+
+/**
+ * The scheme of the payment protocol to use. Currently, the only supported scheme is `exact`.
+ */
+export declare type X402V1PaymentPayloadScheme = (typeof X402V1PaymentPayloadScheme)[keyof typeof X402V1PaymentPayloadScheme];
+
+export declare const X402V1PaymentPayloadScheme: {
+    readonly exact: "exact";
+};
+
+/**
+ * The x402 v1 payment requirements. Uses human-readable network names, and carries resource metadata (`resource`, `description`, `mimeType`) alongside the payment fields. The only supported scheme is `exact`.
+ */
+export declare interface X402V1PaymentRequirements {
+    /** The scheme of the payment protocol to use. Currently, the only supported scheme is `exact`. */
+    scheme: X402V1PaymentRequirementsScheme;
+    /** The network of the blockchain to send payment on. */
+    network: X402V1Network;
+    /** The maximum amount required to pay for the resource in atomic units of the payment asset. */
+    maxAmountRequired: string;
+    /** The URL of the resource to pay for. */
+    resource: string;
+    /** A human-readable description of the resource. */
+    description: Description;
+    /** The MIME type of the resource response. */
+    mimeType: string;
+    /** The optional JSON schema describing the resource output. */
+    outputSchema?: X402V1PaymentRequirementsOutputSchema;
+    /** The destination to pay value to.
+
+     For EVM networks, payTo will be a 0x-prefixed, checksum EVM address.
+
+     For Solana-based networks, payTo will be a base58-encoded Solana address. */
+    payTo: BlockchainAddress;
+    /** The maximum time in seconds for the resource server to respond. */
+    maxTimeoutSeconds: number;
+    /** The asset to pay with.
+
+     For EVM networks, the asset will be a 0x-prefixed, checksum EVM address.
+
+     For Solana-based networks, the asset will be a base58-encoded Solana address. */
+    asset: BlockchainAddress;
+    /** The optional additional scheme-specific payment info. */
+    extra?: X402V1PaymentRequirementsExtra;
+}
+
+/**
+ * The optional additional scheme-specific payment info.
+ */
+export declare type X402V1PaymentRequirementsExtra = {
+    [key: string]: unknown;
+};
+
+/**
+ * The optional JSON schema describing the resource output.
+ */
+export declare type X402V1PaymentRequirementsOutputSchema = {
+    [key: string]: unknown;
+};
+
+/**
+ * The scheme of the payment protocol to use. Currently, the only supported scheme is `exact`.
+ */
+export declare type X402V1PaymentRequirementsScheme = (typeof X402V1PaymentRequirementsScheme)[keyof typeof X402V1PaymentRequirementsScheme];
+
+export declare const X402V1PaymentRequirementsScheme: {
+    readonly exact: "exact";
+};
+
+/**
+ * The x402 v2 network identifier in CAIP-2 format. x402 v2 identifies networks by their CAIP-2 chain ID (e.g. `eip155:<chainId>` for EVM networks, `solana:<genesisHash>` for Solana). Supported networks: Base, Polygon, Arbitrum One, World Chain (EVM), and Solana.
+ */
+export declare type X402V2Network = (typeof X402V2Network)[keyof typeof X402V2Network];
+
+export declare const X402V2Network: {
+    readonly "eip155:8453": "eip155:8453";
+    readonly "eip155:84532": "eip155:84532";
+    readonly "eip155:137": "eip155:137";
+    readonly "eip155:42161": "eip155:42161";
+    readonly "eip155:480": "eip155:480";
+    readonly "eip155:4801": "eip155:4801";
+    readonly "solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp": "solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp";
+    readonly "solana:EtWTRABZaYq6iMfeYKouRu166VU2xqa1": "solana:EtWTRABZaYq6iMfeYKouRu166VU2xqa1";
+};
+
+/**
+ * The x402 v2 protocol payment payload. Uses CAIP-2 network identifiers. The `accepted` field carries the full payment requirements; `scheme` and `network` are not top-level fields (they are on the nested `accepted` object).
+ */
+export declare interface X402V2PaymentPayload {
+    /** The x402 protocol version. Must be `2` for this payload shape. */
+    x402Version: X402Version;
+    /** The payload of the payment depending on the x402Version, scheme, and network. Discriminated by scheme-specific fields: exact-EVM/upto-EVM payloads carry a `signature`; exact-Solana carries a `transaction`; batch-settlement carries a `type` discriminator. See `x402BatchSettlementEvmPayload` for the documented batch-settlement variants. */
+    payload: X402V2PaymentPayloadPayload;
+    accepted: X402V2PaymentRequirements;
+    resource?: X402ResourceInfo;
+    /** Optional protocol extensions. */
+    extensions?: X402V2PaymentPayloadExtensions;
+}
+
+/**
+ * Optional protocol extensions.
+ */
+export declare type X402V2PaymentPayloadExtensions = {
+    [key: string]: unknown;
+};
+
+/**
+ * The payload of the payment depending on the x402Version, scheme, and network. Discriminated by scheme-specific fields: exact-EVM/upto-EVM payloads carry a `signature`; exact-Solana carries a `transaction`; batch-settlement carries a `type` discriminator. See `x402BatchSettlementEvmPayload` for the documented batch-settlement variants.
+ */
+export declare type X402V2PaymentPayloadPayload = X402ExactEvmPayload | X402ExactEvmPermit2Payload | X402ExactSolanaPayload | X402UptoEvmPermit2Payload | X402BatchSettlementEvmPayload;
+
+/**
+ * The x402 v2 payment requirements. Uses CAIP-2 network identifiers and supports `exact`, `upto`, and `batch-settlement` schemes. Carries only the payment fields (no resource metadata — that is in the enclosing `x402V2PaymentPayload.resource`).
+ */
+export declare interface X402V2PaymentRequirements {
+    /** The scheme of the payment protocol to use. Supported schemes are `exact`, `upto`, and `batch-settlement`. */
+    scheme: X402V2PaymentRequirementsScheme;
+    /** The network of the blockchain to send payment on in CAIP-2 format. */
+    network: X402V2Network;
+    /** The asset to pay with.
+
+     For EVM networks, the asset will be a 0x-prefixed, checksum EVM address.
+
+     For Solana-based networks, the asset will be a base58-encoded Solana address. */
+    asset: BlockchainAddress;
+    /** The amount to pay for the resource in atomic units of the payment asset. */
+    amount: string;
+    /** The destination to pay value to.
+
+     For EVM networks, payTo will be a 0x-prefixed, checksum EVM address.
+
+     For Solana-based networks, payTo will be a base58-encoded Solana address. */
+    payTo: BlockchainAddress;
+    /** The maximum time in seconds for the resource server to respond. */
+    maxTimeoutSeconds: number;
+    /** The optional additional scheme-specific payment info. */
+    extra?: X402V2PaymentRequirementsExtra;
+}
+
+/**
+ * The optional additional scheme-specific payment info.
+ */
+export declare type X402V2PaymentRequirementsExtra = {
+    [key: string]: unknown;
+};
+
+/**
+ * The scheme of the payment protocol to use. Supported schemes are `exact`, `upto`, and `batch-settlement`.
+ */
+export declare type X402V2PaymentRequirementsScheme = (typeof X402V2PaymentRequirementsScheme)[keyof typeof X402V2PaymentRequirementsScheme];
+
+export declare const X402V2PaymentRequirementsScheme: {
+    readonly exact: "exact";
+    readonly upto: "upto";
+    readonly "batch-settlement": "batch-settlement";
+};
+
+/**
+ * The version of the x402 protocol.
+ */
+export declare type X402Version = (typeof X402Version)[keyof typeof X402Version];
+
+export declare const X402Version: {
+    readonly NUMBER_1: 1;
+    readonly NUMBER_2: 2;
+};
+
 /**
  * A JWT signed using your Wallet Secret, encoded in base64. Refer to the
  [Generate Wallet Token](https://docs.cdp.coinbase.com/api-reference/v2/authentication#2-generate-wallet-token)