@coinbase/cdp-core 0.0.119 → 0.0.121

package/dist/native/index.native78.js

@@ -2,7 +2,7 @@ import { initiateMfaEnrollment2 as a } from "@coinbase/cdp-api-client";
 import { Analytics as c } from "./index.native2.js";
 import "./index.native3.js";
 import { withAuth as u } from "./index.native99.js";
-import { validateUserAuthState as i } from "./index.native104.js";
+import { validateUserAuthState as i } from "./index.native105.js";
 import { getConfig as o, getCoreAuthManager as p } from "./index.native76.js";
 import { validatePhoneNumber as h } from "./index.native91.js";
 async function l(t, e) {

package/dist/native/index.native79.js

@@ -1,10 +1,10 @@
 import { submitMfaEnrollment as s } from "@coinbase/cdp-api-client";
 import { Analytics as u } from "./index.native2.js";
 import "./index.native3.js";
-import { toAuthStateUser as i } from "./index.native103.js";
+import { toAuthStateUser as i } from "./index.native104.js";
 import { withAuth as f } from "./index.native99.js";
-import { mockUser as c } from "./index.native108.js";
-import { validateUserAuthState as l } from "./index.native104.js";
+import { mockUser as c } from "./index.native109.js";
+import { validateUserAuthState as l } from "./index.native105.js";
 import { getConfig as o, getCoreAuthManager as p } from "./index.native76.js";
 const E = async (e) => {
   if (u.sendActionCallEvent({ name: "submit_mfa_enrollment" }), o().useMock)

package/dist/native/index.native86.js

@@ -1,4 +1,4 @@
-import { createSolanaKeyExportIframe as t, createEvmKeyExportIframe as m } from "./index.native133.js";
+import { createSolanaKeyExportIframe as t, createEvmKeyExportIframe as m } from "./index.native130.js";
 import { signBitcoinHash as i } from "./index.native67.js";
 import "@coinbase/cdp-api-client";
 import "./index.native2.js";

package/dist/native/index.native87.js

@@ -1,42 +1,42 @@
-import { logOutEndUser as f, refreshAccessToken as d, registerTemporaryWalletSecret as S, APIError as m } from "@coinbase/cdp-api-client";
-import { Analytics as h } from "./index.native2.js";
+import { logOutEndUser as f, refreshAccessToken as d, isRefreshTokenUnavailableError as m, isTransientTokenReadError as S, registerTemporaryWalletSecret as w, APIError as y } from "@coinbase/cdp-api-client";
+import { Analytics as i } from "./index.native2.js";
 import "./index.native3.js";
 import "jose";
-import { SignJWT as w } from "./index.native109.js";
-import { toAuthState as y } from "./index.native103.js";
+import { SignJWT as _ } from "./index.native110.js";
+import { toAuthState as k } from "./index.native104.js";
 import "viem";
 import { getPlatformCrypto as c } from "./index.native10.js";
 import { sortKeys as p } from "./index.native100.js";
-import { getCoreOAuthManager as g } from "./index.native76.js";
-const l = 60 * 1e3, k = {
+import { getCoreOAuthManager as T } from "./index.native76.js";
+const l = 60 * 1e3, R = {
   maxRetries: 3,
   baseDelayMs: 1e3,
   maxDelayMs: 1e4
 };
-function T(t, e, s) {
-  const n = e * Math.pow(2, t), i = Math.random() * 0.3 * n;
-  return Math.min(n + i, s);
+function g(s, e, r) {
+  const n = e * Math.pow(2, s), o = Math.random() * 0.3 * n;
+  return Math.min(n + o, r);
 }
-function R(t) {
-  return new Promise((e) => setTimeout(e, t));
+function A(s) {
+  return new Promise((e) => setTimeout(e, s));
 }
-function _(t) {
-  if (t instanceof TypeError && t.message.includes("fetch"))
+function E(s) {
+  if (s instanceof TypeError && s.message.includes("fetch"))
     return !0;
-  if (t instanceof m) {
-    if (t.statusCode >= 500 && t.statusCode < 600 || t.statusCode === 408 || t.statusCode === 429)
+  if (s instanceof y) {
+    if (s.statusCode >= 500 && s.statusCode < 600 || s.statusCode === 408 || s.statusCode === 429)
       return !0;
-    if (t.statusCode === 401)
+    if (s.statusCode === 401)
       return !1;
   }
-  if (t instanceof Error) {
-    const e = t.message.toLowerCase();
+  if (s instanceof Error) {
+    const e = s.message.toLowerCase();
     if (e.includes("network") || e.includes("timeout") || e.includes("econnrefused") || e.includes("enotfound") || e.includes("socket"))
       return !0;
   }
   return !1;
 }
-class v {
+class j {
   projectId;
   authState = null;
   walletSecret = null;
@@ -139,14 +139,14 @@ class v {
     if (!await this.isSignedIn())
       throw new Error("Cannot get X-Wallet-Auth header if the user is not signed in");
     this.shouldRefreshWalletSecret() && await this.refreshWalletSecret();
-    const s = `${e.requestMethod} ${e.requestHost}${e.requestPath}`, n = Math.floor(Date.now() / 1e3), i = c(), r = {
-      uris: [s]
+    const r = `${e.requestMethod} ${e.requestHost}${e.requestPath}`, n = Math.floor(Date.now() / 1e3), o = c(), a = {
+      uris: [r]
     };
     if (e.requestData && Object.keys(e.requestData).length > 0) {
-      const a = p(e.requestData);
-      r.reqHash = await i.hash(new TextEncoder().encode(JSON.stringify(a)));
+      const t = p(e.requestData);
+      a.reqHash = await o.hash(new TextEncoder().encode(JSON.stringify(t)));
     }
-    return await new w(r).setProtectedHeader({ alg: "ES256", typ: "JWT" }).setIssuedAt(n).setNotBefore(n).setJti(i.generateRandomId()).sign(this.walletSecret.keyPair.privateKey);
+    return await new _(a).setProtectedHeader({ alg: "ES256", typ: "JWT" }).setIssuedAt(n).setNotBefore(n).setJti(o.generateRandomId()).sign(this.walletSecret.keyPair.privateKey);
   }
   /**
    * Gets the authentication state.
@@ -162,13 +162,13 @@ class v {
    * @param authState - The authentication state.
    */
   async setAuthState(e) {
-    this.authState = e, h.endUserIdentifier = e.user.userId, this.authStateChangeCallbacks.forEach((s) => s(this.authState?.user ?? null)), this.scheduleTokenRefresh();
+    this.authState = e, i.endUserIdentifier = e.user.userId, this.authStateChangeCallbacks.forEach((r) => r(this.authState?.user ?? null)), this.scheduleTokenRefresh();
   }
   /**
    * Clears the authentication state.
    */
   async clearAuthState() {
-    this.authState = null, this.walletSecret = null, h.endUserIdentifier = "", this.cancelTokenRefresh(), this.authStateChangeCallbacks.forEach((e) => e(null));
+    this.authState = null, this.walletSecret = null, i.endUserIdentifier = "", this.cancelTokenRefresh(), this.authStateChangeCallbacks.forEach((e) => e(null));
   }
   /**
    * Ensures the AuthManager is initialized before proceeding.
@@ -186,7 +186,7 @@ class v {
    */
   async _doInitialize() {
     try {
-      await this.refreshAccessToken("init"), await g().handleOAuthCode();
+      await this.refreshAccessToken("init"), await T().handleOAuthCode();
     } catch (e) {
       console.warn("Failed to refresh access token during initialization:", e);
     }
@@ -210,57 +210,78 @@ class v {
    * @returns The new access token.
    */
   async refreshAccessToken(e = "on_demand") {
-    const { maxRetries: s, baseDelayMs: n, maxDelayMs: i } = k;
-    h.sendSessionRefreshEvent({
+    const { maxRetries: r, baseDelayMs: n, maxDelayMs: o } = R;
+    i.sendSessionRefreshEvent({
       name: "refresh_token_start",
       trigger: e
     });
-    for (let r = 0; r <= s; r++)
+    for (let a = 0; a <= r; a++)
       try {
-        const a = await d(this.projectId, {
+        const t = await d(this.projectId, {
           grantType: "refresh_token"
-        }), o = y(
-          a.accessToken,
-          a.validUntil,
-          a.endUser
+        }), h = k(
+          t.accessToken,
+          t.validUntil,
+          t.endUser
         );
-        await this.setAuthState(o), h.sendSessionRefreshEvent({
+        await this.setAuthState(h), i.sendSessionRefreshEvent({
           name: "refresh_token_success",
           trigger: e,
-          attempt: r
+          attempt: a
         });
         return;
-      } catch (a) {
-        const o = a instanceof Error ? a.message : String(a);
-        if (!_(a)) {
-          h.sendSessionRefreshEvent({
+      } catch (t) {
+        const h = t instanceof Error ? t.message : String(t);
+        if (m(t)) {
+          if (S(t)) {
+            i.sendSessionRefreshEvent({
+              name: "refresh_token_skipped_transient",
+              trigger: e,
+              attempt: a,
+              read_outcome: t.outcome,
+              error_message: h
+            });
+            return;
+          }
+          i.sendSessionRefreshEvent({
             name: "refresh_token_failure",
             trigger: e,
-            attempt: r,
+            attempt: a,
             error_type: "non_transient",
-            error_message: o
+            read_outcome: t.outcome,
+            error_message: h
           }), await this.signOut();
           return;
         }
-        if (r === s) {
-          h.sendSessionRefreshEvent({
+        if (!E(t)) {
+          i.sendSessionRefreshEvent({
+            name: "refresh_token_failure",
+            trigger: e,
+            attempt: a,
+            error_type: "non_transient",
+            error_message: h
+          }), await this.signOut();
+          return;
+        }
+        if (a === r) {
+          i.sendSessionRefreshEvent({
             name: "refresh_token_exhausted",
             trigger: e,
-            attempt: r,
+            attempt: a,
             error_type: "transient",
-            error_message: o
+            error_message: h
           });
           return;
         }
-        h.sendSessionRefreshEvent({
+        i.sendSessionRefreshEvent({
           name: "refresh_token_retry",
           trigger: e,
-          attempt: r,
+          attempt: a,
           error_type: "transient",
-          error_message: o
+          error_message: h
         });
-        const u = T(r, n, i);
-        await R(u);
+        const u = g(a, n, o);
+        await A(u);
       }
   }
   /**
@@ -270,13 +291,13 @@ class v {
   scheduleTokenRefresh() {
     if (this.cancelTokenRefresh(), !this.authState)
       return;
-    const s = this.authState.expiresAt - l - Date.now();
-    s <= 0 || (h.sendSessionRefreshEvent({
+    const r = this.authState.expiresAt - l - Date.now();
+    r <= 0 || (i.sendSessionRefreshEvent({
       name: "refresh_token_scheduled",
-      time_until_refresh_ms: s
+      time_until_refresh_ms: r
     }), this.refreshTimeout = setTimeout(async () => {
       await this.refreshAccessToken("scheduled"), this.scheduleTokenRefresh();
-    }, s));
+    }, r));
   }
   /**
    * Cancels any scheduled token refresh.
@@ -313,23 +334,23 @@ class v {
    * Internal wallet secret refresh logic.
    */
   async _doRefreshWalletSecret() {
-    const e = c(), s = this.walletSecret?.walletSecretId ?? e.generateRandomId(), n = this.walletSecret?.keyPair ?? await e.createKeyPair(), i = this.authState.expiresAt, r = new Date(i).toISOString();
-    this.walletSecret = { walletSecretId: s, keyPair: n, expiresAt: i };
+    const e = c(), r = this.walletSecret?.walletSecretId ?? e.generateRandomId(), n = this.walletSecret?.keyPair ?? await e.createKeyPair(), o = this.authState.expiresAt, a = new Date(o).toISOString();
+    this.walletSecret = { walletSecretId: r, keyPair: n, expiresAt: o };
     try {
-      await S(
+      await w(
         this.authState.user.userId,
         {
-          walletSecretId: s,
+          walletSecretId: r,
           publicKey: n.publicKeyBase64,
-          validUntil: r
+          validUntil: a
         },
         { projectID: this.projectId }
       );
-    } catch (a) {
-      throw this.walletSecret = null, a;
+    } catch (t) {
+      throw this.walletSecret = null, t;
     }
   }
 }
 export {
-  v as AuthManager
+  j as AuthManager
 };

package/dist/native/index.native89.js

@@ -12,9 +12,9 @@ import { signEvmTypedData as y } from "./index.native33.js";
 import "./index.native101.js";
 import "@solana/web3.js";
 import "bs58";
-import { COINBASE_SMART_WALLET_FACTORY_ADDRESS as v, COINBASE_SMART_WALLET_FACTORY_ABI as w } from "./index.native110.js";
-import { signAndWrapTypedDataForSmartAccount as E } from "./index.native111.js";
-import { toAccount as T } from "./index.native112.js";
+import { COINBASE_SMART_WALLET_FACTORY_ADDRESS as v, COINBASE_SMART_WALLET_FACTORY_ABI as w } from "./index.native111.js";
+import { signAndWrapTypedDataForSmartAccount as E } from "./index.native112.js";
+import { toAccount as T } from "./index.native113.js";
 function W(r) {
   const o = l();
   if (!o || !o.evmAccountObjects?.length && !o.evmSmartAccountObjects?.length)

package/dist/native/index.native92.js

@@ -1,11 +1,11 @@
 import { createStore as p } from "zustand";
-import { subscribeWithSelector as c, persist as d, createJSONStorage as h } from "./index.native113.js";
-import { EventEmitter as f } from "./index.native114.js";
-import "./index.native115.js";
+import { subscribeWithSelector as c, persist as d, createJSONStorage as h } from "./index.native114.js";
+import { EventEmitter as f } from "./index.native115.js";
+import "./index.native116.js";
 import "viem";
 import "@coinbase/cdp-api-client";
 import { getPlatformStorage as u } from "./index.native10.js";
-import { createProvider as g } from "./index.native116.js";
+import { createProvider as g } from "./index.native117.js";
 import { onAuthStateChange as l } from "./index.native28.js";
 import "./index.native2.js";
 import "./index.native3.js";

package/dist/native-types/shared/oauthFlowStorage.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Persists the flow ID for an OAuth flow that is about to redirect out of the app
+ * (e.g. to Google/Apple/X), so it can later be validated against the flow ID
+ * returned on the OAuth callback.
+ *
+ * This is the CSRF "state" binding for the OAuth flow: without it, an attacker can
+ * craft a link containing their own `code`/`flow_id` that a victim's browser would
+ * otherwise silently consume (see `consumePendingOAuthFlowId`).
+ *
+ * @param flowId - The flow ID returned by the backend when initiating the OAuth flow.
+ */
+export declare const setPendingOAuthFlowId: (flowId: string) => Promise<void>;
+/**
+ * Reads and clears the persisted pending OAuth flow ID, if any.
+ *
+ * This is a single-use nonce: it is always removed from storage as part of this
+ * call, regardless of whether the caller ultimately treats it as valid. This
+ * prevents a captured/replayed callback URL from being consumed more than once.
+ *
+ * @returns The persisted flow ID, or null if none was persisted (e.g. no OAuth
+ * flow was initiated by this client, or it was already consumed).
+ */
+export declare const consumePendingOAuthFlowId: () => Promise<string | null>;

package/dist/native-types/version.d.ts

@@ -2,4 +2,4 @@
  * Current version of @coinbase/cdp-core package.
  * This file is auto-generated by scripts/sync-versions.js
  */
-export declare const VERSION = "0.0.119";
+export declare const VERSION = "0.0.121";

package/dist/types/shared/oauthFlowStorage.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Persists the flow ID for an OAuth flow that is about to redirect out of the app
+ * (e.g. to Google/Apple/X), so it can later be validated against the flow ID
+ * returned on the OAuth callback.
+ *
+ * This is the CSRF "state" binding for the OAuth flow: without it, an attacker can
+ * craft a link containing their own `code`/`flow_id` that a victim's browser would
+ * otherwise silently consume (see `consumePendingOAuthFlowId`).
+ *
+ * @param flowId - The flow ID returned by the backend when initiating the OAuth flow.
+ */
+export declare const setPendingOAuthFlowId: (flowId: string) => Promise<void>;
+/**
+ * Reads and clears the persisted pending OAuth flow ID, if any.
+ *
+ * This is a single-use nonce: it is always removed from storage as part of this
+ * call, regardless of whether the caller ultimately treats it as valid. This
+ * prevents a captured/replayed callback URL from being consumed more than once.
+ *
+ * @returns The persisted flow ID, or null if none was persisted (e.g. no OAuth
+ * flow was initiated by this client, or it was already consumed).
+ */
+export declare const consumePendingOAuthFlowId: () => Promise<string | null>;

package/dist/types/version.d.ts

@@ -2,4 +2,4 @@
  * Current version of @coinbase/cdp-core package.
  * This file is auto-generated by scripts/sync-versions.js
  */
-export declare const VERSION = "0.0.119";
+export declare const VERSION = "0.0.121";

package/dist/web/index.web10.js

@@ -1,26 +1,26 @@
-import { configureCdpApiClient as j, setAuthManager as v, getMfaConfig as C, APIError as g, getProjectConfig as S } from "@coinbase/cdp-api-client";
-import { Analytics as c } from "./index.web2.js";
+import { configureCdpApiClient as C, setAuthManager as v, getMfaConfig as M, APIError as m, getProjectConfig as S } from "@coinbase/cdp-api-client";
+import { Analytics as d } from "./index.web2.js";
 import "./index.web3.js";
-import { createAuthManager as y } from "./index.web115.js";
-import { OAuthManager as M } from "./index.web116.js";
-import { MockAuthManager as w } from "./index.web117.js";
-import { MockOAuthManager as P } from "./index.web118.js";
-import { getPlatformServices as m } from "./index.web5.js";
-import { getConfig as i, setCoreAuthManager as h, setCoreOAuthManager as I, setMfaConfig as A, setProjectConfig as k, getCoreAuthManager as _, setConfig as O } from "./index.web74.js";
+import { createAuthManager as y } from "./index.web116.js";
+import { OAuthManager as w } from "./index.web117.js";
+import { MockAuthManager as P } from "./index.web118.js";
+import { MockOAuthManager as _ } from "./index.web119.js";
+import { getPlatformServices as h } from "./index.web5.js";
+import { getConfig as s, setCoreAuthManager as I, setCoreOAuthManager as A, setMfaConfig as k, setProjectConfig as b, getCoreAuthManager as O, setConfig as R } from "./index.web74.js";
 import "viem";
-const x = async (t) => {
+const H = async (t) => {
   if (!t.projectId)
     throw new Error("Project ID is required");
-  t.disableAnalytics === void 0 || t.disableAnalytics === !1 ? (c.developerIdentifier = t.projectId, c.isUsingMocks = t.useMock === !0, c.isProduction = !t.basePath || t.basePath === "https://api.cdp.coinbase.com/platform") : c.enabled = !1;
+  t.disableAnalytics === void 0 || t.disableAnalytics === !1 ? (d.developerIdentifier = t.projectId, d.isUsingMocks = t.useMock === !0, d.isProduction = !t.basePath || t.basePath === "https://api.cdp.coinbase.com/platform") : d.enabled = !1;
   let a;
   try {
-    a = i().projectId !== t.projectId;
+    a = s().projectId !== t.projectId;
   } catch {
     a = !0;
   }
-  if (O(t), i().useMock) {
-    h(new w(i().projectId)), I(new P()), A({
-      projectId: i().projectId,
+  if (R(t), s().useMock) {
+    I(new P(s().projectId)), A(new _()), k({
+      projectId: s().projectId,
       enabled: !1,
       totpConfig: { enabled: !1 },
       smsConfig: { enabled: !1 },
@@ -29,95 +29,96 @@ const x = async (t) => {
       requireVerificationOnLogin: !1,
       createdAt: (/* @__PURE__ */ new Date()).toISOString(),
       updatedAt: (/* @__PURE__ */ new Date()).toISOString()
-    }), k({
-      projectId: i().projectId,
+    }), b({
+      projectId: s().projectId,
       name: "Mock Project",
       createdAt: (/* @__PURE__ */ new Date()).toISOString(),
       updatedAt: (/* @__PURE__ */ new Date()).toISOString()
     });
     return;
   }
-  let o, s = !1;
+  let o, c = !1, i = !1;
   try {
-    const e = m();
-    e.secureStorage ? (s = !0, o = {
+    const e = h();
+    e.secureStorage ? (c = !0, i = !0, o = {
       getRefreshToken: () => e.secureStorage.getItem("cdp_refresh_token"),
-      getRefreshTokenWithOutcome: () => b(e.secureStorage),
+      getRefreshTokenWithOutcome: () => j(e.secureStorage),
       setRefreshToken: (n) => e.secureStorage.setItem("cdp_refresh_token", n),
       removeRefreshToken: () => e.secureStorage.removeItem("cdp_refresh_token")
     }) : o = {
       getRefreshToken: () => e.storage.getItem("cdp_refresh_token"),
-      getRefreshTokenWithOutcome: () => b(e.storage),
+      getRefreshTokenWithOutcome: () => j(e.storage),
       setRefreshToken: (n) => e.storage.setItem("cdp_refresh_token", n),
       removeRefreshToken: () => e.storage.removeItem("cdp_refresh_token")
     };
   } catch {
-    c.sendSessionRefreshEvent({
+    d.sendSessionRefreshEvent({
       name: "refresh_token_storage_not_initialized"
     }), o = void 0;
   }
-  let r, d, p;
+  let r, f, p;
   try {
-    const e = m();
-    p = e.deviceInfo?.getPlatform?.(), e.attestation && (r = e.attestation, d = e.deviceInfo?.getAppBundleId?.());
+    const e = h();
+    p = e.deviceInfo?.getPlatform?.(), e.attestation && (r = e.attestation, f = e.deviceInfo?.getAppBundleId?.());
   } catch {
     r = void 0;
   }
-  if (j({
-    debugging: i().debugging,
-    basePath: i().basePath,
+  if (C({
+    debugging: s().debugging,
+    basePath: s().basePath,
     refreshTokenStorage: o,
-    retryTokenReads: s,
+    retryTokenReads: c,
+    failClosedOnMissingToken: i,
     platform: p,
     appAttestation: r && {
       isEnabled: () => r.isEnabled,
-      appIdentifier: d,
+      appIdentifier: f,
       generateAssertion: r.generateAssertion.bind(r)
     }
   }), a) {
-    const e = new M();
-    I(e);
-    const n = y(i().projectId);
-    h(n), v(n);
+    const e = new w();
+    A(e);
+    const n = y(s().projectId);
+    I(n), v(n);
   }
-  const [, f, l] = await Promise.allSettled([
-    _().ensureInitialized(),
+  const [, l, u] = await Promise.allSettled([
+    O().ensureInitialized(),
     (async () => {
       try {
-        return await C(t.projectId);
+        return await M(t.projectId);
       } catch (e) {
-        return (!(e instanceof g) || e.statusCode !== 404) && console.warn("Failed to get MFA config", e), null;
+        return (!(e instanceof m) || e.statusCode !== 404) && console.warn("Failed to get MFA config", e), null;
       }
     })(),
     (async () => {
       try {
         return await S(t.projectId);
       } catch (e) {
-        return (!(e instanceof g) || e.statusCode !== 404) && console.warn("Failed to get project config", e), null;
+        return (!(e instanceof m) || e.statusCode !== 404) && console.warn("Failed to get project config", e), null;
       }
     })()
   ]);
-  if (f.status === "fulfilled" && f.value && A(f.value), l.status === "fulfilled" && l.value) {
-    const e = l.value;
-    if (k(e), e.appAttestation && r && d) {
-      const n = R(e.appAttestation, d);
+  if (l.status === "fulfilled" && l.value && k(l.value), u.status === "fulfilled" && u.value) {
+    const e = u.value;
+    if (b(e), e.appAttestation && r && f) {
+      const n = E(e.appAttestation, f);
       n !== null && (console.warn(
         "[Attestation] Project config has attestation enabled for this app, but no attestation provider is registered. Install @coinbase/cdp-app-attest and add `import '@coinbase/cdp-app-attest'` to your app's entry point."
-      ), r.isEnabled = !0, r.cloudProjectNumber = n.cloudProjectNumber, r.initialize().catch((u) => {
+      ), r.isEnabled = !0, r.cloudProjectNumber = n.cloudProjectNumber, r.initialize().catch((g) => {
         console.error(
           "[Attestation] Background initialization failed:",
-          u instanceof Error ? u.message : String(u)
+          g instanceof Error ? g.message : String(g)
         );
       }));
     }
   }
-}, b = async (t) => {
-  const { value: a, outcome: o, errorMessage: s } = await t.getItemWithOutcome("cdp_refresh_token");
-  return { token: a, outcome: o, errorMessage: s };
-}, R = (t, a) => {
-  const o = t.android?.find((r) => r.identifier === a);
-  return o ? { cloudProjectNumber: o.googleProjectNumber } : t.ios?.find((r) => r.identifier === a) ? {} : null;
+}, j = async (t) => {
+  const { value: a, outcome: o, errorMessage: c } = await t.getItemWithOutcome("cdp_refresh_token");
+  return { token: a, outcome: o, errorMessage: c };
+}, E = (t, a) => {
+  const o = t.android?.find((i) => i.identifier === a);
+  return o ? { cloudProjectNumber: o.googleProjectNumber } : t.ios?.find((i) => i.identifier === a) ? {} : null;
 };
 export {
-  x as initialize
+  H as initialize
 };

package/dist/web/index.web101.js

@@ -1,27 +1,16 @@
-import "@coinbase/cdp-api-client";
-const e = (t) => ({
-  userId: t.userId,
-  // Deprecated fields - keep for backward compatibility
-  evmAccounts: t.evmAccounts?.map((c) => c) ?? [],
-  evmSmartAccounts: t.evmSmartAccounts?.map((c) => c) ?? [],
-  solanaAccounts: t.solanaAccounts?.map((c) => c) ?? [],
-  // New account object fields
-  evmAccountObjects: t.evmAccountObjects,
-  evmSmartAccountObjects: t.evmSmartAccountObjects,
-  solanaAccountObjects: t.solanaAccountObjects,
-  btcAccountObjects: t.btcAccountObjects,
-  authenticationMethods: t.authenticationMethods.reduce((c, o) => (c[o.type] = o, c), {}),
-  mfaMethods: t.mfaMethods,
-  lastAuthenticatedAt: t.lastAuthenticatedAt
-}), s = (t, c, o) => {
-  const a = new Date(c).getTime();
-  return {
-    accessToken: t,
-    expiresAt: a,
-    user: e(o)
-  };
+import { getPlatformStorage as e } from "./index.web5.js";
+const o = "cdp_oauth_pending_flow_id", c = async (t) => {
+  await e().setItem(o, t);
+}, s = async () => {
+  const t = e(), n = await t.getItem(o);
+  try {
+    await t.removeItem(o);
+  } catch (a) {
+    console.warn(`Failed to clear pending OAuth flow ID: ${a}`);
+  }
+  return n;
 };
 export {
-  s as toAuthState,
-  e as toAuthStateUser
+  s as consumePendingOAuthFlowId,
+  c as setPendingOAuthFlowId
 };

package/dist/web/index.web102.js

@@ -1,17 +1,27 @@
-import { ValidationError as n, InternalError as s } from "./index.web88.js";
-function d(e, o) {
-  if (!e)
-    throw new n("User must be signed in");
-  if (!o)
-    throw new s("No auth state found");
-  return { user: e, authState: o };
-}
-function w(e, o) {
-  const r = o.toLowerCase();
-  if (!(e.evmAccountObjects?.some((t) => t.address.toLowerCase() === r) || e.evmSmartAccountObjects?.some((t) => t.address.toLowerCase() === r) || e.solanaAccountObjects?.some((t) => t.address === o)))
-    throw new Error(`Address ${o} does not belong to the current user.`);
-}
+import "@coinbase/cdp-api-client";
+const e = (t) => ({
+  userId: t.userId,
+  // Deprecated fields - keep for backward compatibility
+  evmAccounts: t.evmAccounts?.map((c) => c) ?? [],
+  evmSmartAccounts: t.evmSmartAccounts?.map((c) => c) ?? [],
+  solanaAccounts: t.solanaAccounts?.map((c) => c) ?? [],
+  // New account object fields
+  evmAccountObjects: t.evmAccountObjects,
+  evmSmartAccountObjects: t.evmSmartAccountObjects,
+  solanaAccountObjects: t.solanaAccountObjects,
+  btcAccountObjects: t.btcAccountObjects,
+  authenticationMethods: t.authenticationMethods.reduce((c, o) => (c[o.type] = o, c), {}),
+  mfaMethods: t.mfaMethods,
+  lastAuthenticatedAt: t.lastAuthenticatedAt
+}), s = (t, c, o) => {
+  const a = new Date(c).getTime();
+  return {
+    accessToken: t,
+    expiresAt: a,
+    user: e(o)
+  };
+};
 export {
-  w as assertUserOwnsAddress,
-  d as validateUserAuthState
+  s as toAuthState,
+  e as toAuthStateUser
 };