@coinbase/cdp-core 0.0.119 → 0.0.121

package/dist/web/index.web85.js

@@ -1,42 +1,42 @@
-import { logOutEndUser as f, refreshAccessToken as d, registerTemporaryWalletSecret as S, APIError as m } from "@coinbase/cdp-api-client";
-import { Analytics as h } from "./index.web2.js";
+import { logOutEndUser as f, refreshAccessToken as d, isRefreshTokenUnavailableError as m, isTransientTokenReadError as S, registerTemporaryWalletSecret as w, APIError as y } from "@coinbase/cdp-api-client";
+import { Analytics as i } from "./index.web2.js";
 import "./index.web3.js";
 import "jose";
-import { SignJWT as w } from "./index.web107.js";
-import { toAuthState as y } from "./index.web101.js";
+import { SignJWT as _ } from "./index.web108.js";
+import { toAuthState as k } from "./index.web102.js";
 import "viem";
 import { getPlatformCrypto as c } from "./index.web5.js";
 import { sortKeys as p } from "./index.web98.js";
-import { getCoreOAuthManager as g } from "./index.web74.js";
-const l = 60 * 1e3, k = {
+import { getCoreOAuthManager as T } from "./index.web74.js";
+const l = 60 * 1e3, R = {
   maxRetries: 3,
   baseDelayMs: 1e3,
   maxDelayMs: 1e4
 };
-function T(t, e, s) {
-  const n = e * Math.pow(2, t), i = Math.random() * 0.3 * n;
-  return Math.min(n + i, s);
+function g(s, e, r) {
+  const n = e * Math.pow(2, s), o = Math.random() * 0.3 * n;
+  return Math.min(n + o, r);
 }
-function R(t) {
-  return new Promise((e) => setTimeout(e, t));
+function A(s) {
+  return new Promise((e) => setTimeout(e, s));
 }
-function _(t) {
-  if (t instanceof TypeError && t.message.includes("fetch"))
+function E(s) {
+  if (s instanceof TypeError && s.message.includes("fetch"))
     return !0;
-  if (t instanceof m) {
-    if (t.statusCode >= 500 && t.statusCode < 600 || t.statusCode === 408 || t.statusCode === 429)
+  if (s instanceof y) {
+    if (s.statusCode >= 500 && s.statusCode < 600 || s.statusCode === 408 || s.statusCode === 429)
       return !0;
-    if (t.statusCode === 401)
+    if (s.statusCode === 401)
       return !1;
   }
-  if (t instanceof Error) {
-    const e = t.message.toLowerCase();
+  if (s instanceof Error) {
+    const e = s.message.toLowerCase();
     if (e.includes("network") || e.includes("timeout") || e.includes("econnrefused") || e.includes("enotfound") || e.includes("socket"))
       return !0;
   }
   return !1;
 }
-class v {
+class j {
   projectId;
   authState = null;
   walletSecret = null;
@@ -139,14 +139,14 @@ class v {
     if (!await this.isSignedIn())
       throw new Error("Cannot get X-Wallet-Auth header if the user is not signed in");
     this.shouldRefreshWalletSecret() && await this.refreshWalletSecret();
-    const s = `${e.requestMethod} ${e.requestHost}${e.requestPath}`, n = Math.floor(Date.now() / 1e3), i = c(), r = {
-      uris: [s]
+    const r = `${e.requestMethod} ${e.requestHost}${e.requestPath}`, n = Math.floor(Date.now() / 1e3), o = c(), a = {
+      uris: [r]
     };
     if (e.requestData && Object.keys(e.requestData).length > 0) {
-      const a = p(e.requestData);
-      r.reqHash = await i.hash(new TextEncoder().encode(JSON.stringify(a)));
+      const t = p(e.requestData);
+      a.reqHash = await o.hash(new TextEncoder().encode(JSON.stringify(t)));
     }
-    return await new w(r).setProtectedHeader({ alg: "ES256", typ: "JWT" }).setIssuedAt(n).setNotBefore(n).setJti(i.generateRandomId()).sign(this.walletSecret.keyPair.privateKey);
+    return await new _(a).setProtectedHeader({ alg: "ES256", typ: "JWT" }).setIssuedAt(n).setNotBefore(n).setJti(o.generateRandomId()).sign(this.walletSecret.keyPair.privateKey);
   }
   /**
    * Gets the authentication state.
@@ -162,13 +162,13 @@ class v {
    * @param authState - The authentication state.
    */
   async setAuthState(e) {
-    this.authState = e, h.endUserIdentifier = e.user.userId, this.authStateChangeCallbacks.forEach((s) => s(this.authState?.user ?? null)), this.scheduleTokenRefresh();
+    this.authState = e, i.endUserIdentifier = e.user.userId, this.authStateChangeCallbacks.forEach((r) => r(this.authState?.user ?? null)), this.scheduleTokenRefresh();
   }
   /**
    * Clears the authentication state.
    */
   async clearAuthState() {
-    this.authState = null, this.walletSecret = null, h.endUserIdentifier = "", this.cancelTokenRefresh(), this.authStateChangeCallbacks.forEach((e) => e(null));
+    this.authState = null, this.walletSecret = null, i.endUserIdentifier = "", this.cancelTokenRefresh(), this.authStateChangeCallbacks.forEach((e) => e(null));
   }
   /**
    * Ensures the AuthManager is initialized before proceeding.
@@ -186,7 +186,7 @@ class v {
    */
   async _doInitialize() {
     try {
-      await this.refreshAccessToken("init"), await g().handleOAuthCode();
+      await this.refreshAccessToken("init"), await T().handleOAuthCode();
     } catch (e) {
       console.warn("Failed to refresh access token during initialization:", e);
     }
@@ -210,57 +210,78 @@ class v {
    * @returns The new access token.
    */
   async refreshAccessToken(e = "on_demand") {
-    const { maxRetries: s, baseDelayMs: n, maxDelayMs: i } = k;
-    h.sendSessionRefreshEvent({
+    const { maxRetries: r, baseDelayMs: n, maxDelayMs: o } = R;
+    i.sendSessionRefreshEvent({
       name: "refresh_token_start",
       trigger: e
     });
-    for (let r = 0; r <= s; r++)
+    for (let a = 0; a <= r; a++)
       try {
-        const a = await d(this.projectId, {
+        const t = await d(this.projectId, {
           grantType: "refresh_token"
-        }), o = y(
-          a.accessToken,
-          a.validUntil,
-          a.endUser
+        }), h = k(
+          t.accessToken,
+          t.validUntil,
+          t.endUser
         );
-        await this.setAuthState(o), h.sendSessionRefreshEvent({
+        await this.setAuthState(h), i.sendSessionRefreshEvent({
           name: "refresh_token_success",
           trigger: e,
-          attempt: r
+          attempt: a
         });
         return;
-      } catch (a) {
-        const o = a instanceof Error ? a.message : String(a);
-        if (!_(a)) {
-          h.sendSessionRefreshEvent({
+      } catch (t) {
+        const h = t instanceof Error ? t.message : String(t);
+        if (m(t)) {
+          if (S(t)) {
+            i.sendSessionRefreshEvent({
+              name: "refresh_token_skipped_transient",
+              trigger: e,
+              attempt: a,
+              read_outcome: t.outcome,
+              error_message: h
+            });
+            return;
+          }
+          i.sendSessionRefreshEvent({
             name: "refresh_token_failure",
             trigger: e,
-            attempt: r,
+            attempt: a,
             error_type: "non_transient",
-            error_message: o
+            read_outcome: t.outcome,
+            error_message: h
           }), await this.signOut();
           return;
         }
-        if (r === s) {
-          h.sendSessionRefreshEvent({
+        if (!E(t)) {
+          i.sendSessionRefreshEvent({
+            name: "refresh_token_failure",
+            trigger: e,
+            attempt: a,
+            error_type: "non_transient",
+            error_message: h
+          }), await this.signOut();
+          return;
+        }
+        if (a === r) {
+          i.sendSessionRefreshEvent({
             name: "refresh_token_exhausted",
             trigger: e,
-            attempt: r,
+            attempt: a,
             error_type: "transient",
-            error_message: o
+            error_message: h
           });
           return;
         }
-        h.sendSessionRefreshEvent({
+        i.sendSessionRefreshEvent({
           name: "refresh_token_retry",
           trigger: e,
-          attempt: r,
+          attempt: a,
           error_type: "transient",
-          error_message: o
+          error_message: h
         });
-        const u = T(r, n, i);
-        await R(u);
+        const u = g(a, n, o);
+        await A(u);
       }
   }
   /**
@@ -270,13 +291,13 @@ class v {
   scheduleTokenRefresh() {
     if (this.cancelTokenRefresh(), !this.authState)
       return;
-    const s = this.authState.expiresAt - l - Date.now();
-    s <= 0 || (h.sendSessionRefreshEvent({
+    const r = this.authState.expiresAt - l - Date.now();
+    r <= 0 || (i.sendSessionRefreshEvent({
       name: "refresh_token_scheduled",
-      time_until_refresh_ms: s
+      time_until_refresh_ms: r
     }), this.refreshTimeout = setTimeout(async () => {
       await this.refreshAccessToken("scheduled"), this.scheduleTokenRefresh();
-    }, s));
+    }, r));
   }
   /**
    * Cancels any scheduled token refresh.
@@ -313,23 +334,23 @@ class v {
    * Internal wallet secret refresh logic.
    */
   async _doRefreshWalletSecret() {
-    const e = c(), s = this.walletSecret?.walletSecretId ?? e.generateRandomId(), n = this.walletSecret?.keyPair ?? await e.createKeyPair(), i = this.authState.expiresAt, r = new Date(i).toISOString();
-    this.walletSecret = { walletSecretId: s, keyPair: n, expiresAt: i };
+    const e = c(), r = this.walletSecret?.walletSecretId ?? e.generateRandomId(), n = this.walletSecret?.keyPair ?? await e.createKeyPair(), o = this.authState.expiresAt, a = new Date(o).toISOString();
+    this.walletSecret = { walletSecretId: r, keyPair: n, expiresAt: o };
     try {
-      await S(
+      await w(
         this.authState.user.userId,
         {
-          walletSecretId: s,
+          walletSecretId: r,
           publicKey: n.publicKeyBase64,
-          validUntil: r
+          validUntil: a
         },
         { projectID: this.projectId }
       );
-    } catch (a) {
-      throw this.walletSecret = null, a;
+    } catch (t) {
+      throw this.walletSecret = null, t;
     }
   }
 }
 export {
-  v as AuthManager
+  j as AuthManager
 };

package/dist/web/index.web87.js

@@ -13,9 +13,9 @@ import "./index.web93.js";
 import "./index.web99.js";
 import "@solana/web3.js";
 import "bs58";
-import { COINBASE_SMART_WALLET_FACTORY_ADDRESS as v, COINBASE_SMART_WALLET_FACTORY_ABI as w } from "./index.web108.js";
-import { signAndWrapTypedDataForSmartAccount as E } from "./index.web109.js";
-import { toAccount as T } from "./index.web110.js";
+import { COINBASE_SMART_WALLET_FACTORY_ADDRESS as v, COINBASE_SMART_WALLET_FACTORY_ABI as w } from "./index.web109.js";
+import { signAndWrapTypedDataForSmartAccount as E } from "./index.web110.js";
+import { toAccount as T } from "./index.web111.js";
 function U(r) {
   const o = l();
   if (!o || !o.evmAccountObjects?.length && !o.evmSmartAccountObjects?.length)

package/dist/web/index.web9.js

@@ -1,4 +1,4 @@
-const o = "0.0.119";
+const o = "0.0.121";
 export {
   o as VERSION
 };

package/dist/web/index.web90.js

@@ -1,11 +1,11 @@
 import { createStore as a } from "zustand";
-import { subscribeWithSelector as c, persist as d, createJSONStorage as h } from "./index.web111.js";
-import { EventEmitter as f } from "./index.web112.js";
-import "./index.web113.js";
+import { subscribeWithSelector as c, persist as d, createJSONStorage as h } from "./index.web112.js";
+import { EventEmitter as f } from "./index.web113.js";
+import "./index.web114.js";
 import "viem";
 import "@coinbase/cdp-api-client";
 import { getPlatformStorage as u } from "./index.web5.js";
-import { createProvider as g } from "./index.web114.js";
+import { createProvider as g } from "./index.web115.js";
 import { onAuthStateChange as l } from "./index.web26.js";
 import "./index.web2.js";
 import "./index.web3.js";

package/dist/web/index.web99.js

@@ -1,4 +1,4 @@
-import { __require as r } from "./index.web136.js";
+import { __require as r } from "./index.web137.js";
 var f = r();
 export {
   f as b

package/dist/web-types/shared/oauthFlowStorage.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Persists the flow ID for an OAuth flow that is about to redirect out of the app
+ * (e.g. to Google/Apple/X), so it can later be validated against the flow ID
+ * returned on the OAuth callback.
+ *
+ * This is the CSRF "state" binding for the OAuth flow: without it, an attacker can
+ * craft a link containing their own `code`/`flow_id` that a victim's browser would
+ * otherwise silently consume (see `consumePendingOAuthFlowId`).
+ *
+ * @param flowId - The flow ID returned by the backend when initiating the OAuth flow.
+ */
+export declare const setPendingOAuthFlowId: (flowId: string) => Promise<void>;
+/**
+ * Reads and clears the persisted pending OAuth flow ID, if any.
+ *
+ * This is a single-use nonce: it is always removed from storage as part of this
+ * call, regardless of whether the caller ultimately treats it as valid. This
+ * prevents a captured/replayed callback URL from being consumed more than once.
+ *
+ * @returns The persisted flow ID, or null if none was persisted (e.g. no OAuth
+ * flow was initiated by this client, or it was already consumed).
+ */
+export declare const consumePendingOAuthFlowId: () => Promise<string | null>;

package/dist/web-types/version.d.ts

@@ -2,4 +2,4 @@
  * Current version of @coinbase/cdp-core package.
  * This file is auto-generated by scripts/sync-versions.js
  */
-export declare const VERSION = "0.0.119";
+export declare const VERSION = "0.0.121";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coinbase/cdp-core",
-  "version": "0.0.119",
+  "version": "0.0.121",
   "type": "module",
   "files": [
     "dist/**",
@@ -29,7 +29,7 @@
     "ox": "0.8.1",
     "viem": "^2.47.0",
     "zustand": "^5.0.6",
-    "@coinbase/cdp-api-client": "^0.0.119"
+    "@coinbase/cdp-api-client": "^0.0.121"
   },
   "peerDependencies": {
     "@react-native-async-storage/async-storage": "^2.0.0",
@@ -70,7 +70,7 @@
       "path": "./dist/esm/index.web.js",
       "running": false,
       "import": "{ signInWithEmail, verifyEmailOTP, getCurrentUser, isSignedIn, signOut }",
-      "limit": "85.5 KB"
+      "limit": "86 KB"
     },
     {
       "name": "evm-only",