@coinbase/cdp-core 0.0.120 → 0.0.121

package/dist/native-types/version.d.ts

@@ -2,4 +2,4 @@
  * Current version of @coinbase/cdp-core package.
  * This file is auto-generated by scripts/sync-versions.js
  */
-export declare const VERSION = "0.0.120";
+export declare const VERSION = "0.0.121";

package/dist/types/shared/oauthFlowStorage.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Persists the flow ID for an OAuth flow that is about to redirect out of the app
+ * (e.g. to Google/Apple/X), so it can later be validated against the flow ID
+ * returned on the OAuth callback.
+ *
+ * This is the CSRF "state" binding for the OAuth flow: without it, an attacker can
+ * craft a link containing their own `code`/`flow_id` that a victim's browser would
+ * otherwise silently consume (see `consumePendingOAuthFlowId`).
+ *
+ * @param flowId - The flow ID returned by the backend when initiating the OAuth flow.
+ */
+export declare const setPendingOAuthFlowId: (flowId: string) => Promise<void>;
+/**
+ * Reads and clears the persisted pending OAuth flow ID, if any.
+ *
+ * This is a single-use nonce: it is always removed from storage as part of this
+ * call, regardless of whether the caller ultimately treats it as valid. This
+ * prevents a captured/replayed callback URL from being consumed more than once.
+ *
+ * @returns The persisted flow ID, or null if none was persisted (e.g. no OAuth
+ * flow was initiated by this client, or it was already consumed).
+ */
+export declare const consumePendingOAuthFlowId: () => Promise<string | null>;

package/dist/types/version.d.ts

@@ -2,4 +2,4 @@
  * Current version of @coinbase/cdp-core package.
  * This file is auto-generated by scripts/sync-versions.js
  */
-export declare const VERSION = "0.0.120";
+export declare const VERSION = "0.0.121";

package/dist/web/index.web10.js

@@ -1,10 +1,10 @@
 import { configureCdpApiClient as C, setAuthManager as v, getMfaConfig as M, APIError as m, getProjectConfig as S } from "@coinbase/cdp-api-client";
 import { Analytics as d } from "./index.web2.js";
 import "./index.web3.js";
-import { createAuthManager as y } from "./index.web115.js";
-import { OAuthManager as w } from "./index.web116.js";
-import { MockAuthManager as P } from "./index.web117.js";
-import { MockOAuthManager as _ } from "./index.web118.js";
+import { createAuthManager as y } from "./index.web116.js";
+import { OAuthManager as w } from "./index.web117.js";
+import { MockAuthManager as P } from "./index.web118.js";
+import { MockOAuthManager as _ } from "./index.web119.js";
 import { getPlatformServices as h } from "./index.web5.js";
 import { getConfig as s, setCoreAuthManager as I, setCoreOAuthManager as A, setMfaConfig as k, setProjectConfig as b, getCoreAuthManager as O, setConfig as R } from "./index.web74.js";
 import "viem";

package/dist/web/index.web101.js

@@ -1,27 +1,16 @@
-import "@coinbase/cdp-api-client";
-const e = (t) => ({
-  userId: t.userId,
-  // Deprecated fields - keep for backward compatibility
-  evmAccounts: t.evmAccounts?.map((c) => c) ?? [],
-  evmSmartAccounts: t.evmSmartAccounts?.map((c) => c) ?? [],
-  solanaAccounts: t.solanaAccounts?.map((c) => c) ?? [],
-  // New account object fields
-  evmAccountObjects: t.evmAccountObjects,
-  evmSmartAccountObjects: t.evmSmartAccountObjects,
-  solanaAccountObjects: t.solanaAccountObjects,
-  btcAccountObjects: t.btcAccountObjects,
-  authenticationMethods: t.authenticationMethods.reduce((c, o) => (c[o.type] = o, c), {}),
-  mfaMethods: t.mfaMethods,
-  lastAuthenticatedAt: t.lastAuthenticatedAt
-}), s = (t, c, o) => {
-  const a = new Date(c).getTime();
-  return {
-    accessToken: t,
-    expiresAt: a,
-    user: e(o)
-  };
+import { getPlatformStorage as e } from "./index.web5.js";
+const o = "cdp_oauth_pending_flow_id", c = async (t) => {
+  await e().setItem(o, t);
+}, s = async () => {
+  const t = e(), n = await t.getItem(o);
+  try {
+    await t.removeItem(o);
+  } catch (a) {
+    console.warn(`Failed to clear pending OAuth flow ID: ${a}`);
+  }
+  return n;
 };
 export {
-  s as toAuthState,
-  e as toAuthStateUser
+  s as consumePendingOAuthFlowId,
+  c as setPendingOAuthFlowId
 };

package/dist/web/index.web102.js

@@ -1,17 +1,27 @@
-import { ValidationError as n, InternalError as s } from "./index.web88.js";
-function d(e, o) {
-  if (!e)
-    throw new n("User must be signed in");
-  if (!o)
-    throw new s("No auth state found");
-  return { user: e, authState: o };
-}
-function w(e, o) {
-  const r = o.toLowerCase();
-  if (!(e.evmAccountObjects?.some((t) => t.address.toLowerCase() === r) || e.evmSmartAccountObjects?.some((t) => t.address.toLowerCase() === r) || e.solanaAccountObjects?.some((t) => t.address === o)))
-    throw new Error(`Address ${o} does not belong to the current user.`);
-}
+import "@coinbase/cdp-api-client";
+const e = (t) => ({
+  userId: t.userId,
+  // Deprecated fields - keep for backward compatibility
+  evmAccounts: t.evmAccounts?.map((c) => c) ?? [],
+  evmSmartAccounts: t.evmSmartAccounts?.map((c) => c) ?? [],
+  solanaAccounts: t.solanaAccounts?.map((c) => c) ?? [],
+  // New account object fields
+  evmAccountObjects: t.evmAccountObjects,
+  evmSmartAccountObjects: t.evmSmartAccountObjects,
+  solanaAccountObjects: t.solanaAccountObjects,
+  btcAccountObjects: t.btcAccountObjects,
+  authenticationMethods: t.authenticationMethods.reduce((c, o) => (c[o.type] = o, c), {}),
+  mfaMethods: t.mfaMethods,
+  lastAuthenticatedAt: t.lastAuthenticatedAt
+}), s = (t, c, o) => {
+  const a = new Date(c).getTime();
+  return {
+    accessToken: t,
+    expiresAt: a,
+    user: e(o)
+  };
+};
 export {
-  w as assertUserOwnsAddress,
-  d as validateUserAuthState
+  s as toAuthState,
+  e as toAuthStateUser
 };

package/dist/web/index.web103.js

@@ -1,27 +1,17 @@
-import { InputValidationError as n } from "./index.web88.js";
-function u(t, e) {
-  if (e) {
-    const o = e.toLowerCase();
-    if (!(t.evmAccountObjects?.some((c) => c.address.toLowerCase() === o) || t.evmSmartAccountObjects?.some((c) => c.address.toLowerCase() === o)))
-      throw new n(`Account ${e} is not owned by the current user`);
-    return e;
-  }
-  return r(t);
+import { ValidationError as n, InternalError as s } from "./index.web88.js";
+function d(e, o) {
+  if (!e)
+    throw new n("User must be signed in");
+  if (!o)
+    throw new s("No auth state found");
+  return { user: e, authState: o };
 }
-function r(t) {
-  const e = t.evmSmartAccountObjects?.length || 0, o = t.evmAccountObjects?.length || 0;
-  if (e === 0 && o === 0)
-    throw new Error(
-      "No EVM accounts available. User must have at least one EVM Smart Account or EVM Account."
-    );
-  if (e === 1 && o <= 1)
-    return t.evmSmartAccountObjects[0].address;
-  if (o === 1 && e === 0)
-    return t.evmAccountObjects[0].address;
-  throw new Error(
-    "Multiple EVM accounts available. Please specify 'account' to select which account to swap with."
-  );
+function w(e, o) {
+  const r = o.toLowerCase();
+  if (!(e.evmAccountObjects?.some((t) => t.address.toLowerCase() === r) || e.evmSmartAccountObjects?.some((t) => t.address.toLowerCase() === r) || e.solanaAccountObjects?.some((t) => t.address === o)))
+    throw new Error(`Address ${o} does not belong to the current user.`);
 }
 export {
-  u as resolveAccount
+  w as assertUserOwnsAddress,
+  d as validateUserAuthState
 };

package/dist/web/index.web104.js

@@ -1,24 +1,27 @@
-import { EvmSwapsNetwork as a } from "@coinbase/cdp-api-client";
-import { InputValidationError as t } from "./index.web88.js";
-const r = /^0x[a-fA-F0-9]{40}$/, o = /^[1-9]\d*$/, n = new Set(Object.values(a));
-function w(e) {
-  if (!n.has(e.network))
-    throw new t(
-      `Invalid network: ${e.network}. Must be one of: ${[...n].join(", ")}`
+import { InputValidationError as n } from "./index.web88.js";
+function u(t, e) {
+  if (e) {
+    const o = e.toLowerCase();
+    if (!(t.evmAccountObjects?.some((c) => c.address.toLowerCase() === o) || t.evmSmartAccountObjects?.some((c) => c.address.toLowerCase() === o)))
+      throw new n(`Account ${e} is not owned by the current user`);
+    return e;
+  }
+  return r(t);
+}
+function r(t) {
+  const e = t.evmSmartAccountObjects?.length || 0, o = t.evmAccountObjects?.length || 0;
+  if (e === 0 && o === 0)
+    throw new Error(
+      "No EVM accounts available. User must have at least one EVM Smart Account or EVM Account."
     );
-  if (!r.test(e.fromToken))
-    throw new t("Invalid fromToken address");
-  if (!r.test(e.toToken))
-    throw new t("Invalid toToken address");
-  if (e.fromToken.toLowerCase() === e.toToken.toLowerCase())
-    throw new t("fromToken and toToken must be different");
-  if (!o.test(e.fromAmount))
-    throw new t("fromAmount must be a positive integer string in atomic units");
-  if (e.slippageBps !== void 0 && (!Number.isInteger(e.slippageBps) || e.slippageBps < 0 || e.slippageBps > 1e4))
-    throw new t("slippageBps must be an integer between 0 and 10000");
-  if (e.account !== void 0 && !r.test(e.account))
-    throw new t("Invalid account address");
+  if (e === 1 && o <= 1)
+    return t.evmSmartAccountObjects[0].address;
+  if (o === 1 && e === 0)
+    return t.evmAccountObjects[0].address;
+  throw new Error(
+    "Multiple EVM accounts available. Please specify 'account' to select which account to swap with."
+  );
 }
 export {
-  w as validateSwapParams
+  u as resolveAccount
 };

package/dist/web/index.web105.js

@@ -1,19 +1,24 @@
-import { APIError as o } from "@coinbase/cdp-api-client";
-import { SwapError as r } from "./index.web88.js";
-const t = {
-  insufficient_liquidity: "INSUFFICIENT_LIQUIDITY",
-  insufficient_allowance: "INSUFFICIENT_ALLOWANCE",
-  insufficient_balance: "INSUFFICIENT_BALANCE",
-  transaction_simulation_failed: "TRANSACTION_SIMULATION_FAILED"
-};
-function e(i) {
-  if (i instanceof o && i.statusCode === 422) {
-    const n = t[i.errorType];
-    if (n)
-      return new r(n, i.errorMessage);
-  }
-  return i instanceof Error ? i : new Error(String(i));
+import { EvmSwapsNetwork as a } from "@coinbase/cdp-api-client";
+import { InputValidationError as t } from "./index.web88.js";
+const r = /^0x[a-fA-F0-9]{40}$/, o = /^[1-9]\d*$/, n = new Set(Object.values(a));
+function w(e) {
+  if (!n.has(e.network))
+    throw new t(
+      `Invalid network: ${e.network}. Must be one of: ${[...n].join(", ")}`
+    );
+  if (!r.test(e.fromToken))
+    throw new t("Invalid fromToken address");
+  if (!r.test(e.toToken))
+    throw new t("Invalid toToken address");
+  if (e.fromToken.toLowerCase() === e.toToken.toLowerCase())
+    throw new t("fromToken and toToken must be different");
+  if (!o.test(e.fromAmount))
+    throw new t("fromAmount must be a positive integer string in atomic units");
+  if (e.slippageBps !== void 0 && (!Number.isInteger(e.slippageBps) || e.slippageBps < 0 || e.slippageBps > 1e4))
+    throw new t("slippageBps must be an integer between 0 and 10000");
+  if (e.account !== void 0 && !r.test(e.account))
+    throw new t("Invalid account address");
 }
 export {
-  e as mapSwapApiError
+  w as validateSwapParams
 };

package/dist/web/index.web106.js

@@ -1,32 +1,19 @@
-import "@coinbase/cdp-api-client";
-import "viem";
-const t = "0x0000000000000000000000000000000000000000", s = {
-  userId: "mock-user-id",
-  evmAccounts: [t],
-  evmSmartAccounts: [],
-  solanaAccounts: ["5fNfvyp5f3BB9T24s6bC8QjDXuJqvU8WjziJpEQi9PWT"],
-  evmAccountObjects: [
-    {
-      address: t,
-      createdAt: "2024-01-01T00:00:00Z"
-    }
-  ],
-  evmSmartAccountObjects: [],
-  solanaAccountObjects: [
-    {
-      address: "5fNfvyp5f3BB9T24s6bC8QjDXuJqvU8WjziJpEQi9PWT",
-      createdAt: "2024-01-01T00:00:00Z"
-    }
-  ],
-  btcAccountObjects: [],
-  authenticationMethods: {
-    email: {
-      type: "email",
-      email: "test@test.com"
-    }
-  }
+import { APIError as o } from "@coinbase/cdp-api-client";
+import { SwapError as r } from "./index.web88.js";
+const t = {
+  insufficient_liquidity: "INSUFFICIENT_LIQUIDITY",
+  insufficient_allowance: "INSUFFICIENT_ALLOWANCE",
+  insufficient_balance: "INSUFFICIENT_BALANCE",
+  transaction_simulation_failed: "TRANSACTION_SIMULATION_FAILED"
 };
+function e(i) {
+  if (i instanceof o && i.statusCode === 422) {
+    const n = t[i.errorType];
+    if (n)
+      return new r(n, i.errorMessage);
+  }
+  return i instanceof Error ? i : new Error(String(i));
+}
 export {
-  t as mockAddress,
-  s as mockUser
+  e as mapSwapApiError
 };

package/dist/web/index.web107.js

@@ -1,43 +1,32 @@
-import { CompactSign as i } from "./index.web127.js";
-import { JWTInvalid as r } from "./index.web128.js";
-import { JWTClaimsBuilder as n } from "./index.web129.js";
-class d {
-  #s;
-  #t;
-  constructor(t = {}) {
-    this.#t = new n(t);
+import "@coinbase/cdp-api-client";
+import "viem";
+const t = "0x0000000000000000000000000000000000000000", s = {
+  userId: "mock-user-id",
+  evmAccounts: [t],
+  evmSmartAccounts: [],
+  solanaAccounts: ["5fNfvyp5f3BB9T24s6bC8QjDXuJqvU8WjziJpEQi9PWT"],
+  evmAccountObjects: [
+    {
+      address: t,
+      createdAt: "2024-01-01T00:00:00Z"
+    }
+  ],
+  evmSmartAccountObjects: [],
+  solanaAccountObjects: [
+    {
+      address: "5fNfvyp5f3BB9T24s6bC8QjDXuJqvU8WjziJpEQi9PWT",
+      createdAt: "2024-01-01T00:00:00Z"
+    }
+  ],
+  btcAccountObjects: [],
+  authenticationMethods: {
+    email: {
+      type: "email",
+      email: "test@test.com"
+    }
   }
-  setIssuer(t) {
-    return this.#t.iss = t, this;
-  }
-  setSubject(t) {
-    return this.#t.sub = t, this;
-  }
-  setAudience(t) {
-    return this.#t.aud = t, this;
-  }
-  setJti(t) {
-    return this.#t.jti = t, this;
-  }
-  setNotBefore(t) {
-    return this.#t.nbf = t, this;
-  }
-  setExpirationTime(t) {
-    return this.#t.exp = t, this;
-  }
-  setIssuedAt(t) {
-    return this.#t.iat = t, this;
-  }
-  setProtectedHeader(t) {
-    return this.#s = t, this;
-  }
-  async sign(t, e) {
-    const s = new i(this.#t.data());
-    if (s.setProtectedHeader(this.#s), Array.isArray(this.#s?.crit) && this.#s.crit.includes("b64") && this.#s.b64 === !1)
-      throw new r("JWTs MUST NOT use unencoded payload");
-    return s.sign(t, e);
-  }
-}
+};
 export {
-  d as SignJWT
+  t as mockAddress,
+  s as mockUser
 };

package/dist/web/index.web108.js

@@ -1,51 +1,43 @@
-const t = "0xba5ed110efdba3d005bfc882d75358acbbb85842", e = [
-  {
-    inputs: [{ name: "implementation_", type: "address" }],
-    stateMutability: "payable",
-    type: "constructor"
-  },
-  { inputs: [], name: "OwnerRequired", type: "error" },
-  {
-    inputs: [
-      { name: "owners", type: "bytes[]" },
-      { name: "nonce", type: "uint256" }
-    ],
-    name: "createAccount",
-    outputs: [
-      {
-        name: "account",
-        type: "address"
-      }
-    ],
-    stateMutability: "payable",
-    type: "function"
-  },
-  {
-    inputs: [
-      { name: "owners", type: "bytes[]" },
-      { name: "nonce", type: "uint256" }
-    ],
-    name: "getAddress",
-    outputs: [{ name: "", type: "address" }],
-    stateMutability: "view",
-    type: "function"
-  },
-  {
-    inputs: [],
-    name: "implementation",
-    outputs: [{ name: "", type: "address" }],
-    stateMutability: "view",
-    type: "function"
-  },
-  {
-    inputs: [],
-    name: "initCodeHash",
-    outputs: [{ name: "", type: "bytes32" }],
-    stateMutability: "view",
-    type: "function"
-  }
-];
+import { CompactSign as i } from "./index.web128.js";
+import { JWTInvalid as r } from "./index.web129.js";
+import { JWTClaimsBuilder as n } from "./index.web130.js";
+class d {
+  #s;
+  #t;
+  constructor(t = {}) {
+    this.#t = new n(t);
+  }
+  setIssuer(t) {
+    return this.#t.iss = t, this;
+  }
+  setSubject(t) {
+    return this.#t.sub = t, this;
+  }
+  setAudience(t) {
+    return this.#t.aud = t, this;
+  }
+  setJti(t) {
+    return this.#t.jti = t, this;
+  }
+  setNotBefore(t) {
+    return this.#t.nbf = t, this;
+  }
+  setExpirationTime(t) {
+    return this.#t.exp = t, this;
+  }
+  setIssuedAt(t) {
+    return this.#t.iat = t, this;
+  }
+  setProtectedHeader(t) {
+    return this.#s = t, this;
+  }
+  async sign(t, e) {
+    const s = new i(this.#t.data());
+    if (s.setProtectedHeader(this.#s), Array.isArray(this.#s?.crit) && this.#s.crit.includes("b64") && this.#s.b64 === !1)
+      throw new r("JWTs MUST NOT use unencoded payload");
+    return s.sign(t, e);
+  }
+}
 export {
-  e as COINBASE_SMART_WALLET_FACTORY_ABI,
-  t as COINBASE_SMART_WALLET_FACTORY_ADDRESS
+  d as SignJWT
 };

package/dist/web/index.web109.js

@@ -1,84 +1,51 @@
-import { sliceHex as o, encodePacked as p, encodeAbiParameters as m } from "viem";
-import "@coinbase/cdp-api-client";
-import "./index.web2.js";
-import "./index.web3.js";
-import "jose";
-import "./index.web98.js";
-import "./index.web93.js";
-import { signEvmTypedData as c } from "./index.web31.js";
-import "./index.web99.js";
-import "@solana/web3.js";
-import "bs58";
-async function I(e) {
-  const { smartAccount: t, hash: a, chainId: n, ownerAddress: r } = e, s = u({
-    hash: a,
-    chainId: n,
-    smartAccountAddress: t
-  }), { signature: i } = await c({
-    evmAccount: r,
-    typedData: s
-  });
-  return {
-    signature: y({
-      signatureHex: i
-    })
-  };
-}
-function u({
-  hash: e,
-  chainId: t,
-  smartAccountAddress: a
-}) {
-  return {
-    domain: {
-      name: "Coinbase Smart Wallet",
-      version: "1",
-      chainId: t,
-      verifyingContract: a
-    },
-    types: {
-      EIP712Domain: [
-        { name: "name", type: "string" },
-        { name: "version", type: "string" },
-        { name: "chainId", type: "uint256" },
-        { name: "verifyingContract", type: "address" }
-      ],
-      CoinbaseSmartWalletMessage: [{ name: "hash", type: "bytes32" }]
-    },
-    primaryType: "CoinbaseSmartWalletMessage",
-    message: {
-      hash: e
-    }
-  };
-}
-function y({ signatureHex: e }) {
-  const t = o(e, 0, 32), a = o(e, 32, 64), n = +`0x${e.slice(130, 132)}`, r = p(["bytes32", "bytes32", "uint8"], [t, a, n]);
-  return m(
-    [d],
-    [
+const t = "0xba5ed110efdba3d005bfc882d75358acbbb85842", e = [
+  {
+    inputs: [{ name: "implementation_", type: "address" }],
+    stateMutability: "payable",
+    type: "constructor"
+  },
+  { inputs: [], name: "OwnerRequired", type: "error" },
+  {
+    inputs: [
+      { name: "owners", type: "bytes[]" },
+      { name: "nonce", type: "uint256" }
+    ],
+    name: "createAccount",
+    outputs: [
       {
-        ownerIndex: 0,
-        signatureData: r
+        name: "account",
+        type: "address"
       }
-    ]
-  );
-}
-const d = {
-  components: [
-    {
-      name: "ownerIndex",
-      type: "uint8"
-    },
-    {
-      name: "signatureData",
-      type: "bytes"
-    }
-  ],
-  name: "SignatureWrapper",
-  type: "tuple"
-};
+    ],
+    stateMutability: "payable",
+    type: "function"
+  },
+  {
+    inputs: [
+      { name: "owners", type: "bytes[]" },
+      { name: "nonce", type: "uint256" }
+    ],
+    name: "getAddress",
+    outputs: [{ name: "", type: "address" }],
+    stateMutability: "view",
+    type: "function"
+  },
+  {
+    inputs: [],
+    name: "implementation",
+    outputs: [{ name: "", type: "address" }],
+    stateMutability: "view",
+    type: "function"
+  },
+  {
+    inputs: [],
+    name: "initCodeHash",
+    outputs: [{ name: "", type: "bytes32" }],
+    stateMutability: "view",
+    type: "function"
+  }
+];
 export {
-  u as createReplaySafeTypedData,
-  y as createSmartAccountSignatureWrapper,
-  I as signAndWrapTypedDataForSmartAccount
+  e as COINBASE_SMART_WALLET_FACTORY_ABI,
+  t as COINBASE_SMART_WALLET_FACTORY_ADDRESS
 };

package/dist/web/index.web11.js

@@ -1,6 +1,6 @@
 import { Analytics as t } from "./index.web2.js";
 import "./index.web3.js";
-import { initiateSignIn as n } from "./index.web119.js";
+import { initiateSignIn as n } from "./index.web120.js";
 import "@coinbase/cdp-api-client";
 import "viem";
 const l = async (i) => (t.sendActionCallEvent({ name: "sign_in_with_email" }), n(