@coinbase/cdp-core 0.0.120 → 0.0.121

package/dist/web/index.web29.js

@@ -11,7 +11,7 @@ import "./index.web99.js";
 import "@solana/web3.js";
 import "bs58";
 import "./index.web93.js";
-import { serializeTransaction as p } from "./index.web126.js";
+import { serializeTransaction as p } from "./index.web127.js";
 const j = async (r) => (e.sendActionCallEvent({ name: "sign_evm_transaction" }), t().useMock ? { signedTransaction: "0x0" } : c(
   () => s(r, m(), async ({ user: n, walletSecretId: i }) => {
     const o = p(r.transaction);

package/dist/web/index.web3.js

@@ -1,2 +1,2 @@
-import { __require as r } from "./index.web210.js";
+import { __require as r } from "./index.web223.js";
 r();

package/dist/web/index.web34.js

@@ -11,7 +11,7 @@ import "./index.web99.js";
 import "@solana/web3.js";
 import "bs58";
 import "./index.web93.js";
-import { serializeTransaction as d } from "./index.web126.js";
+import { serializeTransaction as d } from "./index.web127.js";
 const I = async (r) => {
   if (i.sendActionCallEvent({ name: "send_evm_transaction" }), !p(r.network))
     throw new Error(`Chain ${r.network} is not supported by the CDP Apis`);

package/dist/web/index.web46.js

@@ -2,17 +2,18 @@ import { initiateAuthentication as o } from "@coinbase/cdp-api-client";
 import { Analytics as e } from "./index.web2.js";
 import "./index.web3.js";
 import { getPlatformOAuth as i } from "./index.web5.js";
-import { getCoreAuthManager as n, getConfig as r } from "./index.web74.js";
+import { setPendingOAuthFlowId as n } from "./index.web101.js";
+import { getCoreAuthManager as r, getConfig as a } from "./index.web74.js";
 async function u() {
-  if (e.sendActionCallEvent({ name: "link_google" }), !await n().isSignedIn())
+  if (e.sendActionCallEvent({ name: "link_google" }), !await r().isSignedIn())
     throw new Error("User must be signed in to link a Google account");
-  const t = await o(r().projectId, {
+  const t = await o(a().projectId, {
     type: "google",
     redirectUrl: i().getRedirectUrl()
   });
   if (!("authUrl" in t))
     throw new Error("Failed to initiate Google authentication");
-  i().initiateOAuthFlow(t.authUrl);
+  await n(t.flowId), i().initiateOAuthFlow(t.authUrl);
 }
 export {
   u as linkGoogle

package/dist/web/index.web49.js

@@ -1,21 +1,22 @@
-import { initiateAuthentication as u } from "@coinbase/cdp-api-client";
-import { Analytics as m } from "./index.web2.js";
+import { initiateAuthentication as m } from "@coinbase/cdp-api-client";
+import { Analytics as u } from "./index.web2.js";
 import "./index.web3.js";
 import "jose";
 import "viem";
 import { getPlatformOAuth as n, getPlatformServices as l } from "./index.web5.js";
 import "./index.web98.js";
-import { getCoreAuthManager as c, getConfig as h, getCoreOAuthManager as o } from "./index.web74.js";
-import { verifyTelegramOAuth as w } from "./index.web19.js";
+import { getCoreAuthManager as h, getConfig as c, getCoreOAuthManager as o } from "./index.web74.js";
+import { setPendingOAuthFlowId as w } from "./index.web101.js";
+import { verifyTelegramOAuth as g } from "./index.web19.js";
 import "./index.web93.js";
 import "./index.web99.js";
 import "@solana/web3.js";
 import "bs58";
-async function D(t, a) {
-  if (m.sendActionCallEvent({ name: "link_oauth" }), !await c().isSignedIn())
+async function b(t, a) {
+  if (u.sendActionCallEvent({ name: "link_oauth" }), !await h().isSignedIn())
     throw new Error("User must be signed in to link an OAuth account");
-  const e = await u(
-    h().projectId,
+  const e = await m(
+    c().projectId,
     {
       type: t,
       redirectUrl: n().getRedirectUrl(),
@@ -40,7 +41,7 @@ async function D(t, a) {
         });
         return;
       }
-      await w({ flowId: e.flowId, telegramData: r }), await o().setOAuthFlowState({ providerType: t, status: "success" });
+      await g({ flowId: e.flowId, telegramData: r }), await o().setOAuthFlowState({ providerType: t, status: "success" });
     } catch (r) {
       const s = r instanceof Error ? r.message : "Unknown error";
       throw await o().setOAuthFlowState({
@@ -51,8 +52,8 @@ async function D(t, a) {
     }
     return;
   }
-  n().initiateOAuthFlow(e.authUrl);
+  await w(e.flowId), n().initiateOAuthFlow(e.authUrl);
 }
 export {
-  D as linkOAuth
+  b as linkOAuth
 };

package/dist/web/index.web50.js

@@ -1,13 +1,14 @@
 import { initiateAuthentication as n } from "@coinbase/cdp-api-client";
-import { Analytics as r } from "./index.web2.js";
+import { Analytics as o } from "./index.web2.js";
 import "./index.web3.js";
 import { getPlatformOAuth as i } from "./index.web5.js";
-import { getCoreAuthManager as o, getConfig as a } from "./index.web74.js";
-async function g(e) {
-  if (r.sendActionCallEvent({ name: "link_apple" }), !await o().isSignedIn())
+import { setPendingOAuthFlowId as r } from "./index.web101.js";
+import { getCoreAuthManager as a, getConfig as p } from "./index.web74.js";
+async function u(e) {
+  if (o.sendActionCallEvent({ name: "link_apple" }), !await a().isSignedIn())
     throw new Error("User must be signed in to link an Apple account");
   const t = await n(
-    a().projectId,
+    p().projectId,
     {
       type: "apple",
       redirectUrl: i().getRedirectUrl()
@@ -16,8 +17,8 @@ async function g(e) {
   );
   if (!("authUrl" in t))
     throw new Error("Failed to initiate Apple authentication");
-  i().initiateOAuthFlow(t.authUrl);
+  await r(t.flowId), i().initiateOAuthFlow(t.authUrl);
 }
 export {
-  g as linkApple
+  u as linkApple
 };

package/dist/web/index.web52.js

@@ -1,9 +1,9 @@
 import { createEndUserEvmAccount as m } from "@coinbase/cdp-api-client";
 import { Analytics as u } from "./index.web2.js";
 import "./index.web3.js";
-import { toAuthStateUser as A } from "./index.web101.js";
+import { toAuthStateUser as A } from "./index.web102.js";
 import { InternalError as d } from "./index.web88.js";
-import { validateUserAuthState as h } from "./index.web102.js";
+import { validateUserAuthState as h } from "./index.web103.js";
 import { getCoreAuthManager as f, getConfig as l } from "./index.web74.js";
 async function U(a) {
   u.sendActionCallEvent({ name: "create_evm_eoa_account" });

package/dist/web/index.web53.js

@@ -1,10 +1,10 @@
 import { APIError as A, createEndUserEvmSmartAccount as h } from "@coinbase/cdp-api-client";
 import { Analytics as f } from "./index.web2.js";
 import "./index.web3.js";
-import { toAuthStateUser as l } from "./index.web101.js";
+import { toAuthStateUser as l } from "./index.web102.js";
 import { InternalError as S } from "./index.web88.js";
 import { createEvmEoaAccount as E } from "./index.web52.js";
-import { validateUserAuthState as g } from "./index.web102.js";
+import { validateUserAuthState as g } from "./index.web103.js";
 import { getCoreAuthManager as p, getConfig as v } from "./index.web74.js";
 async function M(r) {
   f.sendActionCallEvent({ name: "create_evm_smart_account" });

package/dist/web/index.web54.js

@@ -1,8 +1,8 @@
 import { createEvmEip7702DelegationWithEndUserAccount as u, getAuthenticatedEndUser as m } from "@coinbase/cdp-api-client";
 import { Analytics as l } from "./index.web2.js";
 import "./index.web3.js";
-import { toAuthStateUser as g } from "./index.web101.js";
-import { validateUserAuthState as A } from "./index.web102.js";
+import { toAuthStateUser as g } from "./index.web102.js";
+import { validateUserAuthState as A } from "./index.web103.js";
 import { getCoreAuthManager as h, getConfig as s } from "./index.web74.js";
 async function v(e) {
   l.sendActionCallEvent({ name: "create_evm_eip7702_delegation" });

package/dist/web/index.web55.js

@@ -1,7 +1,7 @@
 import { getEvmEip7702DelegationOperationByIdWithEndUserAccount as r } from "@coinbase/cdp-api-client";
 import { Analytics as n } from "./index.web2.js";
 import "./index.web3.js";
-import { validateUserAuthState as i } from "./index.web102.js";
+import { validateUserAuthState as i } from "./index.web103.js";
 import { getCoreAuthManager as a, getConfig as p } from "./index.web74.js";
 async function u(e) {
   n.sendActionCallEvent({ name: "get_evm_eip7702_delegation_operation" });

package/dist/web/index.web60.js

@@ -4,7 +4,7 @@ import "./index.web3.js";
 import { withAuth as s } from "./index.web97.js";
 import { InputValidationError as i } from "./index.web88.js";
 import { withMfa as m } from "./index.web82.js";
-import { assertUserOwnsAddress as c } from "./index.web102.js";
+import { assertUserOwnsAddress as c } from "./index.web103.js";
 import { getCoreAuthManager as d, getConfig as f } from "./index.web74.js";
 async function D(e) {
   const t = new Date(e.expiresAt);

package/dist/web/index.web61.js

@@ -2,7 +2,7 @@ import { getDelegationForEndUserAccount as e } from "@coinbase/cdp-api-client";
 import { Analytics as o } from "./index.web2.js";
 import "./index.web3.js";
 import { withAuth as n } from "./index.web97.js";
-import { assertUserOwnsAddress as a } from "./index.web102.js";
+import { assertUserOwnsAddress as a } from "./index.web103.js";
 import { getCoreAuthManager as i, getConfig as s } from "./index.web74.js";
 async function u(t) {
   return o.sendActionCallEvent({ name: "get_delegation_for_account" }), n({}, i(), async ({ user: r }) => (a(r, t.address), await e(r.userId, t.address, {

package/dist/web/index.web62.js

@@ -3,7 +3,7 @@ import { Analytics as n } from "./index.web2.js";
 import "./index.web3.js";
 import { withAuth as a } from "./index.web97.js";
 import { withMfa as i } from "./index.web82.js";
-import { assertUserOwnsAddress as m } from "./index.web102.js";
+import { assertUserOwnsAddress as m } from "./index.web103.js";
 import { getCoreAuthManager as c, getConfig as s } from "./index.web74.js";
 async function h(r) {
   return n.sendActionCallEvent({ name: "revoke_delegation_for_account" }), i(

package/dist/web/index.web63.js

@@ -1,9 +1,9 @@
 import { createEndUserSolanaAccount as u } from "@coinbase/cdp-api-client";
 import { Analytics as l } from "./index.web2.js";
 import "./index.web3.js";
-import { toAuthStateUser as m } from "./index.web101.js";
+import { toAuthStateUser as m } from "./index.web102.js";
 import { InternalError as d } from "./index.web88.js";
-import { validateUserAuthState as A } from "./index.web102.js";
+import { validateUserAuthState as A } from "./index.web103.js";
 import { getCoreAuthManager as h, getConfig as S } from "./index.web74.js";
 async function C(r) {
   l.sendActionCallEvent({ name: "create_solana_account" });

package/dist/web/index.web64.js

@@ -1,9 +1,9 @@
 import { createEndUserBtcAccount as h } from "@coinbase/cdp-api-client";
 import { Analytics as p } from "./index.web2.js";
 import "./index.web3.js";
-import { toAuthStateUser as m } from "./index.web101.js";
+import { toAuthStateUser as m } from "./index.web102.js";
 import { InternalError as o } from "./index.web88.js";
-import { validateUserAuthState as w } from "./index.web102.js";
+import { validateUserAuthState as w } from "./index.web103.js";
 import { getCoreAuthManager as b, getConfig as A } from "./index.web74.js";
 async function U(r) {
   p.sendActionCallEvent({ name: "create_bitcoin_account" });

package/dist/web/index.web70.js

@@ -3,8 +3,8 @@ import { Analytics as A } from "./index.web2.js";
 import "./index.web3.js";
 import { withAuth as k } from "./index.web97.js";
 import { getConfig as a, getCoreAuthManager as c } from "./index.web74.js";
-import { resolveAccount as w } from "./index.web103.js";
-import { validateSwapParams as d } from "./index.web104.js";
+import { resolveAccount as w } from "./index.web104.js";
+import { validateSwapParams as d } from "./index.web105.js";
 const h = async (e) => (A.sendActionCallEvent({ name: "get_swap_price" }), a().useMock ? {
   liquidityAvailable: !0,
   network: e.network,

package/dist/web/index.web71.js

@@ -12,9 +12,9 @@ import "./index.web99.js";
 import "@solana/web3.js";
 import "bs58";
 import "./index.web93.js";
-import { mapSwapApiError as k } from "./index.web105.js";
-import { resolveAccount as l } from "./index.web103.js";
-import { validateSwapParams as y } from "./index.web104.js";
+import { mapSwapApiError as k } from "./index.web106.js";
+import { resolveAccount as l } from "./index.web104.js";
+import { validateSwapParams as y } from "./index.web105.js";
 const B = async (e) => {
   if (c.sendActionCallEvent({ name: "execute_swap" }), n().useMock)
     return {

package/dist/web/index.web75.js

@@ -2,7 +2,7 @@ import { recordMfaEnrollmentPrompted as s } from "@coinbase/cdp-api-client";
 import { Analytics as l } from "./index.web2.js";
 import "./index.web3.js";
 import { withAuth as d } from "./index.web97.js";
-import { validateUserAuthState as p } from "./index.web102.js";
+import { validateUserAuthState as p } from "./index.web103.js";
 import { getConfig as o, getCoreAuthManager as c } from "./index.web74.js";
 const M = async (n) => {
   if (l.sendActionCallEvent({ name: "record_mfa_enrollment_prompted" }), o().useMock)

package/dist/web/index.web76.js

@@ -2,7 +2,7 @@ import { initiateMfaEnrollment2 as a } from "@coinbase/cdp-api-client";
 import { Analytics as c } from "./index.web2.js";
 import "./index.web3.js";
 import { withAuth as u } from "./index.web97.js";
-import { validateUserAuthState as i } from "./index.web102.js";
+import { validateUserAuthState as i } from "./index.web103.js";
 import { getConfig as o, getCoreAuthManager as p } from "./index.web74.js";
 import { validatePhoneNumber as h } from "./index.web89.js";
 async function l(t, e) {

package/dist/web/index.web77.js

@@ -1,10 +1,10 @@
 import { submitMfaEnrollment as s } from "@coinbase/cdp-api-client";
 import { Analytics as u } from "./index.web2.js";
 import "./index.web3.js";
-import { toAuthStateUser as i } from "./index.web101.js";
+import { toAuthStateUser as i } from "./index.web102.js";
 import { withAuth as f } from "./index.web97.js";
-import { mockUser as c } from "./index.web106.js";
-import { validateUserAuthState as l } from "./index.web102.js";
+import { mockUser as c } from "./index.web107.js";
+import { validateUserAuthState as l } from "./index.web103.js";
 import { getConfig as o, getCoreAuthManager as p } from "./index.web74.js";
 const E = async (e) => {
   if (u.sendActionCallEvent({ name: "submit_mfa_enrollment" }), o().useMock)

package/dist/web/index.web85.js

@@ -2,8 +2,8 @@ import { logOutEndUser as f, refreshAccessToken as d, isRefreshTokenUnavailableE
 import { Analytics as i } from "./index.web2.js";
 import "./index.web3.js";
 import "jose";
-import { SignJWT as _ } from "./index.web107.js";
-import { toAuthState as k } from "./index.web101.js";
+import { SignJWT as _ } from "./index.web108.js";
+import { toAuthState as k } from "./index.web102.js";
 import "viem";
 import { getPlatformCrypto as c } from "./index.web5.js";
 import { sortKeys as p } from "./index.web98.js";

package/dist/web/index.web87.js

@@ -13,9 +13,9 @@ import "./index.web93.js";
 import "./index.web99.js";
 import "@solana/web3.js";
 import "bs58";
-import { COINBASE_SMART_WALLET_FACTORY_ADDRESS as v, COINBASE_SMART_WALLET_FACTORY_ABI as w } from "./index.web108.js";
-import { signAndWrapTypedDataForSmartAccount as E } from "./index.web109.js";
-import { toAccount as T } from "./index.web110.js";
+import { COINBASE_SMART_WALLET_FACTORY_ADDRESS as v, COINBASE_SMART_WALLET_FACTORY_ABI as w } from "./index.web109.js";
+import { signAndWrapTypedDataForSmartAccount as E } from "./index.web110.js";
+import { toAccount as T } from "./index.web111.js";
 function U(r) {
   const o = l();
   if (!o || !o.evmAccountObjects?.length && !o.evmSmartAccountObjects?.length)

package/dist/web/index.web9.js

@@ -1,4 +1,4 @@
-const o = "0.0.120";
+const o = "0.0.121";
 export {
   o as VERSION
 };

package/dist/web/index.web90.js

@@ -1,11 +1,11 @@
 import { createStore as a } from "zustand";
-import { subscribeWithSelector as c, persist as d, createJSONStorage as h } from "./index.web111.js";
-import { EventEmitter as f } from "./index.web112.js";
-import "./index.web113.js";
+import { subscribeWithSelector as c, persist as d, createJSONStorage as h } from "./index.web112.js";
+import { EventEmitter as f } from "./index.web113.js";
+import "./index.web114.js";
 import "viem";
 import "@coinbase/cdp-api-client";
 import { getPlatformStorage as u } from "./index.web5.js";
-import { createProvider as g } from "./index.web114.js";
+import { createProvider as g } from "./index.web115.js";
 import { onAuthStateChange as l } from "./index.web26.js";
 import "./index.web2.js";
 import "./index.web3.js";

package/dist/web/index.web99.js

@@ -1,4 +1,4 @@
-import { __require as r } from "./index.web136.js";
+import { __require as r } from "./index.web137.js";
 var f = r();
 export {
   f as b

package/dist/web-types/shared/oauthFlowStorage.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Persists the flow ID for an OAuth flow that is about to redirect out of the app
+ * (e.g. to Google/Apple/X), so it can later be validated against the flow ID
+ * returned on the OAuth callback.
+ *
+ * This is the CSRF "state" binding for the OAuth flow: without it, an attacker can
+ * craft a link containing their own `code`/`flow_id` that a victim's browser would
+ * otherwise silently consume (see `consumePendingOAuthFlowId`).
+ *
+ * @param flowId - The flow ID returned by the backend when initiating the OAuth flow.
+ */
+export declare const setPendingOAuthFlowId: (flowId: string) => Promise<void>;
+/**
+ * Reads and clears the persisted pending OAuth flow ID, if any.
+ *
+ * This is a single-use nonce: it is always removed from storage as part of this
+ * call, regardless of whether the caller ultimately treats it as valid. This
+ * prevents a captured/replayed callback URL from being consumed more than once.
+ *
+ * @returns The persisted flow ID, or null if none was persisted (e.g. no OAuth
+ * flow was initiated by this client, or it was already consumed).
+ */
+export declare const consumePendingOAuthFlowId: () => Promise<string | null>;

package/dist/web-types/version.d.ts

@@ -2,4 +2,4 @@
  * Current version of @coinbase/cdp-core package.
  * This file is auto-generated by scripts/sync-versions.js
  */
-export declare const VERSION = "0.0.120";
+export declare const VERSION = "0.0.121";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coinbase/cdp-core",
-  "version": "0.0.120",
+  "version": "0.0.121",
   "type": "module",
   "files": [
     "dist/**",
@@ -29,7 +29,7 @@
     "ox": "0.8.1",
     "viem": "^2.47.0",
     "zustand": "^5.0.6",
-    "@coinbase/cdp-api-client": "^0.0.120"
+    "@coinbase/cdp-api-client": "^0.0.121"
   },
   "peerDependencies": {
     "@react-native-async-storage/async-storage": "^2.0.0",