@coinbase/cdp-core 0.0.121 → 0.0.122

package/dist/web-types/actions/verifyPasskey.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Options for verifying a passkey (WebAuthn).
+ */
+export type VerifyPasskeyOptions = {
+    /** Optional idempotency key for safe retries. */
+    idempotencyKey?: string;
+};
+/**
+ * Completes an MFA verification using an enrolled passkey (WebAuthn).
+ *
+ * This runs the full WebAuthn authentication ceremony in one call: it initiates
+ * verification with the server to obtain credential request options, prompts the
+ * browser for an assertion via `navigator.credentials.get()`, and submits the
+ * resulting assertion to the server. After successful verification, any pending
+ * operation that was waiting for MFA will automatically continue.
+ *
+ * Passkey MFA is supported in web environments only. Call `isPasskeySupported`
+ * first to check availability before offering passkey verification in your UI.
+ *
+ * @param options - The options for the verification.
+ * @param options.idempotencyKey - Optional idempotency key for safe retries.
+ * @example
+ * ```typescript
+ * await verifyPasskey();
+ * ```
+ * @returns A promise that resolves if passkey verification is successful.
+ * @throws {MfaError} With code `PASSKEY_NOT_SUPPORTED` when passkeys are not available in the current environment.
+ * @throws {MfaError} With code `CANCELLED` when the user dismisses the passkey prompt or it times out.
+ */
+export declare const verifyPasskey: (options?: VerifyPasskeyOptions) => Promise<void>;

package/dist/web-types/errors.d.ts

@@ -63,7 +63,11 @@ export type MfaErrorCode =
 /** No MFA listener is registered to handle verification. */
  | "LISTENER_REQUIRED"
 /** MFA listeners are registered but none matched the trigger value. */
- | "NO_LISTENER_MATCHED";
+ | "NO_LISTENER_MATCHED"
+/** Passkeys (WebAuthn) are not supported in the current environment. */
+ | "PASSKEY_NOT_SUPPORTED"
+/** This device already holds a passkey for this account, so it cannot enroll another. */
+ | "PASSKEY_ALREADY_ENROLLED";
 /**
  * Error thrown when an MFA operation fails.
  */
@@ -77,8 +81,12 @@ export declare class MfaError extends Error {
      *
      * @param code - The error code identifying the type of MFA error.
      * @param message - The error message.
+     * @param options - Additional error options.
+     * @param options.cause - The underlying error this one was mapped from, when there is one.
      */
-    constructor(code: MfaErrorCode, message: string);
+    constructor(code: MfaErrorCode, message: string, options?: {
+        cause?: unknown;
+    });
 }
 /**
  * Error codes for swap-related errors returned by the backend.

package/dist/web-types/index.web.d.ts

@@ -49,6 +49,10 @@ export { submitMfaEnrollment, type SubmitMfaEnrollmentOptions, type SubmitMfaEnr
 export { initiateMfaVerification } from './actions/initiateMfaVerification.js';
 export { submitMfaVerification, type SubmitMfaVerificationOptions, } from './actions/submitMfaVerification.js';
 export { cancelMfaVerification } from './actions/cancelMfaVerification.js';
+export { enrollPasskey, type EnrollPasskeyOptions, type EnrollPasskeyResult, } from './actions/enrollPasskey.js';
+export { verifyPasskey, type VerifyPasskeyOptions } from './actions/verifyPasskey.js';
+export { listPasskeys } from './actions/listPasskeys.js';
+export { deletePasskey } from './actions/deletePasskey.js';
 export { getEnabledMfaMethods, getEnrolledMfaMethods, isEnrolledInMfa, isMfaProtectedAction, isMfaRequired, MFA_PROTECTED_ACTIONS, MFA_PROTECTED_FUNCTIONS, type MfaProtectedAction, type MfaListener, type MfaVerificationContext, } from './mfa/index.js';
 export { registerMfaListener, type MfaListenerOptions } from './mfa/state.web.js';
 export * from './auth/authManager.js';
@@ -66,3 +70,4 @@ export * from './secureIframe/index.js';
 export { createEvmKeyExportIframe, createSolanaKeyExportIframe, type CreateKeyExportIframeOptions, type CreateKeyExportIframeResult, type SecureIframeStatusDetails, } from './actions/createKeyExportIframe.js';
 export { getConfig } from './state.js';
 export { toTransactionSigner } from './solana-kit/toTransactionSigner.js';
+export { isPasskeySupported } from './shared/webauthn.js';

package/dist/web-types/mfa/utils.d.ts

@@ -3,13 +3,13 @@ import { User, MfaMethod } from '../types.js';
  * Gets the list of MFA methods that the user has enrolled in.
  *
  * @param user - The user object.
- * @returns An array of enrolled MFA methods ('totp', 'sms', or both).
+ * @returns An array of enrolled MFA methods, any of 'totp', 'sms', and 'passkey'.
  *
  * @example
  * ```typescript
  * const user = await getCurrentUser();
  * const methods = getEnrolledMfaMethods(user);
- * // methods = ['totp', 'sms']
+ * // methods = ['totp', 'passkey']
  *
  * if (methods.length > 1) {
  *   // Prompt user to choose which method to use
@@ -56,7 +56,7 @@ export declare function isEnrolledInMfa(user: User, method?: MfaMethod): boolean
  * const config = getMfaConfigState();
  * if (config) {
  *   const methods = getEnabledMfaMethods(config);
- *   // methods = ['totp', 'sms']
+ *   // methods = ['totp', 'passkey']
  * }
  * ```
  */

package/dist/web-types/shared/base64url.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Encodes binary data to a URL-safe base64 string (base64url), with no padding.
+ *
+ * URL-safe base64 replaces the standard `+` and `/` characters with `-` and `_`
+ * respectively, and omits the `=` padding. This is the encoding WebAuthn uses for
+ * binary fields (challenge, credential IDs, etc.) when serialized to JSON.
+ *
+ * @param data - The binary data to encode, as an ArrayBuffer or Uint8Array.
+ * @returns The base64url-encoded string (no padding).
+ */
+export declare function encodeBase64url(data: ArrayBuffer | Uint8Array): string;
+/**
+ * Decodes a URL-safe base64 string (base64url) to binary data.
+ *
+ * Accepts input with or without padding, and tolerates the standard base64
+ * alphabet as well. Reverses {@link encodeBase64url}.
+ *
+ * @param base64url - The base64url-encoded string to decode.
+ * @returns The decoded bytes as a Uint8Array.
+ */
+export declare function decodeBase64url(base64url: string): Uint8Array;

package/dist/web-types/shared/webauthn.d.ts

@@ -0,0 +1,121 @@
+/**
+ * The message for a passkey ceremony the user dismissed or let expire. `NotAllowedError` covers
+ * both, deliberately, so that a site cannot tell a dismissal from a timeout.
+ */
+export declare const PASSKEY_PROMPT_DISMISSED = "The passkey prompt was dismissed or timed out.";
+/**
+ * A serialized WebAuthn registration (attestation) credential, produced by
+ * {@link serializeAttestationResponse}. Binary fields are base64url-encoded so the
+ * payload is JSON-safe and can be submitted to the passkey enrollment endpoint.
+ */
+export type SerializedAttestationResponse = {
+    /** The base64url-encoded credential ID. */
+    id: string;
+    /** The base64url-encoded raw credential ID. */
+    rawId: string;
+    /** The credential type, always `"public-key"`. */
+    type: string;
+    /** Client extension results returned by the authenticator. */
+    clientExtensionResults: AuthenticationExtensionsClientOutputs;
+    /** The attestation response payload. */
+    response: {
+        /** The base64url-encoded client data JSON. */
+        clientDataJSON: string;
+        /** The base64url-encoded attestation object. */
+        attestationObject: string;
+        /** The authenticator transports, when reported by the authenticator. */
+        transports?: string[];
+    };
+};
+/**
+ * A serialized WebAuthn authentication (assertion) credential, produced by
+ * {@link serializeAssertionResponse}. Binary fields are base64url-encoded so the
+ * payload is JSON-safe and can be submitted to the passkey verification endpoint.
+ */
+export type SerializedAssertionResponse = {
+    /** The base64url-encoded credential ID. */
+    id: string;
+    /** The base64url-encoded raw credential ID. */
+    rawId: string;
+    /** The credential type, always `"public-key"`. */
+    type: string;
+    /** Client extension results returned by the authenticator. */
+    clientExtensionResults: AuthenticationExtensionsClientOutputs;
+    /** The assertion response payload. */
+    response: {
+        /** The base64url-encoded client data JSON. */
+        clientDataJSON: string;
+        /** The base64url-encoded authenticator data. */
+        authenticatorData: string;
+        /** The base64url-encoded assertion signature. */
+        signature: string;
+        /** The base64url-encoded user handle, when present. */
+        userHandle?: string;
+    };
+};
+/**
+ * The JSON shape of WebAuthn credential creation options as returned by the
+ * server. Binary members (`challenge`, `user.id`, `excludeCredentials[].id`) are
+ * base64url-encoded strings. Passed opaquely to {@link deserializeCreationOptions}.
+ */
+export type CreationOptionsJSON = Record<string, unknown>;
+/**
+ * The JSON shape of WebAuthn credential request options as returned by the
+ * server. Binary members (`challenge`, `allowCredentials[].id`) are base64url-encoded
+ * strings. Passed opaquely to {@link deserializeRequestOptions}.
+ */
+export type RequestOptionsJSON = Record<string, unknown>;
+/**
+ * Detects whether passkeys (WebAuthn platform authenticators) are usable in the
+ * current environment. Returns `false` in non-web environments and when no
+ * user-verifying platform authenticator is available.
+ *
+ * @returns A promise resolving to `true` when passkeys are supported, `false` otherwise.
+ */
+export declare function isPasskeySupported(): Promise<boolean>;
+/**
+ * Maps a rejected WebAuthn ceremony to an {@link MfaError} with a code callers can branch on,
+ * and passes anything it does not recognize through untouched. The browser rejects with a
+ * `DOMException` whose message differs per browser and reads like a spec citation, so the
+ * recognized failures get copy instead.
+ *
+ * @param error - The error the browser rejected `navigator.credentials.create()` or `.get()` with.
+ * @returns The error to throw, mapped when recognized.
+ */
+export declare function mapCeremonyError(error: unknown): unknown;
+/**
+ * Serializes a WebAuthn registration credential (the result of
+ * `navigator.credentials.create()`) into a JSON-safe object with base64url-encoded
+ * binary fields, ready to submit to the passkey enrollment endpoint.
+ *
+ * @param credential - The PublicKeyCredential returned by `navigator.credentials.create()`.
+ * @returns The serialized attestation response.
+ */
+export declare function serializeAttestationResponse(credential: PublicKeyCredential): SerializedAttestationResponse;
+/**
+ * Serializes a WebAuthn authentication credential (the result of
+ * `navigator.credentials.get()`) into a JSON-safe object with base64url-encoded
+ * binary fields, ready to submit to the passkey verification endpoint.
+ *
+ * @param credential - The PublicKeyCredential returned by `navigator.credentials.get()`.
+ * @returns The serialized assertion response.
+ */
+export declare function serializeAssertionResponse(credential: PublicKeyCredential): SerializedAssertionResponse;
+/**
+ * Deserializes server-provided WebAuthn credential creation options (JSON with
+ * base64url-encoded binary members) into a {@link PublicKeyCredentialCreationOptions}
+ * object with `ArrayBuffer` members, ready to pass to `navigator.credentials.create()`.
+ *
+ * @param options - The credential creation options JSON from the server (the `publicKey` member).
+ * @returns The creation options with binary fields decoded to ArrayBuffers.
+ */
+export declare function deserializeCreationOptions(options: CreationOptionsJSON): PublicKeyCredentialCreationOptions;
+/**
+ * Deserializes server-provided WebAuthn credential request options (JSON with
+ * base64url-encoded binary members) into a {@link PublicKeyCredentialRequestOptions}
+ * object with `ArrayBuffer` members, ready to pass to `navigator.credentials.get()`.
+ *
+ * @param options - The credential request options JSON from the server (the `publicKey` member).
+ * @returns The request options with binary fields decoded to ArrayBuffers.
+ */
+export declare function deserializeRequestOptions(options: RequestOptionsJSON): PublicKeyCredentialRequestOptions;

package/dist/web-types/types.d.ts

@@ -1,4 +1,4 @@
-import { SendEvmTransactionWithEndUserAccountBodyNetwork, SendSolanaTransactionWithEndUserAccountBodyNetwork, APIError, APIErrorType, ErrorType, HttpErrorType, EvmUserOperation, EvmCall as EvmUserOperationCall, EvmUserOperationNetwork, EvmUserOperationStatus, OAuth2ProviderType, OAuth2Authentication, TelegramAuthentication, SiweAuthentication, MFAMethods, MfaMethod, EndUserEvmAccount, EndUserSolanaAccount, EndUserEvmSmartAccount, EndUserBtcAccount, CreateEndUserBtcAccountBodyNetwork, UserOperationReceipt, TokenFee, GetEndUserEvmSwapPrice200IssuesAllowance, GetEndUserEvmSwapPrice200IssuesBalance, PaymasterContext } from '@coinbase/cdp-api-client';
+import { SendEvmTransactionWithEndUserAccountBodyNetwork, SendSolanaTransactionWithEndUserAccountBodyNetwork, APIError, APIErrorType, ErrorType, HttpErrorType, EvmUserOperation, EvmCall as EvmUserOperationCall, EvmUserOperationNetwork, EvmUserOperationStatus, OAuth2ProviderType, OAuth2Authentication, TelegramAuthentication, SiweAuthentication, MFAMethods, MfaMethod, PasskeySummary, EndUserEvmAccount, EndUserSolanaAccount, EndUserEvmSmartAccount, EndUserBtcAccount, CreateEndUserBtcAccountBodyNetwork, UserOperationReceipt, TokenFee, GetEndUserEvmSwapPrice200IssuesAllowance, GetEndUserEvmSwapPrice200IssuesBalance, PaymasterContext } from '@coinbase/cdp-api-client';
 import { TransactionSerializableEIP1559 } from 'viem';
 export { 
 /** The API error class */
@@ -15,10 +15,12 @@ SendEvmTransactionWithEndUserAccountBodyNetwork,
 SendSolanaTransactionWithEndUserAccountBodyNetwork, 
 /** The type of OAuth provider to sign in with. */
 OAuth2ProviderType, 
-/** MFA method type (totp or sms) */
+/** MFA method type (totp, sms, or passkey) */
 type MfaMethod, 
 /** MFA methods enrolled for a user */
 type MFAMethods, 
+/** Summary of an enrolled passkey (WebAuthn) credential */
+type PasskeySummary, 
 /** EVM account object with address and createdAt */
 type EndUserEvmAccount, 
 /** Solana account object with address and createdAt */

package/dist/web-types/version.d.ts

@@ -2,4 +2,4 @@
  * Current version of @coinbase/cdp-core package.
  * This file is auto-generated by scripts/sync-versions.js
  */
-export declare const VERSION = "0.0.121";
+export declare const VERSION = "0.0.122";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coinbase/cdp-core",
-  "version": "0.0.121",
+  "version": "0.0.122",
   "type": "module",
   "files": [
     "dist/**",
@@ -29,7 +29,7 @@
     "ox": "0.8.1",
     "viem": "^2.47.0",
     "zustand": "^5.0.6",
-    "@coinbase/cdp-api-client": "^0.0.121"
+    "@coinbase/cdp-api-client": "^0.0.122"
   },
   "peerDependencies": {
     "@react-native-async-storage/async-storage": "^2.0.0",
@@ -63,7 +63,7 @@
       "path": "./dist/esm/index.web.js",
       "running": false,
       "import": "*",
-      "limit": "130 KB"
+      "limit": "131 KB"
     },
     {
       "name": "auth-only",