@coinbase/cdp-core 0.0.122 → 0.0.124

package/dist/esm/index.web88.js

@@ -1,20 +1,58 @@
-import { registerMfaListener as r } from "./index.web4.js";
-const o = /* @__PURE__ */ new Set(), f = (t) => typeof t == "object" && t !== null && typeof t.nodeType == "number", p = (t, i) => {
-  const e = i?.scope;
-  if (!e)
-    return r(t);
-  o.add(e);
-  const c = r(t, { matches: (s) => {
-    if (!f(s) || !e.contains(s)) return !1;
-    for (const n of o)
-      if (n !== e && e.contains(n) && n !== e && n.contains(s))
-        return !1;
-    return !0;
-  } });
-  return () => {
-    o.delete(e), c();
-  };
+import { initiateMfaEnrollment2 as y, submitMfaEnrollment as d } from "@coinbase/cdp-api-client";
+import { Analytics as f } from "./index.web2.js";
+import "./index.web3.js";
+import { toAuthStateUser as h } from "./index.web114.js";
+import { withAuth as S } from "./index.web109.js";
+import { MfaError as i, InternalError as A } from "./index.web99.js";
+import { mockUser as w } from "./index.web119.js";
+import { validateUserAuthState as E } from "./index.web115.js";
+import { isPasskeySupported as k, deserializeCreationOptions as M, mapCeremonyError as P, PASSKEY_PROMPT_DISMISSED as g, serializeAttestationResponse as I } from "./index.web107.js";
+import { getConfig as a, getCoreAuthManager as C } from "./index.web81.js";
+const z = async (t = {}) => {
+  if (f.sendActionCallEvent({ name: "enroll_passkey" }), a().useMock)
+    return { user: w };
+  if (!await k())
+    throw new i(
+      "PASSKEY_NOT_SUPPORTED",
+      "Passkeys are not supported in the current environment."
+    );
+  const e = C(), { authState: m } = E(e.getUser(), e.getAuthState()), p = await S({}, e, async ({ user: n }) => {
+    const s = await y(
+      n.userId,
+      "passkey",
+      { type: "passkey" },
+      { projectID: a().projectId },
+      t.idempotencyKey
+    );
+    if (!s?.creationOptions)
+      throw new A(
+        "Passkey enrollment did not return credential creation options. The server may have started a different MFA method."
+      );
+    const l = M(s.creationOptions);
+    let r;
+    try {
+      r = await navigator.credentials.create({
+        publicKey: l
+      });
+    } catch (u) {
+      throw P(u);
+    }
+    if (!r)
+      throw new i("CANCELLED", g);
+    return d(
+      n.userId,
+      "passkey",
+      {
+        type: "passkey",
+        credential: I(r),
+        ...t.name ? { name: t.name } : {}
+      },
+      { projectID: a().projectId },
+      t.idempotencyKey
+    );
+  }), o = h(p.endUser), c = e.getAuthState() ?? m;
+  return await e.setAuthState({ ...c, user: o }), { user: o };
 };
 export {
-  p as registerMfaListener
+  z as enrollPasskey
 };

package/dist/esm/index.web89.js

@@ -1,356 +1,66 @@
-import { logOutEndUser as f, refreshAccessToken as d, isRefreshTokenUnavailableError as m, isTransientTokenReadError as S, registerTemporaryWalletSecret as w, APIError as y } from "@coinbase/cdp-api-client";
-import { Analytics as i } from "./index.web2.js";
+import { initiateMfaVerification as u, submitMfaVerification as d } from "@coinbase/cdp-api-client";
+import { Analytics as y } from "./index.web2.js";
 import "./index.web3.js";
-import "jose";
-import { SignJWT as _ } from "./index.web113.js";
-import { toAuthState as k } from "./index.web107.js";
-import "viem";
-import { getPlatformCrypto as c } from "./index.web5.js";
-import { sortKeys as p } from "./index.web103.js";
-import { getCoreOAuthManager as T } from "./index.web74.js";
-const l = 60 * 1e3, R = {
-  maxRetries: 3,
-  baseDelayMs: 1e3,
-  maxDelayMs: 1e4
-};
-function g(s, e, r) {
-  const n = e * Math.pow(2, s), o = Math.random() * 0.3 * n;
-  return Math.min(n + o, r);
-}
-function A(s) {
-  return new Promise((e) => setTimeout(e, s));
-}
-function E(s) {
-  if (s instanceof TypeError && s.message.includes("fetch"))
-    return !0;
-  if (s instanceof y) {
-    if (s.statusCode >= 500 && s.statusCode < 600 || s.statusCode === 408 || s.statusCode === 429)
-      return !0;
-    if (s.statusCode === 401)
-      return !1;
-  }
-  if (s instanceof Error) {
-    const e = s.message.toLowerCase();
-    if (e.includes("network") || e.includes("timeout") || e.includes("econnrefused") || e.includes("enotfound") || e.includes("socket"))
-      return !0;
-  }
-  return !1;
-}
-class j {
-  projectId;
-  authState = null;
-  walletSecret = null;
-  authStateChangeCallbacks = [];
-  initPromise = null;
-  refreshTimeout = null;
-  refreshWalletSecretPromise = null;
-  /**
-   * Initializes the token manager.
-   *
-   * @param projectId - The project ID.
-   */
-  constructor(e) {
-    this.projectId = e, this.initPromise = this._doInitialize();
-  }
-  /**
-   * Gets the current user, or null if there is no user signed in.
-   *
-   * @returns The current user.
-   */
-  getUser() {
-    return this.authState?.user ?? null;
-  }
-  /**
-   * Returns whether the user is signed in - i.e., whether there is an unexpired
-   * access token and user. Attempts to refresh the token if it's expired.
-   *
-   * @returns True if the user is signed in, false otherwise.
-   */
-  async isSignedIn() {
-    if (!this.authState)
-      return !1;
-    if (this.authState.expiresAt > Date.now() + l)
-      return !0;
-    try {
-      return await this.getToken() !== null;
-    } catch {
-      return !1;
-    }
-  }
-  /**
-   * Signs out the user, clearing all authentication state.
-   */
-  async signOut() {
-    try {
-      await f(this.projectId);
-    } catch {
-    } finally {
-      await this.clearAuthState();
-    }
-  }
-  /**
-   * Adds a callback to be called when the auth state changes.
-   *
-   * @param callback - The function to call when the auth state changes.
-   */
-  addAuthStateChangeCallback(e) {
-    this.authStateChangeCallbacks.push(e), e(this.authState?.user ?? null);
-  }
-  /**
-   * Gets the access token, refreshing it if it is expired. Returns null if the user is not
-   * signed in.
-   *
-   * @param options - The options for getting the token.
-   * @param options.forceRefresh - Whether to force a refresh of the token.
-   * @returns The access token.
-   */
-  async getToken(e) {
-    return (e?.forceRefresh || this.shouldRefreshToken()) && await this.refreshAccessToken(e?.forceRefresh ? "force" : "on_demand"), this.authState?.accessToken ?? null;
-  }
-  /**
-   * Gets the expiration time of the access token, or null if the user is not signed in.
-   *
-   * @returns The expiration time of the access token.
-   */
-  async getTokenExpiration() {
-    return this.authState?.expiresAt ?? null;
-  }
-  /**
-   * Gets the currently registered wallet secret ID. Rejects if the user is not signed in.
-   *
-   * @returns The wallet secret ID.
-   */
-  async getWalletSecretId() {
-    if (!await this.isSignedIn())
-      throw new Error("Cannot get wallet secret ID if the user is not signed in");
-    return this.shouldRefreshWalletSecret() && await this.refreshWalletSecret(), this.walletSecret.walletSecretId;
-  }
-  /**
-   * Gets the X-Wallet-Auth header. Rejects if the user is not signed in.
-   *
-   * @param options - The options for the request.
-   * @param options.requestMethod - The HTTP method of the request.
-   * @param options.requestHost - The host of the request.
-   * @param options.requestPath - The path of the request.
-   * @param options.requestData - The data of the request.
-   * @returns The X-Wallet-Auth header.
-   */
-  async getXWalletAuth(e) {
-    if (!await this.isSignedIn())
-      throw new Error("Cannot get X-Wallet-Auth header if the user is not signed in");
-    this.shouldRefreshWalletSecret() && await this.refreshWalletSecret();
-    const r = `${e.requestMethod} ${e.requestHost}${e.requestPath}`, n = Math.floor(Date.now() / 1e3), o = c(), a = {
-      uris: [r]
-    };
-    if (e.requestData && Object.keys(e.requestData).length > 0) {
-      const t = p(e.requestData);
-      a.reqHash = await o.hash(new TextEncoder().encode(JSON.stringify(t)));
-    }
-    return await new _(a).setProtectedHeader({ alg: "ES256", typ: "JWT" }).setIssuedAt(n).setNotBefore(n).setJti(o.generateRandomId()).sign(this.walletSecret.keyPair.privateKey);
-  }
-  /**
-   * Gets the authentication state.
-   *
-   * @returns The authentication state.
-   */
-  getAuthState() {
-    return this.authState;
-  }
-  /**
-   * Sets the authentication state.
-   *
-   * @param authState - The authentication state.
-   */
-  async setAuthState(e) {
-    this.authState = e, i.endUserIdentifier = e.user.userId, this.authStateChangeCallbacks.forEach((r) => r(this.authState?.user ?? null)), this.scheduleTokenRefresh();
-  }
-  /**
-   * Clears the authentication state.
-   */
-  async clearAuthState() {
-    this.authState = null, this.walletSecret = null, i.endUserIdentifier = "", this.cancelTokenRefresh(), this.authStateChangeCallbacks.forEach((e) => e(null));
-  }
-  /**
-   * Ensures the AuthManager is initialized before proceeding.
-   * If initialization is already in progress, waits for it to complete.
-   */
-  async ensureInitialized() {
-    if (this.initPromise) {
-      await this.initPromise;
-      return;
-    }
-    throw new Error("AuthManager not initialized");
-  }
-  /**
-   * Internal async initialization logic.
-   */
-  async _doInitialize() {
+import { withAuth as h } from "./index.web109.js";
+import { MfaError as n, InternalError as w } from "./index.web99.js";
+import { resolvePendingMfaVerification as p } from "./index.web4.js";
+import { isPasskeySupported as l, deserializeRequestOptions as S, mapCeremonyError as A, PASSKEY_PROMPT_DISMISSED as M, serializeAssertionResponse as g } from "./index.web107.js";
+import { getConfig as i, getCoreAuthManager as c } from "./index.web81.js";
+const R = async (a = {}) => {
+  if (y.sendActionCallEvent({ name: "verify_passkey" }), i().useMock) {
+    p();
+    return;
+  }
+  if (!await l())
+    throw new n(
+      "PASSKEY_NOT_SUPPORTED",
+      "Passkeys are not supported in the current environment."
+    );
+  await h({}, c(), async ({ user: o }) => {
+    const s = await u(
+      o.userId,
+      "passkey",
+      { projectID: i().projectId },
+      a.idempotencyKey
+    );
+    if (!s?.requestOptions)
+      throw new w(
+        "Passkey verification did not return credential request options. The server may have started a different MFA method."
+      );
+    const f = S(s.requestOptions);
+    let t;
     try {
-      await this.refreshAccessToken("init"), await T().handleOAuthCode();
-    } catch (e) {
-      console.warn("Failed to refresh access token during initialization:", e);
+      t = await navigator.credentials.get({
+        publicKey: f
+      });
+    } catch (m) {
+      throw A(m);
     }
-  }
-  /**
-   * Returns whether the token should be refreshed.
-   *
-   * @returns True if the token should be refreshed, false otherwise.
-   */
-  shouldRefreshToken() {
-    return !(this.authState && this.authState.expiresAt > Date.now() + l);
-  }
-  /**
-   * Refreshes the access token and transitions the auth state accordingly.
-   * If a refresh is already in progress, it will wait for that refresh to complete.
-   * Retries with exponential backoff on transient failures only. Unauthorized error
-   * short-circuit immediately since retrying won't help.
-   *
-   * @param trigger - The trigger for the refresh.
-   *
-   * @returns The new access token.
-   */
-  async refreshAccessToken(e = "on_demand") {
-    const { maxRetries: r, baseDelayMs: n, maxDelayMs: o } = R;
-    i.sendSessionRefreshEvent({
-      name: "refresh_token_start",
-      trigger: e
-    });
-    for (let a = 0; a <= r; a++)
-      try {
-        const t = await d(this.projectId, {
-          grantType: "refresh_token"
-        }), h = k(
-          t.accessToken,
-          t.validUntil,
-          t.endUser
-        );
-        await this.setAuthState(h), i.sendSessionRefreshEvent({
-          name: "refresh_token_success",
-          trigger: e,
-          attempt: a
-        });
-        return;
-      } catch (t) {
-        const h = t instanceof Error ? t.message : String(t);
-        if (m(t)) {
-          if (S(t)) {
-            i.sendSessionRefreshEvent({
-              name: "refresh_token_skipped_transient",
-              trigger: e,
-              attempt: a,
-              read_outcome: t.outcome,
-              error_message: h
-            });
-            return;
-          }
-          i.sendSessionRefreshEvent({
-            name: "refresh_token_failure",
-            trigger: e,
-            attempt: a,
-            error_type: "non_transient",
-            read_outcome: t.outcome,
-            error_message: h
-          }), await this.signOut();
-          return;
+    if (!t)
+      throw new n("CANCELLED", M);
+    await d(
+      o.userId,
+      "passkey",
+      {
+        type: "passkey",
+        credential: g(t)
+      },
+      { projectID: i().projectId },
+      a.idempotencyKey
+    );
+    const r = c(), e = r.getAuthState();
+    e && await r.setAuthState({
+      ...e,
+      user: {
+        ...e.user,
+        mfaMethods: {
+          ...e.user.mfaMethods,
+          lastVerificationCompletedAt: (/* @__PURE__ */ new Date()).toISOString()
         }
-        if (!E(t)) {
-          i.sendSessionRefreshEvent({
-            name: "refresh_token_failure",
-            trigger: e,
-            attempt: a,
-            error_type: "non_transient",
-            error_message: h
-          }), await this.signOut();
-          return;
-        }
-        if (a === r) {
-          i.sendSessionRefreshEvent({
-            name: "refresh_token_exhausted",
-            trigger: e,
-            attempt: a,
-            error_type: "transient",
-            error_message: h
-          });
-          return;
-        }
-        i.sendSessionRefreshEvent({
-          name: "refresh_token_retry",
-          trigger: e,
-          attempt: a,
-          error_type: "transient",
-          error_message: h
-        });
-        const u = g(a, n, o);
-        await A(u);
       }
-  }
-  /**
-   * Schedules a token refresh to occur exactly when shouldRefreshToken() would return true.
-   * Uses the same REFRESH_CREDENTIALS_BUFFER_MS timing as the rest of the auth system.
-   */
-  scheduleTokenRefresh() {
-    if (this.cancelTokenRefresh(), !this.authState)
-      return;
-    const r = this.authState.expiresAt - l - Date.now();
-    r <= 0 || (i.sendSessionRefreshEvent({
-      name: "refresh_token_scheduled",
-      time_until_refresh_ms: r
-    }), this.refreshTimeout = setTimeout(async () => {
-      await this.refreshAccessToken("scheduled"), this.scheduleTokenRefresh();
-    }, r));
-  }
-  /**
-   * Cancels any scheduled token refresh.
-   */
-  cancelTokenRefresh() {
-    this.refreshTimeout && (clearTimeout(this.refreshTimeout), this.refreshTimeout = null);
-  }
-  /**
-   * Returns whether the wallet secret should be refreshed.
-   *
-   * @returns True if the wallet secret should be refreshed, false otherwise.
-   */
-  shouldRefreshWalletSecret() {
-    return !(this.walletSecret && this.walletSecret.expiresAt > Date.now() + l);
-  }
-  /**
-   * Refreshes the wallet secret. Assumes the user is signed in.
-   * Concurrent callers share the same in-flight registration to avoid
-   * racing on `this.walletSecret` (e.g. React Strict Mode double-fire).
-   *
-   * @returns A promise that resolves when the wallet secret is registered.
-   */
-  async refreshWalletSecret() {
-    if (this.refreshWalletSecretPromise)
-      return this.refreshWalletSecretPromise;
-    this.refreshWalletSecretPromise = this._doRefreshWalletSecret();
-    try {
-      await this.refreshWalletSecretPromise;
-    } finally {
-      this.refreshWalletSecretPromise = null;
-    }
-  }
-  /**
-   * Internal wallet secret refresh logic.
-   */
-  async _doRefreshWalletSecret() {
-    const e = c(), r = this.walletSecret?.walletSecretId ?? e.generateRandomId(), n = this.walletSecret?.keyPair ?? await e.createKeyPair(), o = this.authState.expiresAt, a = new Date(o).toISOString();
-    this.walletSecret = { walletSecretId: r, keyPair: n, expiresAt: o };
-    try {
-      await w(
-        this.authState.user.userId,
-        {
-          walletSecretId: r,
-          publicKey: n.publicKeyBase64,
-          validUntil: a
-        },
-        { projectID: this.projectId }
-      );
-    } catch (t) {
-      throw this.walletSecret = null, t;
-    }
-  }
-}
+    }), await r.getToken({ forceRefresh: !0 }), p();
+  });
+};
 export {
-  j as AuthManager
+  R as verifyPasskey
 };

package/dist/esm/index.web9.js

@@ -1,4 +1,4 @@
-const o = "0.0.122";
+const o = "0.0.124";
 export {
   o as VERSION
 };

package/dist/esm/index.web90.js

@@ -1,21 +1,9 @@
-import { APIError as c, ErrorType as u, HttpErrorType as E, OAuth2ProviderType as a, SendEvmTransactionWithEndUserAccountBodyNetwork as d, SendSolanaTransactionWithEndUserAccountBodyNetwork as p } from "@coinbase/cdp-api-client";
-import "viem";
-class e extends Error {
-  /**
-   * Creates a new CustomAuthError.
-   *
-   * @param message - The error message.
-   */
-  constructor(r) {
-    super(r), this.name = "CustomAuthError";
-  }
-}
+import { listPasskeys as e } from "@coinbase/cdp-api-client";
+import { Analytics as r } from "./index.web2.js";
+import "./index.web3.js";
+import { withAuth as o } from "./index.web109.js";
+import { getConfig as s, getCoreAuthManager as n } from "./index.web81.js";
+const l = async () => (r.sendActionCallEvent({ name: "list_passkeys" }), s().useMock ? [] : (await o({}, n(), async ({ user: t }) => e(t.userId, { projectID: s().projectId }))).passkeys);
 export {
-  c as APIError,
-  e as CustomAuthError,
-  u as ErrorType,
-  E as HttpErrorType,
-  a as OAuth2ProviderType,
-  d as SendEvmTransactionWithEndUserAccountBodyNetwork,
-  p as SendSolanaTransactionWithEndUserAccountBodyNetwork
+  l as listPasskeys
 };

package/dist/esm/index.web91.js

@@ -1,135 +1,20 @@
-import { hashTypedData as m, serializeErc6492Signature as u, encodeFunctionData as g, pad as d, getTypesForEIP712Domain as p, hashMessage as A } from "viem";
-import { getCurrentUserSync as l } from "./index.web44.js";
-import "@coinbase/cdp-api-client";
-import "./index.web2.js";
+import { deletePasskey as o } from "@coinbase/cdp-api-client";
+import { Analytics as s } from "./index.web2.js";
 import "./index.web3.js";
-import "jose";
-import "./index.web103.js";
-import { signEvmHash as i } from "./index.web28.js";
-import { signEvmTransaction as h } from "./index.web29.js";
-import { signEvmMessage as f } from "./index.web30.js";
-import { signEvmTypedData as y } from "./index.web31.js";
-import "./index.web97.js";
-import "./index.web104.js";
-import "@solana/web3.js";
-import "bs58";
-import { COINBASE_SMART_WALLET_FACTORY_ADDRESS as v, COINBASE_SMART_WALLET_FACTORY_ABI as w } from "./index.web114.js";
-import { signAndWrapTypedDataForSmartAccount as E } from "./index.web115.js";
-import { toAccount as T } from "./index.web116.js";
-function U(r) {
-  const o = l();
-  if (!o || !o.evmAccountObjects?.length && !o.evmSmartAccountObjects?.length)
-    throw new Error(
-      "No accounts found - user must be authenticated and have at least one EVM account or smart account"
-    );
-  const s = r.toLowerCase(), c = o.evmAccountObjects?.some((e) => e.address.toLowerCase() === s) ?? !1, a = o.evmSmartAccountObjects?.some((e) => e.address.toLowerCase() === s) ?? !1;
-  if (!c && !a)
-    throw new Error(`Cannot sign for address ${r} - not authorized for this account`);
-  return T({
-    address: r,
-    /**
-     * Signs a message using CDP's message signing functionality.
-     * Supports string messages, hex strings, and byte arrays.
-     *
-     * @param root0 - The parameters object
-     * @param root0.message - The message to sign, can be a string, hex string, or byte array
-     * @returns The signature as a hex string
-     */
-    async signMessage({ message: e }) {
-      let t;
-      if (typeof e == "string")
-        t = (await f({
-          evmAccount: r,
-          message: e
-        })).signature;
-      else if ("raw" in e) {
-        const n = A(e);
-        t = (await i({
-          evmAccount: r,
-          hash: n
-        })).signature;
-      } else
-        throw new Error("Unsupported message format");
-      return t;
-    },
-    /**
-     * Signs a transaction using CDP's transaction signing functionality.
-     * Converts Viem's transaction format to CDP's AllowedEvmTransactionType.
-     *
-     * @param transaction - The transaction to sign in Viem's format
-     * @returns The signature as a hex string
-     */
-    async signTransaction(e) {
-      const t = {
-        to: e.to,
-        value: e.value,
-        data: e.data,
-        nonce: e.nonce,
-        gas: e.gas,
-        chainId: e.chainId ?? 1
-      };
-      return e.gasPrice !== void 0 ? (t.maxFeePerGas = e.gasPrice, t.maxPriorityFeePerGas = e.gasPrice) : (t.maxFeePerGas = e.maxFeePerGas, t.maxPriorityFeePerGas = e.maxPriorityFeePerGas), (await h({
-        evmAccount: r,
-        transaction: t
-      })).signedTransaction;
-    },
-    /**
-     * Signs EIP-712 typed data using CDP's typed data signing functionality.
-     * Handles domain separation and type encoding according to the EIP-712 specification.
-     * For smart accounts, implements replay-safe hash and signature wrapping.
-     *
-     * @param params - The typed data parameters following the EIP-712 specification
-     * @returns The signature as a hex string
-     */
-    async signTypedData(e) {
-      if (a) {
-        const t = await E({
-          smartAccount: r,
-          ownerAddress: o.evmAccountObjects?.[0]?.address,
-          hash: m(e),
-          chainId: Number(e.domain.chainId)
-        });
-        return u({
-          address: v,
-          data: g({
-            abi: w,
-            functionName: "createAccount",
-            args: [[d(o.evmAccountObjects?.[0]?.address)], 0n]
-          }),
-          signature: t.signature
-        });
-      } else {
-        const t = {
-          domain: e.domain,
-          types: {
-            EIP712Domain: p({
-              domain: e.domain
-            }),
-            ...e.types
-          },
-          primaryType: e.primaryType,
-          message: e.message
-        };
-        return (await y({
-          evmAccount: r,
-          typedData: t
-        })).signature;
-      }
-    },
-    /**
-     * Signs a raw message hash using CDP's message signing functionality.
-     *
-     * @param message - The message hash to sign
-     * @returns The signature as a hex string
-     */
-    async sign(e) {
-      return (await i({
-        evmAccount: r,
-        hash: e.hash
-      })).signature;
-    }
+import { withAuth as n } from "./index.web109.js";
+import { getConfig as t, getCoreAuthManager as i } from "./index.web81.js";
+const d = async (a) => {
+  if (s.sendActionCallEvent({ name: "delete_passkey" }), t().useMock)
+    return;
+  const e = i();
+  await n({}, e, async ({ user: r }) => {
+    await o(r.userId, a, { projectID: t().projectId });
   });
-}
+  try {
+    await e.getToken({ forceRefresh: !0 });
+  } catch {
+  }
+};
 export {
-  U as toViemAccount
+  d as deletePasskey
 };