@coinbase/cdp-core 0.0.123 → 0.0.125

package/dist/types/mfa/protectedActions.d.ts

@@ -1,6 +1,23 @@
+import { createDelegation } from '../actions/createDelegation.js';
+import { createDelegationForAccount } from '../actions/createDelegationForAccount.js';
 import { createEvmKeyExportIframe, createSolanaKeyExportIframe } from '../actions/createKeyExportIframe.js';
+import { revokeDelegation } from '../actions/revokeDelegation.js';
+import { revokeDelegationForAccount } from '../actions/revokeDelegationForAccount.js';
 import { SignEvmHashOptions, SignEvmHashResult, SignEvmTransactionOptions, SignEvmTransactionResult, SignSolanaTransactionOptions, SignSolanaTransactionResult, SendEvmTransactionOptions, SendEvmTransactionResult, SendSolanaTransactionOptions, SendSolanaTransactionResult, SignEvmMessageOptions, SignSolanaMessageOptions, SignSolanaMessageResult, SignEvmTypedDataOptions, SignEvmTypedDataResult, SendUserOperationOptions, SendUserOperationResult, ExportEvmAccountOptions, ExportEvmAccountResult, ExportSolanaAccountOptions, ExportSolanaAccountResult } from '../types.js';
 import { SignBitcoinHashOptions, SignBitcoinHashResult } from '../actions/signBitcoinHash.js';
+import { AdjustBorrowPositionOptions, AdjustBorrowPositionResult } from '../actions/adjustBorrowPosition.js';
+import { CloseBorrowPositionOptions, CloseBorrowPositionResult } from '../actions/closeBorrowPosition.js';
+import { CreateBorrowPositionOptions, CreateBorrowPositionResult } from '../actions/createBorrowPosition.js';
+import { CreateSpendPermissionOptions, CreateSpendPermissionResult } from '../actions/createSpendPermission.js';
+import { EnableSpendPermissionsOptions, EnableSpendPermissionsResult } from '../actions/enableSpendPermissions.js';
+import { ExecuteSwapOptions, ExecuteSwapResult } from '../actions/executeSwap.js';
+import { RevokeSpendPermissionOptions, RevokeSpendPermissionResult } from '../actions/revokeSpendPermission.js';
+import { SendEvmEoaUsdcOptions, SendEvmEoaUsdcResult } from '../actions/sendEvmEoaUsdc.js';
+import { SendEvmSmartAccountUsdcOptions, SendEvmSmartAccountUsdcResult } from '../actions/sendEvmSmartAccountUsdc.js';
+import { SendSolanaUsdcOptions, SendSolanaUsdcResult } from '../actions/sendSolanaUsdc.js';
+import { EnrollPasskeyOptions, EnrollPasskeyResult } from '../actions/enrollPasskey.js';
+import { InitiateMfaOptions, InitiateMfaEnrollmentResult } from '../actions/initiateMfaEnrollment.js';
+import { SubmitMfaEnrollmentOptions, SubmitMfaEnrollmentResult } from '../actions/submitMfaEnrollment.js';
 /**
  * Map of MFA-protected functions to ensure type safety.
  * If a function is renamed, the import will fail and this file won't compile.
@@ -22,6 +39,23 @@ export declare const MFA_PROTECTED_FUNCTIONS: {
     readonly signBitcoinHash: (options: SignBitcoinHashOptions) => Promise< SignBitcoinHashResult>;
     readonly createEvmKeyExportIframe: typeof createEvmKeyExportIframe;
     readonly createSolanaKeyExportIframe: typeof createSolanaKeyExportIframe;
+    readonly adjustBorrowPosition: (options: AdjustBorrowPositionOptions) => Promise< AdjustBorrowPositionResult>;
+    readonly closeBorrowPosition: (options: CloseBorrowPositionOptions) => Promise< CloseBorrowPositionResult>;
+    readonly createBorrowPosition: (options: CreateBorrowPositionOptions) => Promise< CreateBorrowPositionResult>;
+    readonly createDelegation: typeof createDelegation;
+    readonly createDelegationForAccount: typeof createDelegationForAccount;
+    readonly createSpendPermission: (options: CreateSpendPermissionOptions) => Promise< CreateSpendPermissionResult>;
+    readonly enableSpendPermissions: (options: EnableSpendPermissionsOptions) => Promise< EnableSpendPermissionsResult>;
+    readonly executeSwap: (options: ExecuteSwapOptions) => Promise< ExecuteSwapResult>;
+    readonly revokeDelegation: typeof revokeDelegation;
+    readonly revokeDelegationForAccount: typeof revokeDelegationForAccount;
+    readonly revokeSpendPermission: (options: RevokeSpendPermissionOptions) => Promise< RevokeSpendPermissionResult>;
+    readonly sendEvmEoaUsdc: (options: SendEvmEoaUsdcOptions) => Promise< SendEvmEoaUsdcResult>;
+    readonly sendEvmSmartAccountUsdc: (options: SendEvmSmartAccountUsdcOptions) => Promise< SendEvmSmartAccountUsdcResult>;
+    readonly sendSolanaUsdc: (options: SendSolanaUsdcOptions) => Promise< SendSolanaUsdcResult>;
+    readonly enrollPasskey: (options?: EnrollPasskeyOptions) => Promise< EnrollPasskeyResult>;
+    readonly initiateMfaEnrollment: (options: InitiateMfaOptions) => Promise< InitiateMfaEnrollmentResult>;
+    readonly submitMfaEnrollment: (options: SubmitMfaEnrollmentOptions) => Promise< SubmitMfaEnrollmentResult>;
 };
 /**
  * List of action names that require MFA verification when the user is enrolled.

package/dist/types/mfa/state.d.ts

@@ -5,6 +5,12 @@ import { MfaMethod } from '@coinbase/cdp-api-client';
 export type MfaVerificationContext = {
     /** The MFA methods the user has enrolled in. */
     methods: MfaMethod[];
+    /**
+     * Opaque challenge handle from the `X-Mfa-Challenge-Id` response header,
+     * present when the project's `verificationScope` is `request`. Passed through
+     * unexamined to `initiateMfaVerification`/`submitMfaVerification`.
+     */
+    challengeId?: string;
 };
 /**
  * Listener function called when MFA verification is required.
@@ -96,10 +102,15 @@ export declare const hasRegisteredMfaListeners: () => boolean;
  *
  * @param {MfaMethod[]} methods - The MFA methods available for verification.
  * @param {unknown} [trigger] - Optional opaque trigger value used by listener predicates.
+ * @param {object} [context] - Optional opaque request-scope context
+ *   merged into the listener's {@link MfaVerificationContext}. Passed through unexamined.
+ * @param {string} [context.challengeId] - Opaque challenge handle, passed through unexamined.
  * @returns {Promise<void>} A Promise that resolves when MFA is complete.
  * @internal
  */
-export declare const triggerMfaVerification: (methods: MfaMethod[], trigger?: unknown) => Promise<void>;
+export declare const triggerMfaVerification: (methods: MfaMethod[], trigger?: unknown, context?: {
+    challengeId?: string;
+}) => Promise<void>;
 /**
  * Resolves the pending MFA verification Promise.
  * Called internally after successful MFA submission.
@@ -115,6 +126,15 @@ export declare const resolvePendingMfaVerification: () => void;
  * @internal
  */
 export declare const rejectPendingMfaVerification: (error: Error) => void;
+/**
+ * Returns the challenge handle for the pending verification, if the server
+ * minted one. MFA actions default to this so request-scope projects work
+ * without every UI having to thread the handle back from its listener.
+ *
+ * @returns {string | undefined} The pending challenge ID, or undefined under session scope.
+ * @internal
+ */
+export declare const getPendingMfaChallengeId: () => string | undefined;
 /**
  * Checks if there's a pending MFA verification.
  *

package/dist/types/mfa/withMfa.d.ts

@@ -1,3 +1,10 @@
+/**
+ * Whether the project verifies MFA per request rather than per session.
+ *
+ * @returns True when the project's verification scope is `request`.
+ * @internal
+ */
+export declare const isRequestScope: () => boolean;
 /**
  * Wraps an async operation to handle MFA verification automatically.
  *
@@ -8,6 +15,13 @@
  * If the operation fails with an `mfa_required` error from the API, it will also
  * trigger the MFA handler and retry the operation after successful verification.
  *
+ * The operation must issue exactly one protected request and must build it from values
+ * computed before the thunk runs. A request-scope approval is bound to a digest of the
+ * request that earned it and is spent once, so the retry is only allowed through as a
+ * byte-identical replay. A salt, timestamp or WebAuthn credential generated inside the
+ * thunk changes that digest and the server rejects the retry too. Two protected requests
+ * therefore need two wrappers, one each, not one wrapper around both.
+ *
  * @param operation - The async operation to wrap.
  * @returns The result of the operation.
  * @internal
@@ -21,6 +35,12 @@ export declare function withMfa<T>(operation: () => Promise<T>): Promise<T>;
  * MFA-protected action will trigger the registered MFA verification handler.
  *
  * Use this to pre-warn users or show UI hints before they start a sensitive flow.
+ * Do not use it to verify ahead of the action: MFA-protected actions prompt and
+ * retry on their own, and under `request` scope the challenge only exists once
+ * the action has been attempted.
+ *
+ * Under `request` scope this returns true for any enrolled user, because every
+ * protected call is verified individually.
  *
  * @returns True if MFA verification will be required for the next sensitive action.
  *
@@ -28,11 +48,10 @@ export declare function withMfa<T>(operation: () => Promise<T>): Promise<T>;
  * ```typescript
  * import { isMfaRequired, signEvmHash } from '@coinbase/cdp-core';
  * async function handleSign() {
- *   // prompt mfa before calling the sign hash function
  *   if (isMfaRequired()) {
- *     await ensureMfaVerified(); // User will be prompted
+ *     showHint("You'll be asked to verify before signing.");
  *   }
- *   await signEvmHash({ ... }); // MFA handled automatically by withMfa
+ *   await signEvmHash({ ... }); // Prompts for MFA and retries automatically
  * }
  * ```
  */

package/dist/types/mocks/borrowProduct.d.ts

@@ -0,0 +1,25 @@
+import { BorrowProduct } from '@coinbase/cdp-api-client';
+/** A stable borrow product ID used across the borrow-product action tests. */
+export declare const mockBorrowProductId = "bp_07fb56c0-9afe-5440-8ff2-5b0e115458df";
+/**
+ * A representative Morpho Blue borrow product (cbBTC / USDC on Base) for use in
+ * core action tests. Mirrors the shape returned by the api-client.
+ */
+export declare const mockBorrowProduct: BorrowProduct;
+/**
+ * Builds a borrow product for tests, applying overrides on top of
+ * {@link mockBorrowProduct}. Useful when a test needs a second, distinct
+ * product (e.g. to assert a key change clears stale data).
+ *
+ * @param overrides - The fields to override on the base mock product.
+ * @returns A borrow product with the overrides applied.
+ *
+ * @example
+ * ```typescript
+ * const other = createBorrowProduct({
+ *   borrowProductId: "bp_other",
+ *   name: "WETH / USDC",
+ * });
+ * ```
+ */
+export declare function createBorrowProduct(overrides?: Partial<BorrowProduct>): BorrowProduct;

package/dist/types/platform/native/loadOptionalModule.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Converts a module-resolution error from an optional native import into an
+ * installation error naming the package and its `configurePlatformServices`
+ * override. Returns non-resolution errors unchanged.
+ *
+ * Call this from a `catch` wrapping a literal dynamic `import()`. Metro's
+ * optional-dependency detection only recognizes an `import()` that appears
+ * directly inside the `try`, so the import cannot be hidden behind a helper.
+ *
+ * @param error - The error caught from the dynamic import.
+ * @param packageName - The optional package name.
+ * @param overrideHint - The platform service that can replace the optional package.
+ * @returns An installation error for module-resolution failures, or the original error.
+ */
+export declare const toOptionalNativeModuleError: (error: unknown, packageName: string, overrideHint: string) => unknown;

package/dist/types/platform/native/storage.d.ts

@@ -4,6 +4,7 @@ import { PlatformStorage } from '../types.js';
  * Uses AsyncStorage for persistent storage.
  *
  * Note: This implementation requires @react-native-async-storage/async-storage
- * to be installed as a peer dependency.
+ * to be installed as a peer dependency. Apps that use a different store supply
+ * their own implementation with `configurePlatformServices({ storage })` instead.
  */
 export declare const nativeStorage: PlatformStorage;

package/dist/types/platform/registry.d.ts

@@ -1,4 +1,4 @@
-import { PlatformServices, PlatformCrypto, PlatformStorage, PlatformOAuth, PlatformAttestation } from './types.js';
+import { PlatformAttestation, PlatformCrypto, PlatformOAuth, PlatformServices, PlatformServicesOverride, PlatformStorage } from './types.js';
 /**
  * Registers platform-specific services with the dependency injection container.
  * This should be called once during application initialization, typically by
@@ -17,6 +17,26 @@ import { PlatformServices, PlatformCrypto, PlatformStorage, PlatformOAuth, Platf
  * ```
  */
 export declare function setPlatformServices(services: PlatformServices): void;
+/**
+ * Replaces individual platform services while leaving the rest of the platform
+ * defaults in place.
+ *
+ * Call this once during application startup, after importing `@coinbase/cdp-core`
+ * and before `initialize`. React Native apps use it to supply a storage
+ * implementation when they do not install `@react-native-async-storage/async-storage`.
+ *
+ * Services omitted from `overrides`, or set to `undefined`, keep their current
+ * implementation. Calling this more than once applies each override on top of the
+ * previous state.
+ *
+ * @param overrides - The platform services to replace.
+ * @throws Error if platform services have not been initialized.
+ * @example
+ * ```typescript
+ * configurePlatformServices({ storage: mmkvStorage });
+ * ```
+ */
+export declare function configurePlatformServices(overrides: PlatformServicesOverride): void;
 /**
  * Retrieves the registered platform services.
  * Throws an error if services have not been initialized.

package/dist/types/platform/types.d.ts

@@ -130,6 +130,38 @@ export interface PlatformSecureStorage {
      */
     clear(): Promise<void>;
 }
+/**
+ * A storage implementation supplied by an application in place of a platform default.
+ *
+ * Identical to {@link PlatformStorage} except that `getItemWithOutcome` is optional.
+ * When it is omitted, the SDK derives read outcomes from `getItem`, so an adapter
+ * does not have to classify them itself. Read error messages are reported in SDK
+ * telemetry after truncation to 256 characters, whether they come from a thrown
+ * error or a resolved `error` outcome, so adapters must not include stored values
+ * or key material in error text. The built-in web and native adapters pass their
+ * own bounded module-resolution and storage errors through without truncation,
+ * because those messages are SDK-controlled and already bounded.
+ */
+export type PlatformStorageOverride = Omit<PlatformStorage, "getItemWithOutcome"> & Partial<Pick<PlatformStorage, "getItemWithOutcome">>;
+/**
+ * The platform services an application may replace after the SDK has registered
+ * its platform defaults.
+ *
+ * Only the services named here are replaced. Every service left out keeps the
+ * default the SDK registered for the current platform.
+ */
+export interface PlatformServicesOverride {
+    /**
+     * Storage used for the pending OAuth flow ID, the embedded wallet store, and the
+     * refresh-token mirror on platforms without secure storage.
+     */
+    storage?: PlatformStorageOverride;
+    /**
+     * Secure storage used for the refresh token on native platforms. Supplying this
+     * on web makes `initialize` use native refresh-token failure handling.
+     */
+    secureStorage?: PlatformStorageOverride;
+}
 /**
  * Result of reading a value from storage.
  */

package/dist/types/version.d.ts

@@ -2,4 +2,4 @@
  * Current version of @coinbase/cdp-core package.
  * This file is auto-generated by scripts/sync-versions.js
  */
-export declare const VERSION = "0.0.123";
+export declare const VERSION = "0.0.125";