@coinbase/cdp-core 0.0.123 → 0.0.125

package/dist/web-types/actions/getEvmBorrowProduct.d.ts

@@ -0,0 +1,22 @@
+import { BorrowProduct } from '@coinbase/cdp-api-client';
+/** Options for fetching a single EVM borrow product by ID. */
+export type GetEvmBorrowProductOptions = {
+    /** The globally unique ID of the borrow product to fetch. */
+    borrowProductId: string;
+};
+/** The result of fetching a single EVM borrow product. */
+export type GetEvmBorrowProductResult = BorrowProduct;
+/**
+ * Gets a single EVM borrow product by its ID.
+ *
+ * @param options - The request parameters including the `borrowProductId`.
+ * @returns The borrow product.
+ *
+ * @example
+ * ```typescript
+ * const borrowProduct = await getEvmBorrowProduct({
+ *   borrowProductId: "bp_07fb56c0-9afe-5440-8ff2-5b0e115458df",
+ * });
+ * ```
+ */
+export declare const getEvmBorrowProduct: (options: GetEvmBorrowProductOptions) => Promise<GetEvmBorrowProductResult>;

package/dist/web-types/actions/initiateMfaVerification.d.ts

@@ -1,4 +1,4 @@
-import { MfaMethod } from '@coinbase/cdp-api-client';
+import { InitiateMfaVerificationResponseWrapper, MfaMethod } from '@coinbase/cdp-api-client';
 /**
  * Request parameters for initiating MFA verification.
  */
@@ -7,6 +7,12 @@ export type InitiateMfaVerificationOptions = {
     mfaMethod: MfaMethod;
     /** Optional idempotency key for safe retries. */
     idempotencyKey?: string;
+    /**
+     * Opaque challenge handle from the MFA listener's context, required when the
+     * project's `verificationScope` is `request`; ignored under `session`. Never
+     * inspected — pass through the value received from the listener unchanged.
+     */
+    challengeId?: string;
 };
 /**
  * Initiates an MFA verification flow for operations requiring MFA.
@@ -28,6 +34,7 @@ export type InitiateMfaVerificationOptions = {
  * await initiateMfaVerification({ mfaMethod: "sms" });
  * // SMS sent to user's phone - prompt for code
  * ```
- * @returns A promise that resolves if MFA initiation is successful.
+ * @returns A promise that resolves with the initiate response (opaque under `session`
+ *   scope, where it resolves to `{}`) once MFA initiation is successful.
  */
-export declare const initiateMfaVerification: (options: InitiateMfaVerificationOptions) => Promise<void>;
+export declare const initiateMfaVerification: (options: InitiateMfaVerificationOptions) => Promise<InitiateMfaVerificationResponseWrapper | void>;

package/dist/web-types/actions/listBorrowPositions.d.ts

@@ -0,0 +1,36 @@
+import { BorrowPosition } from '@coinbase/cdp-api-client';
+import { EvmAddress } from '../types.js';
+/** Options for listing borrow positions for an EVM Smart Account. */
+export type ListBorrowPositionsOptions = {
+    /** The EVM Smart Account to list borrow positions for. */
+    evmSmartAccount: EvmAddress;
+    /** The number of resources to return per page. */
+    pageSize?: number;
+    /** The token for the next page of resources, if any. */
+    pageToken?: string;
+};
+/** A page of borrow positions held by a smart account. */
+export type ListBorrowPositionsResult = {
+    /** The borrow positions held by the smart account. */
+    borrowPositions: BorrowPosition[];
+    /** Whether there are more results available. */
+    hasNextPage: boolean;
+    /** The token for the next page of borrow positions, if any. */
+    nextPageToken: string | undefined;
+};
+/**
+ * Lists the borrow positions held by an EVM Smart Account for the signed-in end
+ * user, with the live onchain state of each position read at a point-in-time
+ * snapshot.
+ *
+ * @param options - The request parameters including the smart account address and optional pagination.
+ * @returns A page of borrow positions, a `hasNextPage` flag, and an optional `nextPageToken` for pagination.
+ *
+ * @example
+ * ```typescript
+ * const { borrowPositions, hasNextPage, nextPageToken } = await listBorrowPositions({
+ *   evmSmartAccount: "0x742d35Cc6634C0532925a3b844Bc454e4438f44e",
+ * });
+ * ```
+ */
+export declare const listBorrowPositions: (options: ListBorrowPositionsOptions) => Promise<ListBorrowPositionsResult>;

package/dist/web-types/actions/listEvmBorrowProducts.d.ts

@@ -0,0 +1,36 @@
+import { BorrowProduct, BorrowProductNetwork, BorrowProductProtocol } from '@coinbase/cdp-api-client';
+/** Options for listing EVM borrow products. */
+export type ListEvmBorrowProductsOptions = {
+    /** The EVM network to list borrow products for. Currently only `"base"` is supported. */
+    network?: BorrowProductNetwork;
+    /** The lending protocol whose borrow products to list. Currently only `"morpho_blue"` is supported. */
+    protocol?: BorrowProductProtocol;
+    /** The number of resources to return per page. */
+    pageSize?: number;
+    /** The token for the next page of resources, if any. */
+    pageToken?: string;
+};
+/** A page of EVM borrow products. */
+export type ListEvmBorrowProductsResult = {
+    /** The EVM borrow products on the requested network and protocol. */
+    borrowProducts: BorrowProduct[];
+    /** Whether there are more results available. */
+    hasNextPage: boolean;
+    /** The token for the next page of borrow products, if any. */
+    nextPageToken: string | undefined;
+};
+/**
+ * Lists the EVM borrow products available to the signed-in end user.
+ *
+ * @param options - The request parameters (network, protocol, optional pagination).
+ * @returns A page of borrow products and an optional `nextPageToken` for pagination.
+ *
+ * @example
+ * ```typescript
+ * const { borrowProducts, nextPageToken } = await listEvmBorrowProducts({
+ *   network: "base",
+ *   protocol: "morpho_blue",
+ * });
+ * ```
+ */
+export declare const listEvmBorrowProducts: (options?: ListEvmBorrowProductsOptions) => Promise<ListEvmBorrowProductsResult>;

package/dist/web-types/actions/refreshUser.d.ts

@@ -0,0 +1,22 @@
+import { User } from '../types.js';
+/**
+ * Re-fetches the signed-in user from the API and writes the result back into shared auth state.
+ *
+ * Unlike {@link getCurrentUser}, which returns the locally cached user (and only re-fetches, without
+ * caching, when `includeBtcXpubs` is set), `refreshUser` reconciles the local auth state with the
+ * server. Use it after accounts are provisioned for the current user out-of-band — i.e. created by a
+ * backend service via the End User API rather than by an in-SDK action such as
+ * `createEvmEoaAccount` / `createSolanaAccount`, which already update the cache themselves.
+ *
+ * Because the refreshed user is written via `setAuthState`, every `useCurrentUser` /
+ * `useEvmAccounts` / `useSolanaAccounts` subscriber re-renders, and subsequent signing actions
+ * (e.g. `signEvmHash`) recognize the newly provisioned accounts instead of throwing
+ * "EVM account not found" against a stale cache.
+ *
+ * This does not request Bitcoin xpubs, so the sensitivity concern that keeps `getCurrentUser`'s
+ * xpub re-fetch out of shared state does not apply here.
+ *
+ * @returns The refreshed user, or null if no user is signed in.
+ * @throws When the network request to re-fetch the user fails.
+ */
+export declare const refreshUser: () => Promise<User | null>;

package/dist/web-types/actions/submitMfaVerification.d.ts

@@ -8,6 +8,12 @@ export type SubmitMfaVerificationOptions = {
     mfaCode: string;
     /** Optional idempotency key for safe retries. */
     idempotencyKey?: string;
+    /**
+     * Opaque challenge handle from the MFA listener's context, required when the
+     * project's `verificationScope` is `request`; ignored under `session`. Never
+     * inspected — pass through the value received from the listener unchanged.
+     */
+    challengeId?: string;
 };
 /**
  * Submits an MFA code to complete the verification process.

package/dist/web-types/actions/verifyPasskey.d.ts

@@ -4,6 +4,12 @@
 export type VerifyPasskeyOptions = {
     /** Optional idempotency key for safe retries. */
     idempotencyKey?: string;
+    /**
+     * Opaque challenge handle from the MFA listener's context, required when the
+     * project's `verificationScope` is `request`; ignored under `session`. Never
+     * inspected — pass through the value received from the listener unchanged.
+     */
+    challengeId?: string;
 };
 /**
  * Completes an MFA verification using an enrolled passkey (WebAuthn).
@@ -23,7 +29,7 @@ export type VerifyPasskeyOptions = {
  * ```typescript
  * await verifyPasskey();
  * ```
- * @returns A promise that resolves if passkey verification is successful.
+ * @returns A promise that resolves once MFA verification is complete.
  * @throws {MfaError} With code `PASSKEY_NOT_SUPPORTED` when passkeys are not available in the current environment.
  * @throws {MfaError} With code `CANCELLED` when the user dismisses the passkey prompt or it times out.
  */

package/dist/web-types/auth/authManager.d.ts

@@ -1,5 +1,16 @@
 import { AuthState, IAuthManager, WalletSecret } from './types.js';
 import { OnAuthStateChangeFn, User } from '../types.js';
+/**
+ * Initialization and platform-specific behavior for standard authentication refreshes.
+ */
+export type AuthManagerOptions = {
+    /** Whether to defer the initial session refresh until ensureInitialized is called. */
+    deferInitialization?: boolean;
+    /** Whether automatic non-transient refresh failures should revoke the remote session. */
+    remoteSignOutOnRefreshFailure?: boolean;
+    /** Whether browser Web Locks should serialize refreshes across contexts. */
+    useBrowserRefreshLock?: boolean;
+};
 /**
  * Manages the authentication state and access token for standard CDP authentication
  * (email/SMS/OAuth flows).
@@ -11,17 +22,20 @@ export declare class AuthManager implements IAuthManager {
     protected authStateChangeCallbacks: OnAuthStateChangeFn[];
     protected initPromise: Promise<void> | null;
     protected refreshTimeout: ReturnType<typeof setTimeout> | null;
+    private refreshAccessTokenPromise;
     private refreshWalletSecretPromise;
+    private remoteSignOutOnRefreshFailure;
+    private useBrowserRefreshLock;
     /**
      * Initializes the token manager.
      *
      * @param projectId - The project ID.
-     * @param options - Options that control initial session refresh behavior.
+     * @param options - Initialization and platform-specific refresh behavior.
      * @param options.deferInitialization - Whether to defer the initial session refresh until ensureInitialized is called.
+     * @param options.remoteSignOutOnRefreshFailure - Whether failed refreshes should revoke the remote session.
+     * @param options.useBrowserRefreshLock - Whether browser refreshes should be serialized across contexts.
      */
-    constructor(projectId: string, options?: {
-        deferInitialization?: boolean;
-    });
+    constructor(projectId: string, options?: AuthManagerOptions);
     /**
      * Gets the current user, or null if there is no user signed in.
      *
@@ -117,15 +131,17 @@ export declare class AuthManager implements IAuthManager {
     protected shouldRefreshToken(): boolean;
     /**
      * Refreshes the access token and transitions the auth state accordingly.
-     * If a refresh is already in progress, it will wait for that refresh to complete.
-     * Retries with exponential backoff on transient failures only. Unauthorized error
-     * short-circuit immediately since retrying won't help.
+     * Concurrent refresh callers in one SDK instance share the same request.
      *
      * @param trigger - The trigger for the refresh.
-     *
-     * @returns The new access token.
      */
     protected refreshAccessToken(trigger?: string): Promise<void>;
+    /**
+     * Performs one serialized refresh cycle.
+     *
+     * @param trigger - The trigger for the refresh.
+     */
+    protected performRefreshAccessToken(trigger: string): Promise<void>;
     /**
      * Schedules a token refresh to occur exactly when shouldRefreshToken() would return true.
      * Uses the same REFRESH_CREDENTIALS_BUFFER_MS timing as the rest of the auth system.

package/dist/web-types/auth/createAuthManager.d.ts

@@ -1,3 +1,4 @@
+import { AuthManagerOptions } from './authManager.js';
 import { IAuthManager } from './types.js';
 /**
  * Creates the appropriate AuthManager instance based on the configuration.
@@ -6,10 +7,10 @@ import { IAuthManager } from './types.js';
  * - Otherwise, returns an AuthManager for standard CDP authentication
  *
  * @param projectId - The project ID.
- * @param options - Options that control initial session refresh behavior.
+ * @param options - Initialization and platform-specific standard-auth refresh behavior.
  * @param options.deferInitialization - Whether to defer the initial session refresh until ensureInitialized is called.
+ * @param options.remoteSignOutOnRefreshFailure - Whether failed refreshes should revoke the remote session.
+ * @param options.useBrowserRefreshLock - Whether browser refreshes should be serialized across contexts.
  * @returns The appropriate AuthManager instance.
  */
-export declare function createAuthManager(projectId: string, options?: {
-    deferInitialization?: boolean;
-}): IAuthManager;
+export declare function createAuthManager(projectId: string, options?: AuthManagerOptions): IAuthManager;

package/dist/web-types/auth/oAuthManager.d.ts

@@ -1,5 +1,5 @@
-import { OAuthFlowState, OnOAuthStateChangeFn } from '../types.js';
 import { IOAuthManager } from './types.js';
+import { OAuthFlowState, OnOAuthStateChangeFn } from '../types.js';
 /**
  * Manages the OAuth flow state and related callbacks.
  */

package/dist/web-types/core.d.ts

@@ -10,6 +10,7 @@ export { verifySiweSignature, type VerifySiweSignatureOptions, type VerifySiweSi
 export { verifyTelegramOAuth } from './actions/verifyTelegramOAuth.js';
 export { authenticateWithJWT } from './actions/authenticateWithJWT.js';
 export { getCurrentUser, type GetCurrentUserOptions } from './actions/getCurrentUser.js';
+export { refreshUser } from './actions/refreshUser.js';
 export { isSignedIn } from './actions/isSignedIn.js';
 export { signOut } from './actions/signOut.js';
 export { getAccessToken } from './actions/getAccessToken.js';

package/dist/web-types/errors.d.ts

@@ -67,7 +67,9 @@ export type MfaErrorCode =
 /** Passkeys (WebAuthn) are not supported in the current environment. */
  | "PASSKEY_NOT_SUPPORTED"
 /** This device already holds a passkey for this account, so it cannot enroll another. */
- | "PASSKEY_ALREADY_ENROLLED";
+ | "PASSKEY_ALREADY_ENROLLED"
+/** MFA cannot be verified ahead of time because the project verifies per request. */
+ | "REQUEST_SCOPE_UNSUPPORTED";
 /**
  * Error thrown when an MFA operation fails.
  */

package/dist/web-types/index.d.ts

@@ -5,7 +5,7 @@ export { type SpendPermissionNetwork } from '@coinbase/cdp-api-client';
 export { revokeSpendPermission, type RevokeSpendPermissionOptions, type RevokeSpendPermissionResult, } from './actions/revokeSpendPermission.js';
 export { enableSpendPermissions, type EnableSpendPermissionsOptions, type EnableSpendPermissionsResult, type EnableSpendPermissionsNetwork, } from './actions/enableSpendPermissions.js';
 export { getCurrentUserSync } from './actions/getCurrentUserSync.js';
-export { fetchWithX402, type FetchWithX402Options, type FetchWithX402ReturnType, } from './actions/fetchWithX402.js';
+export { fetchWithX402, type FetchWithX402Options, type FetchWithX402ReturnType, type X402SchemesConfig, } from './actions/fetchWithX402.js';
 export { linkGoogle } from './actions/linkGoogle.js';
 export { linkSms } from './actions/linkSms.js';
 export { linkEmail } from './actions/linkEmail.js';
@@ -36,12 +36,21 @@ export { sendUsdc, type SendUsdcOptions, type SendUsdcResult, type SendUsdcNetwo
 export { getSwapPrice, type GetSwapPriceOptions, type GetSwapPriceResult, type SwapUnavailableResult, type SwapIssues, } from './actions/getSwapPrice.js';
 export { executeSwap, type ExecuteSwapOptions, type ExecuteSwapResult, type ExecuteEvmEoaSwapResult, type ExecuteEvmSmartSwapResult, } from './actions/executeSwap.js';
 export { EvmSwapsNetwork } from '@coinbase/cdp-api-client';
+export { listEvmBorrowProducts, type ListEvmBorrowProductsOptions, type ListEvmBorrowProductsResult, } from './actions/listEvmBorrowProducts.js';
+export { getEvmBorrowProduct, type GetEvmBorrowProductOptions, type GetEvmBorrowProductResult, } from './actions/getEvmBorrowProduct.js';
+export { createBorrowPosition, type CreateBorrowPositionOptions, type CreateBorrowPositionResult, } from './actions/createBorrowPosition.js';
+export { adjustBorrowPosition, type AdjustBorrowPositionOptions, type AdjustBorrowPositionResult, } from './actions/adjustBorrowPosition.js';
+export { closeBorrowPosition, type CloseBorrowPositionOptions, type CloseBorrowPositionResult, } from './actions/closeBorrowPosition.js';
+export { listBorrowPositions, type ListBorrowPositionsOptions, type ListBorrowPositionsResult, } from './actions/listBorrowPositions.js';
+export { type BorrowPosition, type BorrowPositionAssetAmount, type BorrowPositionDebt, type BorrowPositionHealthStatus, type BorrowPositionOnchainState, type MorphoBlueOnchainState, } from '@coinbase/cdp-api-client';
+export { BorrowProductNetwork, BorrowProductProtocol, type BorrowProduct, type BorrowProductVenue, type BorrowProductToken, type BorrowProductAsset, type BorrowProductAssetCapability, type BorrowProductAssetCapabilityType, type BorrowProductSnapshot, type BorrowProductProtocolDetails, type MorphoBlueProtocolDetails, type MorphoBlueMarketParams, type MorphoBlueProtocolDetailsType, } from '@coinbase/cdp-api-client';
 export { getMfaConfig, type GetMfaConfigResult } from './actions/getMfaConfig.js';
 export { getProjectConfig, type GetProjectConfigResult } from './actions/getProjectConfig.js';
 export { getMfaConfigState, getProjectConfigState } from './state.js';
 export { recordMfaEnrollmentPrompted, type RecordMfaEnrollmentPromptedResult, } from './actions/recordMfaEnrollmentPrompted.js';
 export { initiateMfaEnrollment, type InitiateMfaEnrollmentResult, type InitiateMfaOptions, type InitiateTotpMfaOptions, type InitiateSmsMfaOptions, type InitiateTotpMfaResult, type InitiateSmsMfaResult, } from './actions/initiateMfaEnrollment.js';
 export { submitMfaEnrollment, type SubmitMfaEnrollmentOptions, type SubmitMfaEnrollmentResult, } from './actions/submitMfaEnrollment.js';
+export { enrollPasskey, type EnrollPasskeyOptions, type EnrollPasskeyResult, } from './actions/enrollPasskey.js';
 export { initiateMfaVerification, type InitiateMfaVerificationOptions, } from './actions/initiateMfaVerification.js';
 export { submitMfaVerification, type SubmitMfaVerificationOptions, } from './actions/submitMfaVerification.js';
 export { cancelMfaVerification } from './actions/cancelMfaVerification.js';
@@ -61,4 +70,6 @@ export * from './eip1193/types.js';
 export * from './secureIframe/index.js';
 export { createEvmKeyExportIframe, createSolanaKeyExportIframe, type CreateKeyExportIframeOptions, type CreateKeyExportIframeResult, type SecureIframeStatusDetails, } from './actions/createKeyExportIframe.js';
 export { getConfig } from './state.js';
+export { configurePlatformServices } from './platform/registry.js';
+export { type PlatformStorage, type PlatformStorageOverride, type PlatformServicesOverride, type StorageReadResult, } from './platform/types.js';
 export { toTransactionSigner } from './solana-kit/toTransactionSigner.js';

package/dist/web-types/index.native.d.ts

@@ -10,7 +10,7 @@ export { type SpendPermissionNetwork } from '@coinbase/cdp-api-client';
 export { revokeSpendPermission, type RevokeSpendPermissionOptions, type RevokeSpendPermissionResult, } from './actions/revokeSpendPermission.js';
 export { enableSpendPermissions, type EnableSpendPermissionsOptions, type EnableSpendPermissionsResult, type EnableSpendPermissionsNetwork, } from './actions/enableSpendPermissions.js';
 export { getCurrentUserSync } from './actions/getCurrentUserSync.js';
-export { fetchWithX402, type FetchWithX402Options, type FetchWithX402ReturnType, } from './actions/fetchWithX402.js';
+export { fetchWithX402, type FetchWithX402Options, type FetchWithX402ReturnType, type X402SchemesConfig, } from './actions/fetchWithX402.js';
 export { linkGoogle } from './actions/linkGoogle.js';
 export { linkSms } from './actions/linkSms.js';
 export { linkEmail } from './actions/linkEmail.js';
@@ -40,6 +40,14 @@ export { sendUsdc, type SendUsdcOptions, type SendUsdcResult, type SendUsdcNetwo
 export { getSwapPrice, type GetSwapPriceOptions, type GetSwapPriceResult, type SwapUnavailableResult, type SwapIssues, } from './actions/getSwapPrice.js';
 export { executeSwap, type ExecuteSwapOptions, type ExecuteSwapResult, type ExecuteEvmEoaSwapResult, type ExecuteEvmSmartSwapResult, } from './actions/executeSwap.js';
 export { EvmSwapsNetwork } from '@coinbase/cdp-api-client';
+export { listEvmBorrowProducts, type ListEvmBorrowProductsOptions, type ListEvmBorrowProductsResult, } from './actions/listEvmBorrowProducts.js';
+export { getEvmBorrowProduct, type GetEvmBorrowProductOptions, type GetEvmBorrowProductResult, } from './actions/getEvmBorrowProduct.js';
+export { createBorrowPosition, type CreateBorrowPositionOptions, type CreateBorrowPositionResult, } from './actions/createBorrowPosition.js';
+export { adjustBorrowPosition, type AdjustBorrowPositionOptions, type AdjustBorrowPositionResult, } from './actions/adjustBorrowPosition.js';
+export { closeBorrowPosition, type CloseBorrowPositionOptions, type CloseBorrowPositionResult, } from './actions/closeBorrowPosition.js';
+export { listBorrowPositions, type ListBorrowPositionsOptions, type ListBorrowPositionsResult, } from './actions/listBorrowPositions.js';
+export { type BorrowPosition, type BorrowPositionAssetAmount, type BorrowPositionDebt, type BorrowPositionHealthStatus, type BorrowPositionOnchainState, type MorphoBlueOnchainState, } from '@coinbase/cdp-api-client';
+export { BorrowProductNetwork, BorrowProductProtocol, type BorrowProduct, type BorrowProductVenue, type BorrowProductToken, type BorrowProductAsset, type BorrowProductAssetCapability, type BorrowProductAssetCapabilityType, type BorrowProductSnapshot, type BorrowProductProtocolDetails, type MorphoBlueProtocolDetails, type MorphoBlueMarketParams, type MorphoBlueProtocolDetailsType, } from '@coinbase/cdp-api-client';
 export { getMfaConfig, type GetMfaConfigResult } from './actions/getMfaConfig.js';
 export { getProjectConfig, type GetProjectConfigResult } from './actions/getProjectConfig.js';
 export { getMfaConfigState, getProjectConfigState } from './state.js';
@@ -66,4 +74,5 @@ export { toTransactionSigner } from './solana-kit/toTransactionSigner.js';
 export { registerAttestationModule, type NativeAttestationModule, } from './platform/native/attestationRegistry.js';
 export { registerAppleAuthProvider, type AppleAuthProvider, } from './platform/native/appleAuthRegistry.js';
 export { registerDeviceInfoModule, type NativeDeviceInfoModule, } from './platform/native/deviceInfoRegistry.js';
-export { type AppleNativeCredential } from './platform/types.js';
+export { configurePlatformServices } from './platform/registry.js';
+export { type AppleNativeCredential, type PlatformStorage, type PlatformStorageOverride, type PlatformServicesOverride, type StorageReadResult, } from './platform/types.js';

package/dist/web-types/index.web.d.ts

@@ -10,7 +10,7 @@ export { type SpendPermissionNetwork } from '@coinbase/cdp-api-client';
 export { revokeSpendPermission, type RevokeSpendPermissionOptions, type RevokeSpendPermissionResult, } from './actions/revokeSpendPermission.js';
 export { enableSpendPermissions, type EnableSpendPermissionsOptions, type EnableSpendPermissionsResult, type EnableSpendPermissionsNetwork, } from './actions/enableSpendPermissions.js';
 export { getCurrentUserSync } from './actions/getCurrentUserSync.js';
-export { fetchWithX402, type FetchWithX402Options, type FetchWithX402ReturnType, } from './actions/fetchWithX402.js';
+export { fetchWithX402, type FetchWithX402Options, type FetchWithX402ReturnType, type X402SchemesConfig, } from './actions/fetchWithX402.js';
 export { linkGoogle } from './actions/linkGoogle.js';
 export { linkSms } from './actions/linkSms.js';
 export { linkEmail } from './actions/linkEmail.js';
@@ -40,6 +40,14 @@ export { sendUsdc, type SendUsdcOptions, type SendUsdcResult, type SendUsdcNetwo
 export { getSwapPrice, type GetSwapPriceOptions, type GetSwapPriceResult, type SwapUnavailableResult, type SwapIssues, } from './actions/getSwapPrice.js';
 export { executeSwap, type ExecuteSwapOptions, type ExecuteSwapResult, type ExecuteEvmEoaSwapResult, type ExecuteEvmSmartSwapResult, } from './actions/executeSwap.js';
 export { EvmSwapsNetwork } from '@coinbase/cdp-api-client';
+export { listEvmBorrowProducts, type ListEvmBorrowProductsOptions, type ListEvmBorrowProductsResult, } from './actions/listEvmBorrowProducts.js';
+export { getEvmBorrowProduct, type GetEvmBorrowProductOptions, type GetEvmBorrowProductResult, } from './actions/getEvmBorrowProduct.js';
+export { createBorrowPosition, type CreateBorrowPositionOptions, type CreateBorrowPositionResult, } from './actions/createBorrowPosition.js';
+export { adjustBorrowPosition, type AdjustBorrowPositionOptions, type AdjustBorrowPositionResult, } from './actions/adjustBorrowPosition.js';
+export { closeBorrowPosition, type CloseBorrowPositionOptions, type CloseBorrowPositionResult, } from './actions/closeBorrowPosition.js';
+export { listBorrowPositions, type ListBorrowPositionsOptions, type ListBorrowPositionsResult, } from './actions/listBorrowPositions.js';
+export { type BorrowPosition, type BorrowPositionAssetAmount, type BorrowPositionDebt, type BorrowPositionHealthStatus, type BorrowPositionOnchainState, type MorphoBlueOnchainState, } from '@coinbase/cdp-api-client';
+export { BorrowProductNetwork, BorrowProductProtocol, type BorrowProduct, type BorrowProductVenue, type BorrowProductToken, type BorrowProductAsset, type BorrowProductAssetCapability, type BorrowProductAssetCapabilityType, type BorrowProductSnapshot, type BorrowProductProtocolDetails, type MorphoBlueProtocolDetails, type MorphoBlueMarketParams, type MorphoBlueProtocolDetailsType, } from '@coinbase/cdp-api-client';
 export { getMfaConfig, type GetMfaConfigResult } from './actions/getMfaConfig.js';
 export { getProjectConfig, type GetProjectConfigResult } from './actions/getProjectConfig.js';
 export { getMfaConfigState, getProjectConfigState } from './state.js';
@@ -69,5 +77,7 @@ export * from './eip1193/types.js';
 export * from './secureIframe/index.js';
 export { createEvmKeyExportIframe, createSolanaKeyExportIframe, type CreateKeyExportIframeOptions, type CreateKeyExportIframeResult, type SecureIframeStatusDetails, } from './actions/createKeyExportIframe.js';
 export { getConfig } from './state.js';
+export { configurePlatformServices } from './platform/registry.js';
+export { type PlatformStorage, type PlatformStorageOverride, type PlatformServicesOverride, type StorageReadResult, } from './platform/types.js';
 export { toTransactionSigner } from './solana-kit/toTransactionSigner.js';
 export { isPasskeySupported } from './shared/webauthn.js';

package/dist/web-types/mfa/index.d.ts

@@ -1,4 +1,4 @@
 export { hasPendingMfaVerification, resolvePendingMfaVerification, rejectPendingMfaVerification, triggerMfaVerification, type MfaListener, type MfaVerificationContext, } from './state.js';
 export { getEnabledMfaMethods, getEnrolledMfaMethods, isEnrolledInMfa } from './utils.js';
-export { withMfa, ensureMfaVerified, isMfaRequired } from './withMfa.js';
+export { withMfa, ensureMfaVerified, isMfaRequired, isRequestScope } from './withMfa.js';
 export { MFA_PROTECTED_ACTIONS, MFA_PROTECTED_FUNCTIONS, isMfaProtectedAction, type MfaProtectedAction, } from './protectedActions.js';

package/dist/web-types/mfa/protectedActions.d.ts

@@ -1,6 +1,23 @@
+import { createDelegation } from '../actions/createDelegation.js';
+import { createDelegationForAccount } from '../actions/createDelegationForAccount.js';
 import { createEvmKeyExportIframe, createSolanaKeyExportIframe } from '../actions/createKeyExportIframe.js';
+import { revokeDelegation } from '../actions/revokeDelegation.js';
+import { revokeDelegationForAccount } from '../actions/revokeDelegationForAccount.js';
 import { SignEvmHashOptions, SignEvmHashResult, SignEvmTransactionOptions, SignEvmTransactionResult, SignSolanaTransactionOptions, SignSolanaTransactionResult, SendEvmTransactionOptions, SendEvmTransactionResult, SendSolanaTransactionOptions, SendSolanaTransactionResult, SignEvmMessageOptions, SignSolanaMessageOptions, SignSolanaMessageResult, SignEvmTypedDataOptions, SignEvmTypedDataResult, SendUserOperationOptions, SendUserOperationResult, ExportEvmAccountOptions, ExportEvmAccountResult, ExportSolanaAccountOptions, ExportSolanaAccountResult } from '../types.js';
 import { SignBitcoinHashOptions, SignBitcoinHashResult } from '../actions/signBitcoinHash.js';
+import { AdjustBorrowPositionOptions, AdjustBorrowPositionResult } from '../actions/adjustBorrowPosition.js';
+import { CloseBorrowPositionOptions, CloseBorrowPositionResult } from '../actions/closeBorrowPosition.js';
+import { CreateBorrowPositionOptions, CreateBorrowPositionResult } from '../actions/createBorrowPosition.js';
+import { CreateSpendPermissionOptions, CreateSpendPermissionResult } from '../actions/createSpendPermission.js';
+import { EnableSpendPermissionsOptions, EnableSpendPermissionsResult } from '../actions/enableSpendPermissions.js';
+import { ExecuteSwapOptions, ExecuteSwapResult } from '../actions/executeSwap.js';
+import { RevokeSpendPermissionOptions, RevokeSpendPermissionResult } from '../actions/revokeSpendPermission.js';
+import { SendEvmEoaUsdcOptions, SendEvmEoaUsdcResult } from '../actions/sendEvmEoaUsdc.js';
+import { SendEvmSmartAccountUsdcOptions, SendEvmSmartAccountUsdcResult } from '../actions/sendEvmSmartAccountUsdc.js';
+import { SendSolanaUsdcOptions, SendSolanaUsdcResult } from '../actions/sendSolanaUsdc.js';
+import { EnrollPasskeyOptions, EnrollPasskeyResult } from '../actions/enrollPasskey.js';
+import { InitiateMfaOptions, InitiateMfaEnrollmentResult } from '../actions/initiateMfaEnrollment.js';
+import { SubmitMfaEnrollmentOptions, SubmitMfaEnrollmentResult } from '../actions/submitMfaEnrollment.js';
 /**
  * Map of MFA-protected functions to ensure type safety.
  * If a function is renamed, the import will fail and this file won't compile.
@@ -22,6 +39,23 @@ export declare const MFA_PROTECTED_FUNCTIONS: {
     readonly signBitcoinHash: (options: SignBitcoinHashOptions) => Promise< SignBitcoinHashResult>;
     readonly createEvmKeyExportIframe: typeof createEvmKeyExportIframe;
     readonly createSolanaKeyExportIframe: typeof createSolanaKeyExportIframe;
+    readonly adjustBorrowPosition: (options: AdjustBorrowPositionOptions) => Promise< AdjustBorrowPositionResult>;
+    readonly closeBorrowPosition: (options: CloseBorrowPositionOptions) => Promise< CloseBorrowPositionResult>;
+    readonly createBorrowPosition: (options: CreateBorrowPositionOptions) => Promise< CreateBorrowPositionResult>;
+    readonly createDelegation: typeof createDelegation;
+    readonly createDelegationForAccount: typeof createDelegationForAccount;
+    readonly createSpendPermission: (options: CreateSpendPermissionOptions) => Promise< CreateSpendPermissionResult>;
+    readonly enableSpendPermissions: (options: EnableSpendPermissionsOptions) => Promise< EnableSpendPermissionsResult>;
+    readonly executeSwap: (options: ExecuteSwapOptions) => Promise< ExecuteSwapResult>;
+    readonly revokeDelegation: typeof revokeDelegation;
+    readonly revokeDelegationForAccount: typeof revokeDelegationForAccount;
+    readonly revokeSpendPermission: (options: RevokeSpendPermissionOptions) => Promise< RevokeSpendPermissionResult>;
+    readonly sendEvmEoaUsdc: (options: SendEvmEoaUsdcOptions) => Promise< SendEvmEoaUsdcResult>;
+    readonly sendEvmSmartAccountUsdc: (options: SendEvmSmartAccountUsdcOptions) => Promise< SendEvmSmartAccountUsdcResult>;
+    readonly sendSolanaUsdc: (options: SendSolanaUsdcOptions) => Promise< SendSolanaUsdcResult>;
+    readonly enrollPasskey: (options?: EnrollPasskeyOptions) => Promise< EnrollPasskeyResult>;
+    readonly initiateMfaEnrollment: (options: InitiateMfaOptions) => Promise< InitiateMfaEnrollmentResult>;
+    readonly submitMfaEnrollment: (options: SubmitMfaEnrollmentOptions) => Promise< SubmitMfaEnrollmentResult>;
 };
 /**
  * List of action names that require MFA verification when the user is enrolled.

package/dist/web-types/mfa/state.d.ts

@@ -5,6 +5,12 @@ import { MfaMethod } from '@coinbase/cdp-api-client';
 export type MfaVerificationContext = {
     /** The MFA methods the user has enrolled in. */
     methods: MfaMethod[];
+    /**
+     * Opaque challenge handle from the `X-Mfa-Challenge-Id` response header,
+     * present when the project's `verificationScope` is `request`. Passed through
+     * unexamined to `initiateMfaVerification`/`submitMfaVerification`.
+     */
+    challengeId?: string;
 };
 /**
  * Listener function called when MFA verification is required.
@@ -96,10 +102,15 @@ export declare const hasRegisteredMfaListeners: () => boolean;
  *
  * @param {MfaMethod[]} methods - The MFA methods available for verification.
  * @param {unknown} [trigger] - Optional opaque trigger value used by listener predicates.
+ * @param {object} [context] - Optional opaque request-scope context
+ *   merged into the listener's {@link MfaVerificationContext}. Passed through unexamined.
+ * @param {string} [context.challengeId] - Opaque challenge handle, passed through unexamined.
  * @returns {Promise<void>} A Promise that resolves when MFA is complete.
  * @internal
  */
-export declare const triggerMfaVerification: (methods: MfaMethod[], trigger?: unknown) => Promise<void>;
+export declare const triggerMfaVerification: (methods: MfaMethod[], trigger?: unknown, context?: {
+    challengeId?: string;
+}) => Promise<void>;
 /**
  * Resolves the pending MFA verification Promise.
  * Called internally after successful MFA submission.
@@ -115,6 +126,15 @@ export declare const resolvePendingMfaVerification: () => void;
  * @internal
  */
 export declare const rejectPendingMfaVerification: (error: Error) => void;
+/**
+ * Returns the challenge handle for the pending verification, if the server
+ * minted one. MFA actions default to this so request-scope projects work
+ * without every UI having to thread the handle back from its listener.
+ *
+ * @returns {string | undefined} The pending challenge ID, or undefined under session scope.
+ * @internal
+ */
+export declare const getPendingMfaChallengeId: () => string | undefined;
 /**
  * Checks if there's a pending MFA verification.
  *

package/dist/web-types/mfa/withMfa.d.ts

@@ -1,3 +1,10 @@
+/**
+ * Whether the project verifies MFA per request rather than per session.
+ *
+ * @returns True when the project's verification scope is `request`.
+ * @internal
+ */
+export declare const isRequestScope: () => boolean;
 /**
  * Wraps an async operation to handle MFA verification automatically.
  *
@@ -8,6 +15,13 @@
  * If the operation fails with an `mfa_required` error from the API, it will also
  * trigger the MFA handler and retry the operation after successful verification.
  *
+ * The operation must issue exactly one protected request and must build it from values
+ * computed before the thunk runs. A request-scope approval is bound to a digest of the
+ * request that earned it and is spent once, so the retry is only allowed through as a
+ * byte-identical replay. A salt, timestamp or WebAuthn credential generated inside the
+ * thunk changes that digest and the server rejects the retry too. Two protected requests
+ * therefore need two wrappers, one each, not one wrapper around both.
+ *
  * @param operation - The async operation to wrap.
  * @returns The result of the operation.
  * @internal
@@ -21,6 +35,12 @@ export declare function withMfa<T>(operation: () => Promise<T>): Promise<T>;
  * MFA-protected action will trigger the registered MFA verification handler.
  *
  * Use this to pre-warn users or show UI hints before they start a sensitive flow.
+ * Do not use it to verify ahead of the action: MFA-protected actions prompt and
+ * retry on their own, and under `request` scope the challenge only exists once
+ * the action has been attempted.
+ *
+ * Under `request` scope this returns true for any enrolled user, because every
+ * protected call is verified individually.
  *
  * @returns True if MFA verification will be required for the next sensitive action.
  *
@@ -28,11 +48,10 @@ export declare function withMfa<T>(operation: () => Promise<T>): Promise<T>;
  * ```typescript
  * import { isMfaRequired, signEvmHash } from '@coinbase/cdp-core';
  * async function handleSign() {
- *   // prompt mfa before calling the sign hash function
  *   if (isMfaRequired()) {
- *     await ensureMfaVerified(); // User will be prompted
+ *     showHint("You'll be asked to verify before signing.");
  *   }
- *   await signEvmHash({ ... }); // MFA handled automatically by withMfa
+ *   await signEvmHash({ ... }); // Prompts for MFA and retries automatically
  * }
  * ```
  */

package/dist/web-types/mocks/borrowProduct.d.ts

@@ -0,0 +1,25 @@
+import { BorrowProduct } from '@coinbase/cdp-api-client';
+/** A stable borrow product ID used across the borrow-product action tests. */
+export declare const mockBorrowProductId = "bp_07fb56c0-9afe-5440-8ff2-5b0e115458df";
+/**
+ * A representative Morpho Blue borrow product (cbBTC / USDC on Base) for use in
+ * core action tests. Mirrors the shape returned by the api-client.
+ */
+export declare const mockBorrowProduct: BorrowProduct;
+/**
+ * Builds a borrow product for tests, applying overrides on top of
+ * {@link mockBorrowProduct}. Useful when a test needs a second, distinct
+ * product (e.g. to assert a key change clears stale data).
+ *
+ * @param overrides - The fields to override on the base mock product.
+ * @returns A borrow product with the overrides applied.
+ *
+ * @example
+ * ```typescript
+ * const other = createBorrowProduct({
+ *   borrowProductId: "bp_other",
+ *   name: "WETH / USDC",
+ * });
+ * ```
+ */
+export declare function createBorrowProduct(overrides?: Partial<BorrowProduct>): BorrowProduct;

package/dist/web-types/platform/native/loadOptionalModule.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Converts a module-resolution error from an optional native import into an
+ * installation error naming the package and its `configurePlatformServices`
+ * override. Returns non-resolution errors unchanged.
+ *
+ * Call this from a `catch` wrapping a literal dynamic `import()`. Metro's
+ * optional-dependency detection only recognizes an `import()` that appears
+ * directly inside the `try`, so the import cannot be hidden behind a helper.
+ *
+ * @param error - The error caught from the dynamic import.
+ * @param packageName - The optional package name.
+ * @param overrideHint - The platform service that can replace the optional package.
+ * @returns An installation error for module-resolution failures, or the original error.
+ */
+export declare const toOptionalNativeModuleError: (error: unknown, packageName: string, overrideHint: string) => unknown;

package/dist/web-types/platform/native/storage.d.ts

@@ -4,6 +4,7 @@ import { PlatformStorage } from '../types.js';
  * Uses AsyncStorage for persistent storage.
  *
  * Note: This implementation requires @react-native-async-storage/async-storage
- * to be installed as a peer dependency.
+ * to be installed as a peer dependency. Apps that use a different store supply
+ * their own implementation with `configurePlatformServices({ storage })` instead.
  */
 export declare const nativeStorage: PlatformStorage;