@coinbase/cdp-core 0.0.124 → 0.0.125

package/dist/web/index.web98.js

@@ -1,23 +1,26 @@
-import { hashTypedData as m, serializeErc6492Signature as u, encodeFunctionData as g, pad as d, getTypesForEIP712Domain as p, hashMessage as A } from "viem";
-import { getCurrentUserSync as l } from "./index.web45.js";
+import { hashTypedData as m, serializeErc6492Signature as u, encodeFunctionData as p, pad as g, getTypesForEIP712Domain as d, hashMessage as A } from "viem";
+import { toAccount as l } from "viem/accounts";
+import { getCurrentUserSync as h } from "./index.web45.js";
 import "@coinbase/cdp-api-client";
 import "./index.web2.js";
 import "./index.web3.js";
 import "jose";
+import "jose/jwt/sign";
 import "./index.web110.js";
 import { signEvmHash as i } from "./index.web29.js";
-import { signEvmTransaction as h } from "./index.web30.js";
-import { signEvmMessage as f } from "./index.web31.js";
-import { signEvmTypedData as y } from "./index.web32.js";
+import { signEvmTransaction as f } from "./index.web30.js";
+import { signEvmMessage as y } from "./index.web31.js";
+import { signEvmTypedData as v } from "./index.web32.js";
 import "./index.web104.js";
+import "./index.web113.js";
+import "viem/utils";
 import "./index.web111.js";
 import "@solana/web3.js";
 import "bs58";
-import { COINBASE_SMART_WALLET_FACTORY_ADDRESS as v, COINBASE_SMART_WALLET_FACTORY_ABI as w } from "./index.web121.js";
-import { signAndWrapTypedDataForSmartAccount as E } from "./index.web122.js";
-import { toAccount as T } from "./index.web123.js";
-function U(r) {
-  const o = l();
+import { COINBASE_SMART_WALLET_FACTORY_ADDRESS as w, COINBASE_SMART_WALLET_FACTORY_ABI as E } from "./index.web120.js";
+import { signAndWrapTypedDataForSmartAccount as T } from "./index.web121.js";
+function H(r) {
+  const o = h();
   if (!o || !o.evmAccountObjects?.length && !o.evmSmartAccountObjects?.length)
     throw new Error(
       "No accounts found - user must be authenticated and have at least one EVM account or smart account"
@@ -25,7 +28,7 @@ function U(r) {
   const s = r.toLowerCase(), c = o.evmAccountObjects?.some((e) => e.address.toLowerCase() === s) ?? !1, a = o.evmSmartAccountObjects?.some((e) => e.address.toLowerCase() === s) ?? !1;
   if (!c && !a)
     throw new Error(`Cannot sign for address ${r} - not authorized for this account`);
-  return T({
+  return l({
     address: r,
     /**
      * Signs a message using CDP's message signing functionality.
@@ -38,7 +41,7 @@ function U(r) {
     async signMessage({ message: e }) {
       let t;
       if (typeof e == "string")
-        t = (await f({
+        t = (await y({
           evmAccount: r,
           message: e
         })).signature;
@@ -68,7 +71,7 @@ function U(r) {
         gas: e.gas,
         chainId: e.chainId ?? 1
       };
-      return e.gasPrice !== void 0 ? (t.maxFeePerGas = e.gasPrice, t.maxPriorityFeePerGas = e.gasPrice) : (t.maxFeePerGas = e.maxFeePerGas, t.maxPriorityFeePerGas = e.maxPriorityFeePerGas), (await h({
+      return e.gasPrice !== void 0 ? (t.maxFeePerGas = e.gasPrice, t.maxPriorityFeePerGas = e.gasPrice) : (t.maxFeePerGas = e.maxFeePerGas, t.maxPriorityFeePerGas = e.maxPriorityFeePerGas), (await f({
         evmAccount: r,
         transaction: t
       })).signedTransaction;
@@ -83,18 +86,18 @@ function U(r) {
      */
     async signTypedData(e) {
       if (a) {
-        const t = await E({
+        const t = await T({
           smartAccount: r,
           ownerAddress: o.evmAccountObjects?.[0]?.address,
           hash: m(e),
           chainId: Number(e.domain.chainId)
         });
         return u({
-          address: v,
-          data: g({
-            abi: w,
+          address: w,
+          data: p({
+            abi: E,
             functionName: "createAccount",
-            args: [[d(o.evmAccountObjects?.[0]?.address)], 0n]
+            args: [[g(o.evmAccountObjects?.[0]?.address)], 0n]
           }),
           signature: t.signature
         });
@@ -102,7 +105,7 @@ function U(r) {
         const t = {
           domain: e.domain,
           types: {
-            EIP712Domain: p({
+            EIP712Domain: d({
               domain: e.domain
             }),
             ...e.types
@@ -110,7 +113,7 @@ function U(r) {
           primaryType: e.primaryType,
           message: e.message
         };
-        return (await y({
+        return (await v({
           evmAccount: r,
           typedData: t
         })).signature;
@@ -131,5 +134,5 @@ function U(r) {
   });
 }
 export {
-  U as toViemAccount
+  H as toViemAccount
 };

package/dist/web-types/actions/fetchWithX402.d.ts

@@ -1,19 +1,52 @@
-import { EvmAddress } from '../types.js';
-import { PaymentRequirementsSelector, X402Config, wrapFetchWithPayment } from 'x402-fetch';
+import { EvmAddress, SolanaAddress } from '../types.js';
+import { PaymentPolicy, x402Client } from '@x402/core/client';
+import { wrapFetchWithPayment } from '@x402/fetch';
+/**
+ * Opt-in/out per x402 payment scheme. `exact`, `upto`, and `authCapture` all
+ * default on.
+ *
+ * `authCapture` only applies to EVM (Base) — it's skipped for a Solana
+ * account regardless of this setting, matching `@x402/svm`'s current scheme
+ * coverage.
+ */
+export type X402SchemesConfig = {
+    /** Registers `ExactEvmScheme` / `ExactSvmScheme`. Defaults to `true`. */
+    exact?: boolean;
+    /** Registers `UptoEvmScheme` / `UptoSvmScheme` (usage-based billing). Defaults to `true`. */
+    upto?: boolean;
+    /** Registers `AuthCaptureEvmScheme` for EVM accounts. Defaults to `true`. */
+    authCapture?: boolean;
+};
 /**
  * Options for the fetchWithX402 function.
  */
 export type FetchWithX402Options = {
-    /** The address of the account to use for the fetch function. */
-    address?: EvmAddress | string;
-    /** The fetch function to use for the fetch function. */
+    /**
+     * The address of the account to use for the fetch function. Pins the
+     * network family — no fallback to the other network is attempted.
+     *
+     * Defaults to the signed-in user's smart account, then EOA, then Solana
+     * account: auto-detection falls back to the Solana account if no EVM
+     * account resolves.
+     */
+    address?: EvmAddress | SolanaAddress | string;
+    /** Custom `fetch` implementation to wrap. Defaults to `globalThis.fetch`. */
     fetch?: typeof globalThis.fetch;
-    /** The maximum allowed payment amount in base units (defaults to 0.1 USDC) */
-    maxValue?: bigint;
-    /** A function that selects the payment requirements from the response */
-    paymentRequirementsSelector?: PaymentRequirementsSelector;
-    /** Optional configuration for X402 operations (e.g., custom RPC URLs) */
-    config?: X402Config;
+    /**
+     * CAIP-2 network id -> RPC URL overrides, e.g.
+     * `{ "eip155:84532": "https://sepolia.base.org" }`. Also registers payment
+     * schemes on any additional `eip155:*` / `solana:*` network supplied here,
+     * on top of the Base mainnet + Solana mainnet baseline that's always
+     * registered.
+     */
+    rpcUrls?: Record<string, string>;
+    /**
+     * Policies registered on the underlying `x402Client`, e.g. to cap spend or
+     * restrict networks/assets.
+     */
+    policies?: PaymentPolicy[];
+    /** Opt-in/out per payment scheme. See {@link X402SchemesConfig}. */
+    schemes?: X402SchemesConfig;
 };
 /**
  * Return type for the fetchWithX402 function.
@@ -21,13 +54,38 @@ export type FetchWithX402Options = {
 export type FetchWithX402ReturnType = {
     /** The wrapped fetch function with payment handling. */
     fetchWithPayment: ReturnType<typeof wrapFetchWithPayment>;
+    /** The lazily initialized `x402Client` for advanced configuration. */
+    client: Promise<x402Client>;
 };
 /**
- * Hook that provides a wrapped fetch function with payment handling.
+ * Imports an x402 peer dependency, adding installation guidance when the
+ * module can't be resolved. Runtime errors thrown by an already-installed
+ * module (e.g. a bug surfaced while evaluating it) are re-thrown as-is,
+ * since installation guidance would be misleading there.
+ *
+ * Exported (but not part of the public SDK surface — not re-exported from
+ * any index) so this classification can be unit tested directly without
+ * fighting test-mocking frameworks' own module-loading error handling.
+ *
+ * @param specifier - The module specifier being imported, for the error message.
+ * @param loader - Thunk performing the dynamic `import()`, so callers keep accurate typing.
+ * @returns The imported module's exports.
+ */
+export declare function importX402Dependency<T>(specifier: string, loader: () => Promise<T>): Promise<T>;
+/**
+ * Provides a wrapped fetch function with x402 (v2) payment handling, backed
+ * by the current CDP embedded wallet user's EVM or Solana account.
+ *
+ * Builds an `x402Client` and registers payment schemes on it: for an EVM
+ * account, `exact`/`upto`/`authCapture` on Base; for a Solana account,
+ * `exact`/`upto` on Solana. See {@link X402SchemesConfig}.
  *
  * @param options - Configuration object for the fetch function
  * @param options.address - The address to use for the fetch function
- * @returns A wrapped fetch function with payment handling
+ * @param options.rpcUrls - CAIP-2 network id -> RPC URL overrides
+ * @param options.policies - Policies to register on the underlying `x402Client`
+ * @param options.schemes - Opt-in/out per payment scheme
+ * @returns A wrapped fetch function with payment handling, and the underlying `x402Client`
  *
  * @example
  * ```tsx lines
@@ -36,5 +94,14 @@ export type FetchWithX402ReturnType = {
  *   method: "GET",
  * });
  * ```
+ *
+ * @example
+ * ```tsx lines
+ * // Also register Base Sepolia (e.g. for local testing) and disable authCapture.
+ * const { fetchWithPayment } = fetchWithX402({
+ *   rpcUrls: { "eip155:84532": "https://sepolia.base.org" },
+ *   schemes: { authCapture: false },
+ * });
+ * ```
  */
 export declare function fetchWithX402(options?: FetchWithX402Options): FetchWithX402ReturnType;

package/dist/web-types/actions/initiateMfaVerification.d.ts

@@ -1,4 +1,4 @@
-import { MfaMethod } from '@coinbase/cdp-api-client';
+import { InitiateMfaVerificationResponseWrapper, MfaMethod } from '@coinbase/cdp-api-client';
 /**
  * Request parameters for initiating MFA verification.
  */
@@ -7,6 +7,12 @@ export type InitiateMfaVerificationOptions = {
     mfaMethod: MfaMethod;
     /** Optional idempotency key for safe retries. */
     idempotencyKey?: string;
+    /**
+     * Opaque challenge handle from the MFA listener's context, required when the
+     * project's `verificationScope` is `request`; ignored under `session`. Never
+     * inspected — pass through the value received from the listener unchanged.
+     */
+    challengeId?: string;
 };
 /**
  * Initiates an MFA verification flow for operations requiring MFA.
@@ -28,6 +34,7 @@ export type InitiateMfaVerificationOptions = {
  * await initiateMfaVerification({ mfaMethod: "sms" });
  * // SMS sent to user's phone - prompt for code
  * ```
- * @returns A promise that resolves if MFA initiation is successful.
+ * @returns A promise that resolves with the initiate response (opaque under `session`
+ *   scope, where it resolves to `{}`) once MFA initiation is successful.
  */
-export declare const initiateMfaVerification: (options: InitiateMfaVerificationOptions) => Promise<void>;
+export declare const initiateMfaVerification: (options: InitiateMfaVerificationOptions) => Promise<InitiateMfaVerificationResponseWrapper | void>;

package/dist/web-types/actions/submitMfaVerification.d.ts

@@ -8,6 +8,12 @@ export type SubmitMfaVerificationOptions = {
     mfaCode: string;
     /** Optional idempotency key for safe retries. */
     idempotencyKey?: string;
+    /**
+     * Opaque challenge handle from the MFA listener's context, required when the
+     * project's `verificationScope` is `request`; ignored under `session`. Never
+     * inspected — pass through the value received from the listener unchanged.
+     */
+    challengeId?: string;
 };
 /**
  * Submits an MFA code to complete the verification process.

package/dist/web-types/actions/verifyPasskey.d.ts

@@ -4,6 +4,12 @@
 export type VerifyPasskeyOptions = {
     /** Optional idempotency key for safe retries. */
     idempotencyKey?: string;
+    /**
+     * Opaque challenge handle from the MFA listener's context, required when the
+     * project's `verificationScope` is `request`; ignored under `session`. Never
+     * inspected — pass through the value received from the listener unchanged.
+     */
+    challengeId?: string;
 };
 /**
  * Completes an MFA verification using an enrolled passkey (WebAuthn).
@@ -23,7 +29,7 @@ export type VerifyPasskeyOptions = {
  * ```typescript
  * await verifyPasskey();
  * ```
- * @returns A promise that resolves if passkey verification is successful.
+ * @returns A promise that resolves once MFA verification is complete.
  * @throws {MfaError} With code `PASSKEY_NOT_SUPPORTED` when passkeys are not available in the current environment.
  * @throws {MfaError} With code `CANCELLED` when the user dismisses the passkey prompt or it times out.
  */

package/dist/web-types/auth/oAuthManager.d.ts

@@ -1,5 +1,5 @@
-import { OAuthFlowState, OnOAuthStateChangeFn } from '../types.js';
 import { IOAuthManager } from './types.js';
+import { OAuthFlowState, OnOAuthStateChangeFn } from '../types.js';
 /**
  * Manages the OAuth flow state and related callbacks.
  */

package/dist/web-types/errors.d.ts

@@ -67,7 +67,9 @@ export type MfaErrorCode =
 /** Passkeys (WebAuthn) are not supported in the current environment. */
  | "PASSKEY_NOT_SUPPORTED"
 /** This device already holds a passkey for this account, so it cannot enroll another. */
- | "PASSKEY_ALREADY_ENROLLED";
+ | "PASSKEY_ALREADY_ENROLLED"
+/** MFA cannot be verified ahead of time because the project verifies per request. */
+ | "REQUEST_SCOPE_UNSUPPORTED";
 /**
  * Error thrown when an MFA operation fails.
  */

package/dist/web-types/index.d.ts

@@ -5,7 +5,7 @@ export { type SpendPermissionNetwork } from '@coinbase/cdp-api-client';
 export { revokeSpendPermission, type RevokeSpendPermissionOptions, type RevokeSpendPermissionResult, } from './actions/revokeSpendPermission.js';
 export { enableSpendPermissions, type EnableSpendPermissionsOptions, type EnableSpendPermissionsResult, type EnableSpendPermissionsNetwork, } from './actions/enableSpendPermissions.js';
 export { getCurrentUserSync } from './actions/getCurrentUserSync.js';
-export { fetchWithX402, type FetchWithX402Options, type FetchWithX402ReturnType, } from './actions/fetchWithX402.js';
+export { fetchWithX402, type FetchWithX402Options, type FetchWithX402ReturnType, type X402SchemesConfig, } from './actions/fetchWithX402.js';
 export { linkGoogle } from './actions/linkGoogle.js';
 export { linkSms } from './actions/linkSms.js';
 export { linkEmail } from './actions/linkEmail.js';
@@ -50,6 +50,7 @@ export { getMfaConfigState, getProjectConfigState } from './state.js';
 export { recordMfaEnrollmentPrompted, type RecordMfaEnrollmentPromptedResult, } from './actions/recordMfaEnrollmentPrompted.js';
 export { initiateMfaEnrollment, type InitiateMfaEnrollmentResult, type InitiateMfaOptions, type InitiateTotpMfaOptions, type InitiateSmsMfaOptions, type InitiateTotpMfaResult, type InitiateSmsMfaResult, } from './actions/initiateMfaEnrollment.js';
 export { submitMfaEnrollment, type SubmitMfaEnrollmentOptions, type SubmitMfaEnrollmentResult, } from './actions/submitMfaEnrollment.js';
+export { enrollPasskey, type EnrollPasskeyOptions, type EnrollPasskeyResult, } from './actions/enrollPasskey.js';
 export { initiateMfaVerification, type InitiateMfaVerificationOptions, } from './actions/initiateMfaVerification.js';
 export { submitMfaVerification, type SubmitMfaVerificationOptions, } from './actions/submitMfaVerification.js';
 export { cancelMfaVerification } from './actions/cancelMfaVerification.js';

package/dist/web-types/index.native.d.ts

@@ -10,7 +10,7 @@ export { type SpendPermissionNetwork } from '@coinbase/cdp-api-client';
 export { revokeSpendPermission, type RevokeSpendPermissionOptions, type RevokeSpendPermissionResult, } from './actions/revokeSpendPermission.js';
 export { enableSpendPermissions, type EnableSpendPermissionsOptions, type EnableSpendPermissionsResult, type EnableSpendPermissionsNetwork, } from './actions/enableSpendPermissions.js';
 export { getCurrentUserSync } from './actions/getCurrentUserSync.js';
-export { fetchWithX402, type FetchWithX402Options, type FetchWithX402ReturnType, } from './actions/fetchWithX402.js';
+export { fetchWithX402, type FetchWithX402Options, type FetchWithX402ReturnType, type X402SchemesConfig, } from './actions/fetchWithX402.js';
 export { linkGoogle } from './actions/linkGoogle.js';
 export { linkSms } from './actions/linkSms.js';
 export { linkEmail } from './actions/linkEmail.js';

package/dist/web-types/index.web.d.ts

@@ -10,7 +10,7 @@ export { type SpendPermissionNetwork } from '@coinbase/cdp-api-client';
 export { revokeSpendPermission, type RevokeSpendPermissionOptions, type RevokeSpendPermissionResult, } from './actions/revokeSpendPermission.js';
 export { enableSpendPermissions, type EnableSpendPermissionsOptions, type EnableSpendPermissionsResult, type EnableSpendPermissionsNetwork, } from './actions/enableSpendPermissions.js';
 export { getCurrentUserSync } from './actions/getCurrentUserSync.js';
-export { fetchWithX402, type FetchWithX402Options, type FetchWithX402ReturnType, } from './actions/fetchWithX402.js';
+export { fetchWithX402, type FetchWithX402Options, type FetchWithX402ReturnType, type X402SchemesConfig, } from './actions/fetchWithX402.js';
 export { linkGoogle } from './actions/linkGoogle.js';
 export { linkSms } from './actions/linkSms.js';
 export { linkEmail } from './actions/linkEmail.js';

package/dist/web-types/mfa/index.d.ts

@@ -1,4 +1,4 @@
 export { hasPendingMfaVerification, resolvePendingMfaVerification, rejectPendingMfaVerification, triggerMfaVerification, type MfaListener, type MfaVerificationContext, } from './state.js';
 export { getEnabledMfaMethods, getEnrolledMfaMethods, isEnrolledInMfa } from './utils.js';
-export { withMfa, ensureMfaVerified, isMfaRequired } from './withMfa.js';
+export { withMfa, ensureMfaVerified, isMfaRequired, isRequestScope } from './withMfa.js';
 export { MFA_PROTECTED_ACTIONS, MFA_PROTECTED_FUNCTIONS, isMfaProtectedAction, type MfaProtectedAction, } from './protectedActions.js';

package/dist/web-types/mfa/protectedActions.d.ts

@@ -1,6 +1,23 @@
+import { createDelegation } from '../actions/createDelegation.js';
+import { createDelegationForAccount } from '../actions/createDelegationForAccount.js';
 import { createEvmKeyExportIframe, createSolanaKeyExportIframe } from '../actions/createKeyExportIframe.js';
+import { revokeDelegation } from '../actions/revokeDelegation.js';
+import { revokeDelegationForAccount } from '../actions/revokeDelegationForAccount.js';
 import { SignEvmHashOptions, SignEvmHashResult, SignEvmTransactionOptions, SignEvmTransactionResult, SignSolanaTransactionOptions, SignSolanaTransactionResult, SendEvmTransactionOptions, SendEvmTransactionResult, SendSolanaTransactionOptions, SendSolanaTransactionResult, SignEvmMessageOptions, SignSolanaMessageOptions, SignSolanaMessageResult, SignEvmTypedDataOptions, SignEvmTypedDataResult, SendUserOperationOptions, SendUserOperationResult, ExportEvmAccountOptions, ExportEvmAccountResult, ExportSolanaAccountOptions, ExportSolanaAccountResult } from '../types.js';
 import { SignBitcoinHashOptions, SignBitcoinHashResult } from '../actions/signBitcoinHash.js';
+import { AdjustBorrowPositionOptions, AdjustBorrowPositionResult } from '../actions/adjustBorrowPosition.js';
+import { CloseBorrowPositionOptions, CloseBorrowPositionResult } from '../actions/closeBorrowPosition.js';
+import { CreateBorrowPositionOptions, CreateBorrowPositionResult } from '../actions/createBorrowPosition.js';
+import { CreateSpendPermissionOptions, CreateSpendPermissionResult } from '../actions/createSpendPermission.js';
+import { EnableSpendPermissionsOptions, EnableSpendPermissionsResult } from '../actions/enableSpendPermissions.js';
+import { ExecuteSwapOptions, ExecuteSwapResult } from '../actions/executeSwap.js';
+import { RevokeSpendPermissionOptions, RevokeSpendPermissionResult } from '../actions/revokeSpendPermission.js';
+import { SendEvmEoaUsdcOptions, SendEvmEoaUsdcResult } from '../actions/sendEvmEoaUsdc.js';
+import { SendEvmSmartAccountUsdcOptions, SendEvmSmartAccountUsdcResult } from '../actions/sendEvmSmartAccountUsdc.js';
+import { SendSolanaUsdcOptions, SendSolanaUsdcResult } from '../actions/sendSolanaUsdc.js';
+import { EnrollPasskeyOptions, EnrollPasskeyResult } from '../actions/enrollPasskey.js';
+import { InitiateMfaOptions, InitiateMfaEnrollmentResult } from '../actions/initiateMfaEnrollment.js';
+import { SubmitMfaEnrollmentOptions, SubmitMfaEnrollmentResult } from '../actions/submitMfaEnrollment.js';
 /**
  * Map of MFA-protected functions to ensure type safety.
  * If a function is renamed, the import will fail and this file won't compile.
@@ -22,6 +39,23 @@ export declare const MFA_PROTECTED_FUNCTIONS: {
     readonly signBitcoinHash: (options: SignBitcoinHashOptions) => Promise< SignBitcoinHashResult>;
     readonly createEvmKeyExportIframe: typeof createEvmKeyExportIframe;
     readonly createSolanaKeyExportIframe: typeof createSolanaKeyExportIframe;
+    readonly adjustBorrowPosition: (options: AdjustBorrowPositionOptions) => Promise< AdjustBorrowPositionResult>;
+    readonly closeBorrowPosition: (options: CloseBorrowPositionOptions) => Promise< CloseBorrowPositionResult>;
+    readonly createBorrowPosition: (options: CreateBorrowPositionOptions) => Promise< CreateBorrowPositionResult>;
+    readonly createDelegation: typeof createDelegation;
+    readonly createDelegationForAccount: typeof createDelegationForAccount;
+    readonly createSpendPermission: (options: CreateSpendPermissionOptions) => Promise< CreateSpendPermissionResult>;
+    readonly enableSpendPermissions: (options: EnableSpendPermissionsOptions) => Promise< EnableSpendPermissionsResult>;
+    readonly executeSwap: (options: ExecuteSwapOptions) => Promise< ExecuteSwapResult>;
+    readonly revokeDelegation: typeof revokeDelegation;
+    readonly revokeDelegationForAccount: typeof revokeDelegationForAccount;
+    readonly revokeSpendPermission: (options: RevokeSpendPermissionOptions) => Promise< RevokeSpendPermissionResult>;
+    readonly sendEvmEoaUsdc: (options: SendEvmEoaUsdcOptions) => Promise< SendEvmEoaUsdcResult>;
+    readonly sendEvmSmartAccountUsdc: (options: SendEvmSmartAccountUsdcOptions) => Promise< SendEvmSmartAccountUsdcResult>;
+    readonly sendSolanaUsdc: (options: SendSolanaUsdcOptions) => Promise< SendSolanaUsdcResult>;
+    readonly enrollPasskey: (options?: EnrollPasskeyOptions) => Promise< EnrollPasskeyResult>;
+    readonly initiateMfaEnrollment: (options: InitiateMfaOptions) => Promise< InitiateMfaEnrollmentResult>;
+    readonly submitMfaEnrollment: (options: SubmitMfaEnrollmentOptions) => Promise< SubmitMfaEnrollmentResult>;
 };
 /**
  * List of action names that require MFA verification when the user is enrolled.

package/dist/web-types/mfa/state.d.ts

@@ -5,6 +5,12 @@ import { MfaMethod } from '@coinbase/cdp-api-client';
 export type MfaVerificationContext = {
     /** The MFA methods the user has enrolled in. */
     methods: MfaMethod[];
+    /**
+     * Opaque challenge handle from the `X-Mfa-Challenge-Id` response header,
+     * present when the project's `verificationScope` is `request`. Passed through
+     * unexamined to `initiateMfaVerification`/`submitMfaVerification`.
+     */
+    challengeId?: string;
 };
 /**
  * Listener function called when MFA verification is required.
@@ -96,10 +102,15 @@ export declare const hasRegisteredMfaListeners: () => boolean;
  *
  * @param {MfaMethod[]} methods - The MFA methods available for verification.
  * @param {unknown} [trigger] - Optional opaque trigger value used by listener predicates.
+ * @param {object} [context] - Optional opaque request-scope context
+ *   merged into the listener's {@link MfaVerificationContext}. Passed through unexamined.
+ * @param {string} [context.challengeId] - Opaque challenge handle, passed through unexamined.
  * @returns {Promise<void>} A Promise that resolves when MFA is complete.
  * @internal
  */
-export declare const triggerMfaVerification: (methods: MfaMethod[], trigger?: unknown) => Promise<void>;
+export declare const triggerMfaVerification: (methods: MfaMethod[], trigger?: unknown, context?: {
+    challengeId?: string;
+}) => Promise<void>;
 /**
  * Resolves the pending MFA verification Promise.
  * Called internally after successful MFA submission.
@@ -115,6 +126,15 @@ export declare const resolvePendingMfaVerification: () => void;
  * @internal
  */
 export declare const rejectPendingMfaVerification: (error: Error) => void;
+/**
+ * Returns the challenge handle for the pending verification, if the server
+ * minted one. MFA actions default to this so request-scope projects work
+ * without every UI having to thread the handle back from its listener.
+ *
+ * @returns {string | undefined} The pending challenge ID, or undefined under session scope.
+ * @internal
+ */
+export declare const getPendingMfaChallengeId: () => string | undefined;
 /**
  * Checks if there's a pending MFA verification.
  *

package/dist/web-types/mfa/withMfa.d.ts

@@ -1,3 +1,10 @@
+/**
+ * Whether the project verifies MFA per request rather than per session.
+ *
+ * @returns True when the project's verification scope is `request`.
+ * @internal
+ */
+export declare const isRequestScope: () => boolean;
 /**
  * Wraps an async operation to handle MFA verification automatically.
  *
@@ -8,6 +15,13 @@
  * If the operation fails with an `mfa_required` error from the API, it will also
  * trigger the MFA handler and retry the operation after successful verification.
  *
+ * The operation must issue exactly one protected request and must build it from values
+ * computed before the thunk runs. A request-scope approval is bound to a digest of the
+ * request that earned it and is spent once, so the retry is only allowed through as a
+ * byte-identical replay. A salt, timestamp or WebAuthn credential generated inside the
+ * thunk changes that digest and the server rejects the retry too. Two protected requests
+ * therefore need two wrappers, one each, not one wrapper around both.
+ *
  * @param operation - The async operation to wrap.
  * @returns The result of the operation.
  * @internal
@@ -21,6 +35,12 @@ export declare function withMfa<T>(operation: () => Promise<T>): Promise<T>;
  * MFA-protected action will trigger the registered MFA verification handler.
  *
  * Use this to pre-warn users or show UI hints before they start a sensitive flow.
+ * Do not use it to verify ahead of the action: MFA-protected actions prompt and
+ * retry on their own, and under `request` scope the challenge only exists once
+ * the action has been attempted.
+ *
+ * Under `request` scope this returns true for any enrolled user, because every
+ * protected call is verified individually.
  *
  * @returns True if MFA verification will be required for the next sensitive action.
  *
@@ -28,11 +48,10 @@ export declare function withMfa<T>(operation: () => Promise<T>): Promise<T>;
  * ```typescript
  * import { isMfaRequired, signEvmHash } from '@coinbase/cdp-core';
  * async function handleSign() {
- *   // prompt mfa before calling the sign hash function
  *   if (isMfaRequired()) {
- *     await ensureMfaVerified(); // User will be prompted
+ *     showHint("You'll be asked to verify before signing.");
  *   }
- *   await signEvmHash({ ... }); // MFA handled automatically by withMfa
+ *   await signEvmHash({ ... }); // Prompts for MFA and retries automatically
  * }
  * ```
  */

package/dist/web-types/version.d.ts

@@ -2,4 +2,4 @@
  * Current version of @coinbase/cdp-core package.
  * This file is auto-generated by scripts/sync-versions.js
  */
-export declare const VERSION = "0.0.124";
+export declare const VERSION = "0.0.125";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coinbase/cdp-core",
-  "version": "0.0.124",
+  "version": "0.0.125",
   "type": "module",
   "files": [
     "dist/**",
@@ -29,25 +29,37 @@
     "ox": "0.8.1",
     "viem": "^2.47.0",
     "zustand": "^5.0.6",
-    "@coinbase/cdp-api-client": "^0.0.124"
+    "@coinbase/cdp-api-client": "^0.0.125"
   },
   "peerDependencies": {
     "@react-native-async-storage/async-storage": "^2.0.0",
+    "@x402/core": "^2.25.0",
+    "@x402/evm": "^2.25.0",
+    "@x402/fetch": "^2.25.0",
+    "@x402/svm": "^2.25.0",
     "expo-secure-store": "^15.0.0",
-    "expo-web-browser": "^15.0.0",
-    "x402-fetch": "^1.0.0"
+    "expo-web-browser": "^15.0.0"
   },
   "peerDependenciesMeta": {
     "@react-native-async-storage/async-storage": {
       "optional": true
     },
-    "expo-secure-store": {
+    "@x402/core": {
       "optional": true
     },
-    "expo-web-browser": {
+    "@x402/evm": {
+      "optional": true
+    },
+    "@x402/fetch": {
+      "optional": true
+    },
+    "@x402/svm": {
       "optional": true
     },
-    "x402-fetch": {
+    "expo-secure-store": {
+      "optional": true
+    },
+    "expo-web-browser": {
       "optional": true
     }
   },
@@ -63,35 +75,35 @@
       "path": "./dist/esm/index.web.js",
       "running": false,
       "import": "*",
-      "limit": "132 KB"
+      "limit": "134 KB"
     },
     {
       "name": "auth-only",
       "path": "./dist/esm/index.web.js",
       "running": false,
       "import": "{ signInWithEmail, verifyEmailOTP, getCurrentUser, isSignedIn, signOut }",
-      "limit": "86 KB"
+      "limit": "88.5 KB"
     },
     {
       "name": "evm-only",
       "path": "./dist/esm/index.web.js",
       "running": false,
       "import": "{ signEvmHash, signEvmTransaction, sendEvmTransaction, signEvmMessage, signEvmTypedData }",
-      "limit": "84.5 KB"
+      "limit": "87.5 KB"
     },
     {
       "name": "export",
       "path": "./dist/esm/index.web.js",
       "running": false,
       "import": "{ createEvmKeyExportIframe }",
-      "limit": "84.5 KB"
+      "limit": "87.5 KB"
     },
     {
       "name": "provider-only",
       "path": "./dist/esm/index.web.js",
       "running": false,
       "import": "{ createCDPEmbeddedWallet }",
-      "limit": "110 KB"
+      "limit": "112.5 KB"
     }
   ],
   "scripts": {

package/dist/esm/index.web181.js

@@ -1,11 +0,0 @@
-import { fromNumber as r } from "./index.web245.js";
-import { validateUserConnected as a } from "./index.web102.js";
-async function s(t, e) {
-  const n = await a();
-  return t.emit("connect", {
-    chainId: r(e.getState().chainId)
-  }), n.evmSmartAccountObjects?.map((c) => c.address) || [];
-}
-export {
-  s as handleRequestAccounts
-};