@coinbase/cdp-core 0.0.124 → 0.0.126

package/dist/native-types/actions/verifyPasskey.d.ts

@@ -4,6 +4,12 @@
 export type VerifyPasskeyOptions = {
     /** Optional idempotency key for safe retries. */
     idempotencyKey?: string;
+    /**
+     * Opaque challenge handle from the MFA listener's context, required when the
+     * project's `verificationScope` is `request`; ignored under `session`. Never
+     * inspected — pass through the value received from the listener unchanged.
+     */
+    challengeId?: string;
 };
 /**
  * Completes an MFA verification using an enrolled passkey (WebAuthn).
@@ -23,7 +29,7 @@ export type VerifyPasskeyOptions = {
  * ```typescript
  * await verifyPasskey();
  * ```
- * @returns A promise that resolves if passkey verification is successful.
+ * @returns A promise that resolves once MFA verification is complete.
  * @throws {MfaError} With code `PASSKEY_NOT_SUPPORTED` when passkeys are not available in the current environment.
  * @throws {MfaError} With code `CANCELLED` when the user dismisses the passkey prompt or it times out.
  */

package/dist/native-types/auth/oAuthManager.d.ts

@@ -1,5 +1,5 @@
-import { OAuthFlowState, OnOAuthStateChangeFn } from '../types.js';
 import { IOAuthManager } from './types.js';
+import { OAuthFlowState, OnOAuthStateChangeFn } from '../types.js';
 /**
  * Manages the OAuth flow state and related callbacks.
  */

package/dist/native-types/errors.d.ts

@@ -67,7 +67,9 @@ export type MfaErrorCode =
 /** Passkeys (WebAuthn) are not supported in the current environment. */
  | "PASSKEY_NOT_SUPPORTED"
 /** This device already holds a passkey for this account, so it cannot enroll another. */
- | "PASSKEY_ALREADY_ENROLLED";
+ | "PASSKEY_ALREADY_ENROLLED"
+/** MFA cannot be verified ahead of time because the project verifies per request. */
+ | "REQUEST_SCOPE_UNSUPPORTED";
 /**
  * Error thrown when an MFA operation fails.
  */

package/dist/native-types/index.d.ts

@@ -50,6 +50,7 @@ export { getMfaConfigState, getProjectConfigState } from './state.js';
 export { recordMfaEnrollmentPrompted, type RecordMfaEnrollmentPromptedResult, } from './actions/recordMfaEnrollmentPrompted.js';
 export { initiateMfaEnrollment, type InitiateMfaEnrollmentResult, type InitiateMfaOptions, type InitiateTotpMfaOptions, type InitiateSmsMfaOptions, type InitiateTotpMfaResult, type InitiateSmsMfaResult, } from './actions/initiateMfaEnrollment.js';
 export { submitMfaEnrollment, type SubmitMfaEnrollmentOptions, type SubmitMfaEnrollmentResult, } from './actions/submitMfaEnrollment.js';
+export { enrollPasskey, type EnrollPasskeyOptions, type EnrollPasskeyResult, } from './actions/enrollPasskey.js';
 export { initiateMfaVerification, type InitiateMfaVerificationOptions, } from './actions/initiateMfaVerification.js';
 export { submitMfaVerification, type SubmitMfaVerificationOptions, } from './actions/submitMfaVerification.js';
 export { cancelMfaVerification } from './actions/cancelMfaVerification.js';

package/dist/native-types/mfa/index.d.ts

@@ -1,4 +1,4 @@
 export { hasPendingMfaVerification, resolvePendingMfaVerification, rejectPendingMfaVerification, triggerMfaVerification, type MfaListener, type MfaVerificationContext, } from './state.js';
 export { getEnabledMfaMethods, getEnrolledMfaMethods, isEnrolledInMfa } from './utils.js';
-export { withMfa, ensureMfaVerified, isMfaRequired } from './withMfa.js';
+export { withMfa, ensureMfaVerified, isMfaRequired, isRequestScope } from './withMfa.js';
 export { MFA_PROTECTED_ACTIONS, MFA_PROTECTED_FUNCTIONS, isMfaProtectedAction, type MfaProtectedAction, } from './protectedActions.js';

package/dist/native-types/mfa/protectedActions.d.ts

@@ -1,6 +1,23 @@
+import { createDelegation } from '../actions/createDelegation.js';
+import { createDelegationForAccount } from '../actions/createDelegationForAccount.js';
 import { createEvmKeyExportIframe, createSolanaKeyExportIframe } from '../actions/createKeyExportIframe.js';
+import { revokeDelegation } from '../actions/revokeDelegation.js';
+import { revokeDelegationForAccount } from '../actions/revokeDelegationForAccount.js';
 import { SignEvmHashOptions, SignEvmHashResult, SignEvmTransactionOptions, SignEvmTransactionResult, SignSolanaTransactionOptions, SignSolanaTransactionResult, SendEvmTransactionOptions, SendEvmTransactionResult, SendSolanaTransactionOptions, SendSolanaTransactionResult, SignEvmMessageOptions, SignSolanaMessageOptions, SignSolanaMessageResult, SignEvmTypedDataOptions, SignEvmTypedDataResult, SendUserOperationOptions, SendUserOperationResult, ExportEvmAccountOptions, ExportEvmAccountResult, ExportSolanaAccountOptions, ExportSolanaAccountResult } from '../types.js';
 import { SignBitcoinHashOptions, SignBitcoinHashResult } from '../actions/signBitcoinHash.js';
+import { AdjustBorrowPositionOptions, AdjustBorrowPositionResult } from '../actions/adjustBorrowPosition.js';
+import { CloseBorrowPositionOptions, CloseBorrowPositionResult } from '../actions/closeBorrowPosition.js';
+import { CreateBorrowPositionOptions, CreateBorrowPositionResult } from '../actions/createBorrowPosition.js';
+import { CreateSpendPermissionOptions, CreateSpendPermissionResult } from '../actions/createSpendPermission.js';
+import { EnableSpendPermissionsOptions, EnableSpendPermissionsResult } from '../actions/enableSpendPermissions.js';
+import { ExecuteSwapOptions, ExecuteSwapResult } from '../actions/executeSwap.js';
+import { RevokeSpendPermissionOptions, RevokeSpendPermissionResult } from '../actions/revokeSpendPermission.js';
+import { SendEvmEoaUsdcOptions, SendEvmEoaUsdcResult } from '../actions/sendEvmEoaUsdc.js';
+import { SendEvmSmartAccountUsdcOptions, SendEvmSmartAccountUsdcResult } from '../actions/sendEvmSmartAccountUsdc.js';
+import { SendSolanaUsdcOptions, SendSolanaUsdcResult } from '../actions/sendSolanaUsdc.js';
+import { EnrollPasskeyOptions, EnrollPasskeyResult } from '../actions/enrollPasskey.js';
+import { InitiateMfaOptions, InitiateMfaEnrollmentResult } from '../actions/initiateMfaEnrollment.js';
+import { SubmitMfaEnrollmentOptions, SubmitMfaEnrollmentResult } from '../actions/submitMfaEnrollment.js';
 /**
  * Map of MFA-protected functions to ensure type safety.
  * If a function is renamed, the import will fail and this file won't compile.
@@ -22,6 +39,23 @@ export declare const MFA_PROTECTED_FUNCTIONS: {
     readonly signBitcoinHash: (options: SignBitcoinHashOptions) => Promise< SignBitcoinHashResult>;
     readonly createEvmKeyExportIframe: typeof createEvmKeyExportIframe;
     readonly createSolanaKeyExportIframe: typeof createSolanaKeyExportIframe;
+    readonly adjustBorrowPosition: (options: AdjustBorrowPositionOptions) => Promise< AdjustBorrowPositionResult>;
+    readonly closeBorrowPosition: (options: CloseBorrowPositionOptions) => Promise< CloseBorrowPositionResult>;
+    readonly createBorrowPosition: (options: CreateBorrowPositionOptions) => Promise< CreateBorrowPositionResult>;
+    readonly createDelegation: typeof createDelegation;
+    readonly createDelegationForAccount: typeof createDelegationForAccount;
+    readonly createSpendPermission: (options: CreateSpendPermissionOptions) => Promise< CreateSpendPermissionResult>;
+    readonly enableSpendPermissions: (options: EnableSpendPermissionsOptions) => Promise< EnableSpendPermissionsResult>;
+    readonly executeSwap: (options: ExecuteSwapOptions) => Promise< ExecuteSwapResult>;
+    readonly revokeDelegation: typeof revokeDelegation;
+    readonly revokeDelegationForAccount: typeof revokeDelegationForAccount;
+    readonly revokeSpendPermission: (options: RevokeSpendPermissionOptions) => Promise< RevokeSpendPermissionResult>;
+    readonly sendEvmEoaUsdc: (options: SendEvmEoaUsdcOptions) => Promise< SendEvmEoaUsdcResult>;
+    readonly sendEvmSmartAccountUsdc: (options: SendEvmSmartAccountUsdcOptions) => Promise< SendEvmSmartAccountUsdcResult>;
+    readonly sendSolanaUsdc: (options: SendSolanaUsdcOptions) => Promise< SendSolanaUsdcResult>;
+    readonly enrollPasskey: (options?: EnrollPasskeyOptions) => Promise< EnrollPasskeyResult>;
+    readonly initiateMfaEnrollment: (options: InitiateMfaOptions) => Promise< InitiateMfaEnrollmentResult>;
+    readonly submitMfaEnrollment: (options: SubmitMfaEnrollmentOptions) => Promise< SubmitMfaEnrollmentResult>;
 };
 /**
  * List of action names that require MFA verification when the user is enrolled.

package/dist/native-types/mfa/state.d.ts

@@ -5,6 +5,12 @@ import { MfaMethod } from '@coinbase/cdp-api-client';
 export type MfaVerificationContext = {
     /** The MFA methods the user has enrolled in. */
     methods: MfaMethod[];
+    /**
+     * Opaque challenge handle from the `X-Mfa-Challenge-Id` response header,
+     * present when the project's `verificationScope` is `request`. Passed through
+     * unexamined to `initiateMfaVerification`/`submitMfaVerification`.
+     */
+    challengeId?: string;
 };
 /**
  * Listener function called when MFA verification is required.
@@ -96,10 +102,15 @@ export declare const hasRegisteredMfaListeners: () => boolean;
  *
  * @param {MfaMethod[]} methods - The MFA methods available for verification.
  * @param {unknown} [trigger] - Optional opaque trigger value used by listener predicates.
+ * @param {object} [context] - Optional opaque request-scope context
+ *   merged into the listener's {@link MfaVerificationContext}. Passed through unexamined.
+ * @param {string} [context.challengeId] - Opaque challenge handle, passed through unexamined.
  * @returns {Promise<void>} A Promise that resolves when MFA is complete.
  * @internal
  */
-export declare const triggerMfaVerification: (methods: MfaMethod[], trigger?: unknown) => Promise<void>;
+export declare const triggerMfaVerification: (methods: MfaMethod[], trigger?: unknown, context?: {
+    challengeId?: string;
+}) => Promise<void>;
 /**
  * Resolves the pending MFA verification Promise.
  * Called internally after successful MFA submission.
@@ -115,6 +126,15 @@ export declare const resolvePendingMfaVerification: () => void;
  * @internal
  */
 export declare const rejectPendingMfaVerification: (error: Error) => void;
+/**
+ * Returns the challenge handle for the pending verification, if the server
+ * minted one. MFA actions default to this so request-scope projects work
+ * without every UI having to thread the handle back from its listener.
+ *
+ * @returns {string | undefined} The pending challenge ID, or undefined under session scope.
+ * @internal
+ */
+export declare const getPendingMfaChallengeId: () => string | undefined;
 /**
  * Checks if there's a pending MFA verification.
  *

package/dist/native-types/mfa/withMfa.d.ts

@@ -1,3 +1,10 @@
+/**
+ * Whether the project verifies MFA per request rather than per session.
+ *
+ * @returns True when the project's verification scope is `request`.
+ * @internal
+ */
+export declare const isRequestScope: () => boolean;
 /**
  * Wraps an async operation to handle MFA verification automatically.
  *
@@ -8,6 +15,13 @@
  * If the operation fails with an `mfa_required` error from the API, it will also
  * trigger the MFA handler and retry the operation after successful verification.
  *
+ * The operation must issue exactly one protected request and must build it from values
+ * computed before the thunk runs. A request-scope approval is bound to a digest of the
+ * request that earned it and is spent once, so the retry is only allowed through as a
+ * byte-identical replay. A salt, timestamp or WebAuthn credential generated inside the
+ * thunk changes that digest and the server rejects the retry too. Two protected requests
+ * therefore need two wrappers, one each, not one wrapper around both.
+ *
  * @param operation - The async operation to wrap.
  * @returns The result of the operation.
  * @internal
@@ -21,6 +35,12 @@ export declare function withMfa<T>(operation: () => Promise<T>): Promise<T>;
  * MFA-protected action will trigger the registered MFA verification handler.
  *
  * Use this to pre-warn users or show UI hints before they start a sensitive flow.
+ * Do not use it to verify ahead of the action: MFA-protected actions prompt and
+ * retry on their own, and under `request` scope the challenge only exists once
+ * the action has been attempted.
+ *
+ * Under `request` scope this returns true for any enrolled user, because every
+ * protected call is verified individually.
  *
  * @returns True if MFA verification will be required for the next sensitive action.
  *
@@ -28,11 +48,10 @@ export declare function withMfa<T>(operation: () => Promise<T>): Promise<T>;
  * ```typescript
  * import { isMfaRequired, signEvmHash } from '@coinbase/cdp-core';
  * async function handleSign() {
- *   // prompt mfa before calling the sign hash function
  *   if (isMfaRequired()) {
- *     await ensureMfaVerified(); // User will be prompted
+ *     showHint("You'll be asked to verify before signing.");
  *   }
- *   await signEvmHash({ ... }); // MFA handled automatically by withMfa
+ *   await signEvmHash({ ... }); // Prompts for MFA and retries automatically
  * }
  * ```
  */

package/dist/native-types/version.d.ts

@@ -2,4 +2,4 @@
  * Current version of @coinbase/cdp-core package.
  * This file is auto-generated by scripts/sync-versions.js
  */
-export declare const VERSION = "0.0.124";
+export declare const VERSION = "0.0.126";

package/dist/types/actions/initiateMfaVerification.d.ts

@@ -1,4 +1,4 @@
-import { MfaMethod } from '@coinbase/cdp-api-client';
+import { InitiateMfaVerificationResponseWrapper, MfaMethod } from '@coinbase/cdp-api-client';
 /**
  * Request parameters for initiating MFA verification.
  */
@@ -7,6 +7,12 @@ export type InitiateMfaVerificationOptions = {
     mfaMethod: MfaMethod;
     /** Optional idempotency key for safe retries. */
     idempotencyKey?: string;
+    /**
+     * Opaque challenge handle from the MFA listener's context, required when the
+     * project's `verificationScope` is `request`; ignored under `session`. Never
+     * inspected — pass through the value received from the listener unchanged.
+     */
+    challengeId?: string;
 };
 /**
  * Initiates an MFA verification flow for operations requiring MFA.
@@ -28,6 +34,7 @@ export type InitiateMfaVerificationOptions = {
  * await initiateMfaVerification({ mfaMethod: "sms" });
  * // SMS sent to user's phone - prompt for code
  * ```
- * @returns A promise that resolves if MFA initiation is successful.
+ * @returns A promise that resolves with the initiate response (opaque under `session`
+ *   scope, where it resolves to `{}`) once MFA initiation is successful.
  */
-export declare const initiateMfaVerification: (options: InitiateMfaVerificationOptions) => Promise<void>;
+export declare const initiateMfaVerification: (options: InitiateMfaVerificationOptions) => Promise<InitiateMfaVerificationResponseWrapper | void>;

package/dist/types/actions/submitMfaVerification.d.ts

@@ -8,6 +8,12 @@ export type SubmitMfaVerificationOptions = {
     mfaCode: string;
     /** Optional idempotency key for safe retries. */
     idempotencyKey?: string;
+    /**
+     * Opaque challenge handle from the MFA listener's context, required when the
+     * project's `verificationScope` is `request`; ignored under `session`. Never
+     * inspected — pass through the value received from the listener unchanged.
+     */
+    challengeId?: string;
 };
 /**
  * Submits an MFA code to complete the verification process.

package/dist/types/actions/verifyPasskey.d.ts

@@ -4,6 +4,12 @@
 export type VerifyPasskeyOptions = {
     /** Optional idempotency key for safe retries. */
     idempotencyKey?: string;
+    /**
+     * Opaque challenge handle from the MFA listener's context, required when the
+     * project's `verificationScope` is `request`; ignored under `session`. Never
+     * inspected — pass through the value received from the listener unchanged.
+     */
+    challengeId?: string;
 };
 /**
  * Completes an MFA verification using an enrolled passkey (WebAuthn).
@@ -23,7 +29,7 @@ export type VerifyPasskeyOptions = {
  * ```typescript
  * await verifyPasskey();
  * ```
- * @returns A promise that resolves if passkey verification is successful.
+ * @returns A promise that resolves once MFA verification is complete.
  * @throws {MfaError} With code `PASSKEY_NOT_SUPPORTED` when passkeys are not available in the current environment.
  * @throws {MfaError} With code `CANCELLED` when the user dismisses the passkey prompt or it times out.
  */

package/dist/types/auth/oAuthManager.d.ts

@@ -1,5 +1,5 @@
-import { OAuthFlowState, OnOAuthStateChangeFn } from '../types.js';
 import { IOAuthManager } from './types.js';
+import { OAuthFlowState, OnOAuthStateChangeFn } from '../types.js';
 /**
  * Manages the OAuth flow state and related callbacks.
  */

package/dist/types/errors.d.ts

@@ -67,7 +67,9 @@ export type MfaErrorCode =
 /** Passkeys (WebAuthn) are not supported in the current environment. */
  | "PASSKEY_NOT_SUPPORTED"
 /** This device already holds a passkey for this account, so it cannot enroll another. */
- | "PASSKEY_ALREADY_ENROLLED";
+ | "PASSKEY_ALREADY_ENROLLED"
+/** MFA cannot be verified ahead of time because the project verifies per request. */
+ | "REQUEST_SCOPE_UNSUPPORTED";
 /**
  * Error thrown when an MFA operation fails.
  */

package/dist/types/index.d.ts

@@ -50,6 +50,7 @@ export { getMfaConfigState, getProjectConfigState } from './state.js';
 export { recordMfaEnrollmentPrompted, type RecordMfaEnrollmentPromptedResult, } from './actions/recordMfaEnrollmentPrompted.js';
 export { initiateMfaEnrollment, type InitiateMfaEnrollmentResult, type InitiateMfaOptions, type InitiateTotpMfaOptions, type InitiateSmsMfaOptions, type InitiateTotpMfaResult, type InitiateSmsMfaResult, } from './actions/initiateMfaEnrollment.js';
 export { submitMfaEnrollment, type SubmitMfaEnrollmentOptions, type SubmitMfaEnrollmentResult, } from './actions/submitMfaEnrollment.js';
+export { enrollPasskey, type EnrollPasskeyOptions, type EnrollPasskeyResult, } from './actions/enrollPasskey.js';
 export { initiateMfaVerification, type InitiateMfaVerificationOptions, } from './actions/initiateMfaVerification.js';
 export { submitMfaVerification, type SubmitMfaVerificationOptions, } from './actions/submitMfaVerification.js';
 export { cancelMfaVerification } from './actions/cancelMfaVerification.js';

package/dist/types/mfa/index.d.ts

@@ -1,4 +1,4 @@
 export { hasPendingMfaVerification, resolvePendingMfaVerification, rejectPendingMfaVerification, triggerMfaVerification, type MfaListener, type MfaVerificationContext, } from './state.js';
 export { getEnabledMfaMethods, getEnrolledMfaMethods, isEnrolledInMfa } from './utils.js';
-export { withMfa, ensureMfaVerified, isMfaRequired } from './withMfa.js';
+export { withMfa, ensureMfaVerified, isMfaRequired, isRequestScope } from './withMfa.js';
 export { MFA_PROTECTED_ACTIONS, MFA_PROTECTED_FUNCTIONS, isMfaProtectedAction, type MfaProtectedAction, } from './protectedActions.js';

package/dist/types/mfa/protectedActions.d.ts

@@ -1,6 +1,23 @@
+import { createDelegation } from '../actions/createDelegation.js';
+import { createDelegationForAccount } from '../actions/createDelegationForAccount.js';
 import { createEvmKeyExportIframe, createSolanaKeyExportIframe } from '../actions/createKeyExportIframe.js';
+import { revokeDelegation } from '../actions/revokeDelegation.js';
+import { revokeDelegationForAccount } from '../actions/revokeDelegationForAccount.js';
 import { SignEvmHashOptions, SignEvmHashResult, SignEvmTransactionOptions, SignEvmTransactionResult, SignSolanaTransactionOptions, SignSolanaTransactionResult, SendEvmTransactionOptions, SendEvmTransactionResult, SendSolanaTransactionOptions, SendSolanaTransactionResult, SignEvmMessageOptions, SignSolanaMessageOptions, SignSolanaMessageResult, SignEvmTypedDataOptions, SignEvmTypedDataResult, SendUserOperationOptions, SendUserOperationResult, ExportEvmAccountOptions, ExportEvmAccountResult, ExportSolanaAccountOptions, ExportSolanaAccountResult } from '../types.js';
 import { SignBitcoinHashOptions, SignBitcoinHashResult } from '../actions/signBitcoinHash.js';
+import { AdjustBorrowPositionOptions, AdjustBorrowPositionResult } from '../actions/adjustBorrowPosition.js';
+import { CloseBorrowPositionOptions, CloseBorrowPositionResult } from '../actions/closeBorrowPosition.js';
+import { CreateBorrowPositionOptions, CreateBorrowPositionResult } from '../actions/createBorrowPosition.js';
+import { CreateSpendPermissionOptions, CreateSpendPermissionResult } from '../actions/createSpendPermission.js';
+import { EnableSpendPermissionsOptions, EnableSpendPermissionsResult } from '../actions/enableSpendPermissions.js';
+import { ExecuteSwapOptions, ExecuteSwapResult } from '../actions/executeSwap.js';
+import { RevokeSpendPermissionOptions, RevokeSpendPermissionResult } from '../actions/revokeSpendPermission.js';
+import { SendEvmEoaUsdcOptions, SendEvmEoaUsdcResult } from '../actions/sendEvmEoaUsdc.js';
+import { SendEvmSmartAccountUsdcOptions, SendEvmSmartAccountUsdcResult } from '../actions/sendEvmSmartAccountUsdc.js';
+import { SendSolanaUsdcOptions, SendSolanaUsdcResult } from '../actions/sendSolanaUsdc.js';
+import { EnrollPasskeyOptions, EnrollPasskeyResult } from '../actions/enrollPasskey.js';
+import { InitiateMfaOptions, InitiateMfaEnrollmentResult } from '../actions/initiateMfaEnrollment.js';
+import { SubmitMfaEnrollmentOptions, SubmitMfaEnrollmentResult } from '../actions/submitMfaEnrollment.js';
 /**
  * Map of MFA-protected functions to ensure type safety.
  * If a function is renamed, the import will fail and this file won't compile.
@@ -22,6 +39,23 @@ export declare const MFA_PROTECTED_FUNCTIONS: {
     readonly signBitcoinHash: (options: SignBitcoinHashOptions) => Promise< SignBitcoinHashResult>;
     readonly createEvmKeyExportIframe: typeof createEvmKeyExportIframe;
     readonly createSolanaKeyExportIframe: typeof createSolanaKeyExportIframe;
+    readonly adjustBorrowPosition: (options: AdjustBorrowPositionOptions) => Promise< AdjustBorrowPositionResult>;
+    readonly closeBorrowPosition: (options: CloseBorrowPositionOptions) => Promise< CloseBorrowPositionResult>;
+    readonly createBorrowPosition: (options: CreateBorrowPositionOptions) => Promise< CreateBorrowPositionResult>;
+    readonly createDelegation: typeof createDelegation;
+    readonly createDelegationForAccount: typeof createDelegationForAccount;
+    readonly createSpendPermission: (options: CreateSpendPermissionOptions) => Promise< CreateSpendPermissionResult>;
+    readonly enableSpendPermissions: (options: EnableSpendPermissionsOptions) => Promise< EnableSpendPermissionsResult>;
+    readonly executeSwap: (options: ExecuteSwapOptions) => Promise< ExecuteSwapResult>;
+    readonly revokeDelegation: typeof revokeDelegation;
+    readonly revokeDelegationForAccount: typeof revokeDelegationForAccount;
+    readonly revokeSpendPermission: (options: RevokeSpendPermissionOptions) => Promise< RevokeSpendPermissionResult>;
+    readonly sendEvmEoaUsdc: (options: SendEvmEoaUsdcOptions) => Promise< SendEvmEoaUsdcResult>;
+    readonly sendEvmSmartAccountUsdc: (options: SendEvmSmartAccountUsdcOptions) => Promise< SendEvmSmartAccountUsdcResult>;
+    readonly sendSolanaUsdc: (options: SendSolanaUsdcOptions) => Promise< SendSolanaUsdcResult>;
+    readonly enrollPasskey: (options?: EnrollPasskeyOptions) => Promise< EnrollPasskeyResult>;
+    readonly initiateMfaEnrollment: (options: InitiateMfaOptions) => Promise< InitiateMfaEnrollmentResult>;
+    readonly submitMfaEnrollment: (options: SubmitMfaEnrollmentOptions) => Promise< SubmitMfaEnrollmentResult>;
 };
 /**
  * List of action names that require MFA verification when the user is enrolled.

package/dist/types/mfa/state.d.ts

@@ -5,6 +5,12 @@ import { MfaMethod } from '@coinbase/cdp-api-client';
 export type MfaVerificationContext = {
     /** The MFA methods the user has enrolled in. */
     methods: MfaMethod[];
+    /**
+     * Opaque challenge handle from the `X-Mfa-Challenge-Id` response header,
+     * present when the project's `verificationScope` is `request`. Passed through
+     * unexamined to `initiateMfaVerification`/`submitMfaVerification`.
+     */
+    challengeId?: string;
 };
 /**
  * Listener function called when MFA verification is required.
@@ -96,10 +102,15 @@ export declare const hasRegisteredMfaListeners: () => boolean;
  *
  * @param {MfaMethod[]} methods - The MFA methods available for verification.
  * @param {unknown} [trigger] - Optional opaque trigger value used by listener predicates.
+ * @param {object} [context] - Optional opaque request-scope context
+ *   merged into the listener's {@link MfaVerificationContext}. Passed through unexamined.
+ * @param {string} [context.challengeId] - Opaque challenge handle, passed through unexamined.
  * @returns {Promise<void>} A Promise that resolves when MFA is complete.
  * @internal
  */
-export declare const triggerMfaVerification: (methods: MfaMethod[], trigger?: unknown) => Promise<void>;
+export declare const triggerMfaVerification: (methods: MfaMethod[], trigger?: unknown, context?: {
+    challengeId?: string;
+}) => Promise<void>;
 /**
  * Resolves the pending MFA verification Promise.
  * Called internally after successful MFA submission.
@@ -115,6 +126,15 @@ export declare const resolvePendingMfaVerification: () => void;
  * @internal
  */
 export declare const rejectPendingMfaVerification: (error: Error) => void;
+/**
+ * Returns the challenge handle for the pending verification, if the server
+ * minted one. MFA actions default to this so request-scope projects work
+ * without every UI having to thread the handle back from its listener.
+ *
+ * @returns {string | undefined} The pending challenge ID, or undefined under session scope.
+ * @internal
+ */
+export declare const getPendingMfaChallengeId: () => string | undefined;
 /**
  * Checks if there's a pending MFA verification.
  *

package/dist/types/mfa/withMfa.d.ts

@@ -1,3 +1,10 @@
+/**
+ * Whether the project verifies MFA per request rather than per session.
+ *
+ * @returns True when the project's verification scope is `request`.
+ * @internal
+ */
+export declare const isRequestScope: () => boolean;
 /**
  * Wraps an async operation to handle MFA verification automatically.
  *
@@ -8,6 +15,13 @@
  * If the operation fails with an `mfa_required` error from the API, it will also
  * trigger the MFA handler and retry the operation after successful verification.
  *
+ * The operation must issue exactly one protected request and must build it from values
+ * computed before the thunk runs. A request-scope approval is bound to a digest of the
+ * request that earned it and is spent once, so the retry is only allowed through as a
+ * byte-identical replay. A salt, timestamp or WebAuthn credential generated inside the
+ * thunk changes that digest and the server rejects the retry too. Two protected requests
+ * therefore need two wrappers, one each, not one wrapper around both.
+ *
  * @param operation - The async operation to wrap.
  * @returns The result of the operation.
  * @internal
@@ -21,6 +35,12 @@ export declare function withMfa<T>(operation: () => Promise<T>): Promise<T>;
  * MFA-protected action will trigger the registered MFA verification handler.
  *
  * Use this to pre-warn users or show UI hints before they start a sensitive flow.
+ * Do not use it to verify ahead of the action: MFA-protected actions prompt and
+ * retry on their own, and under `request` scope the challenge only exists once
+ * the action has been attempted.
+ *
+ * Under `request` scope this returns true for any enrolled user, because every
+ * protected call is verified individually.
  *
  * @returns True if MFA verification will be required for the next sensitive action.
  *
@@ -28,11 +48,10 @@ export declare function withMfa<T>(operation: () => Promise<T>): Promise<T>;
  * ```typescript
  * import { isMfaRequired, signEvmHash } from '@coinbase/cdp-core';
  * async function handleSign() {
- *   // prompt mfa before calling the sign hash function
  *   if (isMfaRequired()) {
- *     await ensureMfaVerified(); // User will be prompted
+ *     showHint("You'll be asked to verify before signing.");
  *   }
- *   await signEvmHash({ ... }); // MFA handled automatically by withMfa
+ *   await signEvmHash({ ... }); // Prompts for MFA and retries automatically
  * }
  * ```
  */

package/dist/types/version.d.ts

@@ -2,4 +2,4 @@
  * Current version of @coinbase/cdp-core package.
  * This file is auto-generated by scripts/sync-versions.js
  */
-export declare const VERSION = "0.0.124";
+export declare const VERSION = "0.0.126";

package/dist/web/index.web10.js

@@ -1,4 +1,4 @@
-import { setCookieDomain as p, configureCdpApiClient as C, setAuthManager as S, getProjectConfig as M, APIError as m, getMfaConfig as v } from "@coinbase/cdp-api-client";
+import { setCookieDomain as p, configureCdpApiClient as C, setAuthManager as S, getProjectConfig as v, APIError as m, getMfaConfig as M } from "@coinbase/cdp-api-client";
 import { Analytics as d } from "./index.web2.js";
 import "./index.web3.js";
 import { createAuthManager as w } from "./index.web129.js";
@@ -24,6 +24,7 @@ const H = async (t) => {
       enabled: !1,
       totpConfig: { enabled: !1 },
       smsConfig: { enabled: !1 },
+      verificationScope: "session",
       verificationWindowSeconds: 300,
       promptEnrollmentOnLogin: !1,
       requireVerificationOnLogin: !1,
@@ -89,7 +90,7 @@ const H = async (t) => {
   }
   let s = null;
   try {
-    s = await M(t.projectId);
+    s = await v(t.projectId);
   } catch (e) {
     (!(e instanceof m) || e.statusCode !== 404) && console.warn("Failed to get project config", e);
   }
@@ -98,7 +99,7 @@ const H = async (t) => {
     O().ensureInitialized(),
     (async () => {
       try {
-        return await v(t.projectId);
+        return await M(t.projectId);
       } catch (e) {
         return (!(e instanceof m) || e.statusCode !== 404) && console.warn("Failed to get MFA config", e), null;
       }

package/dist/web/index.web101.js

@@ -2,20 +2,21 @@ import { createStore as a } from "zustand";
 import { subscribeWithSelector as c, persist as d, createJSONStorage as h } from "./index.web124.js";
 import { EventEmitter as f } from "./index.web125.js";
 import "./index.web126.js";
+import { createProvider as u } from "./index.web127.js";
 import "viem";
 import "@coinbase/cdp-api-client";
-import { getPlatformStorage as u } from "./index.web5.js";
-import { createProvider as g } from "./index.web127.js";
+import { getPlatformStorage as g } from "./index.web5.js";
 import { onAuthStateChange as l } from "./index.web27.js";
 import "./index.web2.js";
 import "./index.web3.js";
 import "jose";
 import "./index.web110.js";
 import "./index.web104.js";
+import "./index.web113.js";
 import "./index.web111.js";
 import "@solana/web3.js";
 import "bs58";
-function j(e) {
+function k(e) {
   if (e.chains.length === 0)
     throw new Error("At least one chain must be configured");
   if (!e.transports)
@@ -23,7 +24,7 @@ function j(e) {
   const o = e.chains, s = e.transports;
   if (o.length === 0)
     throw new Error("No chains found in configuration");
-  const m = new f(), i = u(), p = {
+  const m = new f(), i = g(), p = {
     getItem: (t) => i.getItem(t),
     setItem: (t, r) => i.setItem(t, r),
     removeItem: (t) => i.removeItem(t)
@@ -47,12 +48,12 @@ function j(e) {
   return n.persist.rehydrate(), l((t) => {
     n.getState().setUser(t);
   }), {
-    provider: g(m, n, {
+    provider: u(m, n, {
       chains: o,
       transports: s
     })
   };
 }
 export {
-  j as createCDPEmbeddedWallet
+  k as createCDPEmbeddedWallet
 };

package/dist/web/index.web102.js

@@ -7,6 +7,7 @@ import "jose";
 import "./index.web110.js";
 import { getCurrentUser as u } from "./index.web21.js";
 import "./index.web104.js";
+import "./index.web113.js";
 import "./index.web111.js";
 import "@solana/web3.js";
 import "bs58";
@@ -77,7 +78,7 @@ const p = /* @__PURE__ */ new Set([
   "wallet_getCallsStatus",
   "wallet_getCapabilities"
 ]);
-function O(e, { chains: t }) {
+function S(e, { chains: t }) {
   const { method: r, params: o } = e;
   if (typeof r != "string" || r.length === 0)
     throw new c(
@@ -110,7 +111,7 @@ async function d() {
     );
   return e;
 }
-async function S(e) {
+async function R(e) {
   const t = await d(), r = e.toLowerCase(), o = t.evmAccountObjects?.some(
     (i) => i.address.toLowerCase() === r
   ), a = t.evmSmartAccountObjects?.some(
@@ -123,7 +124,7 @@ async function S(e) {
     );
   return t;
 }
-async function R(e) {
+async function g(e) {
   const t = await d(), r = e.toLowerCase();
   if (!t.evmAccountObjects?.some((o) => o.address.toLowerCase() === r))
     throw new s(
@@ -132,7 +133,7 @@ async function R(e) {
     );
   return t;
 }
-async function g(e) {
+async function z(e) {
   const t = await d(), r = e.toLowerCase();
   if (!t.evmSmartAccountObjects?.some(
     (o) => o.address.toLowerCase() === r
@@ -143,7 +144,7 @@ async function g(e) {
     );
   return t;
 }
-async function z() {
+async function U() {
   const e = await d();
   if (!e.evmSmartAccountObjects?.[0])
     throw new s(
@@ -156,10 +157,10 @@ export {
   s as EIP1193ProviderError,
   c as RPCRequestError,
   n as STANDARD_ERROR_CODES,
-  O as validateRequest,
+  S as validateRequest,
   d as validateUserConnected,
-  z as validateUserHasEvmSmartAccount,
-  S as validateUserOwnsAddress,
-  R as validateUserOwnsEOA,
-  g as validateUserOwnsSmartAccount
+  U as validateUserHasEvmSmartAccount,
+  R as validateUserOwnsAddress,
+  g as validateUserOwnsEOA,
+  z as validateUserOwnsSmartAccount
 };