@coinbase/cdp-sdk 1.44.1 → 1.46.0

package/CHANGELOG.md

@@ -1,5 +1,33 @@
 # CDP SDK Changelog
 
+## 1.46.0
+
+### Minor Changes
+
+- [#624](https://github.com/coinbase/cdp-sdk/pull/624) [`0c0c1c8`](https://github.com/coinbase/cdp-sdk/commit/0c0c1c8d4202dc24bd07b926de2d81144fba8599) Thanks [@sammccord](https://github.com/sammccord)! - Add revokeDelegation, and delegated signing operations to end user client
+
+### Patch Changes
+
+- [#627](https://github.com/coinbase/cdp-sdk/pull/627) [`4a10b49`](https://github.com/coinbase/cdp-sdk/commit/4a10b4940c825a77e7af2378e1cb9f8e6d4db956) Thanks [@0xRAG](https://github.com/0xRAG)! - Removed @solana/web3.js dependency to avoid transitive LGPL license
+
+- [#622](https://github.com/coinbase/cdp-sdk/pull/622) [`03d0b68`](https://github.com/coinbase/cdp-sdk/commit/03d0b680b0a5d3758a9092a8cf9abaeb2ae4790a) Thanks [@0xRAG](https://github.com/0xRAG)! - Patched security vulnerabilities across several dependencies.
+
+- [#623](https://github.com/coinbase/cdp-sdk/pull/623) [`ec2866f`](https://github.com/coinbase/cdp-sdk/commit/ec2866ff0423130a3a6ed948ab7e3c741e376b90) Thanks [@milan-cb](https://github.com/milan-cb)! - Added EIP-6492 signature wrapping for undeployed smart accounts
+
+## 1.45.0
+
+### Minor Changes
+
+- [#606](https://github.com/coinbase/cdp-sdk/pull/606) [`3fef84a`](https://github.com/coinbase/cdp-sdk/commit/3fef84a828ee897fcbdc9bb920fcc3641eac8641) Thanks [@milan-cb](https://github.com/milan-cb)! - Added createEvmEip7702Delegation to upgrade EOAs with smart account capabilities
+
+- [#612](https://github.com/coinbase/cdp-sdk/pull/612) [`7ed8a11`](https://github.com/coinbase/cdp-sdk/commit/7ed8a1177e5fddc70929ee7ec339887c780657b1) Thanks [@milan-cb](https://github.com/milan-cb)! - Added getEvmEip7702DelegationOperationById and waitForEvmEip7702DelegationOperationStatus
+
+- [#608](https://github.com/coinbase/cdp-sdk/pull/608) [`8fcfac3`](https://github.com/coinbase/cdp-sdk/commit/8fcfac348487f586b224b77074f52594ad44198b) Thanks [@sammccord](https://github.com/sammccord)! - Added support for new end user embedded wallet policy rules, reusing existing criteria - signEndUserEvmTransaction, sendEndUserEvmTransaction, signEndUserEvmMessage, signEndUserEvmTypedData, signEndUserSolTransaction, sendEndUserSolTransaction, and signEndUserSolMessage.
+
+### Patch Changes
+
+- [#607](https://github.com/coinbase/cdp-sdk/pull/607) [`21244e3`](https://github.com/coinbase/cdp-sdk/commit/21244e32384fb189facbea96668087d24ded035a) Thanks [@0xRAG](https://github.com/0xRAG)! - Simplify analytics
+
 ## 1.44.1
 
 ### Patch Changes
@@ -414,7 +442,6 @@
 - [#122](https://github.com/coinbase/cdp-sdk/pull/122) [`ee41d98`](https://github.com/coinbase/cdp-sdk/commit/ee41d986406e3e8666d1d1a1b1525e7ff7435a2b) Thanks [@sddioulde](https://github.com/sddioulde)! - Added account actions to Solana
 
 - [#103](https://github.com/coinbase/cdp-sdk/pull/103) [`2777cde`](https://github.com/coinbase/cdp-sdk/commit/2777cde93e4f10579a4ca31e140720067799cf66) Thanks [@0xRAG](https://github.com/0xRAG)! - Added additional options to transfer methods:
-
   - Added `paymasterUrl` and `waitOptions` to EvmSmartAccount.transfer
   - Added `waitOptions` to EvmAccount.transfer
 
@@ -423,7 +450,6 @@
 ### Minor Changes
 
 - [#99](https://github.com/coinbase/cdp-sdk/pull/99) [`0fd6d2b`](https://github.com/coinbase/cdp-sdk/commit/0fd6d2ba56b2da52c96eb19278dc782560b7680b) Thanks [@0xRAG](https://github.com/0xRAG)! - Added actions to EvmAccount and EvmSmartAccount:
-
   - listTokenBalances
   - requestFaucet
   - sendTransaction (EvmAccount only)

package/README.md

@@ -12,11 +12,13 @@
   - [Updating Accounts](#updating-evm-or-solana-accounts)
   - [Testnet Faucet](#testnet-faucet)
   - [Sending Transactions](#sending-transactions)
+  - [EIP-7702 delegation](#eip-7702-delegation)
   - [EVM Smart Accounts](#evm-smart-accounts)
   - [EVM Swaps](#evm-swaps)
   - [Transferring Tokens](#transferring-tokens)
   - [Account Actions](#account-actions)
 - [Policy Management](#policy-management)
+  - [End User Policies](#end-user-policies)
 - [End-user Management](#end-user-management)
   - [Create End User](#create-end-user)
   - [Import End User](#import-end-user)
@@ -376,37 +378,49 @@ import { CdpClient } from "@coinbase/cdp-sdk";
 import "dotenv/config";
 
 import {
-  PublicKey,
-  SystemProgram,
-  SYSVAR_RECENT_BLOCKHASHES_PUBKEY,
-  Transaction,
-} from "@solana/web3.js";
+  address as solanaAddress,
+  appendTransactionMessageInstructions,
+  compileTransaction,
+  createNoopSigner,
+  createSolanaRpc,
+  createTransactionMessage,
+  getBase64EncodedWireTransaction,
+  pipe,
+  setTransactionMessageFeePayer,
+  setTransactionMessageLifetimeUsingBlockhash,
+} from "@solana/kit";
+import { getTransferSolInstruction } from "@solana-program/system";
 
 const cdp = new CdpClient();
 
 const account = await cdp.solana.createAccount();
 
-const faucetResp = await cdp.solana.requestFaucet({
+await cdp.solana.requestFaucet({
   address: account.address,
   token: "sol",
 });
 
-const transaction = new Transaction();
-transaction.add(
-  SystemProgram.transfer({
-    fromPubkey: new PublicKey(account.address),
-    toPubkey: new PublicKey("3KzDtddx4i53FBkvCzuDmRbaMozTZoJBb1TToWhz3JfE"),
-    lamports: 10000,
-  })
-);
+const rpc = createSolanaRpc("https://api.devnet.solana.com");
+const { value: { blockhash, lastValidBlockHeight } } = await rpc.getLatestBlockhash().send();
+
+const instruction = getTransferSolInstruction({
+  source: createNoopSigner(solanaAddress(account.address)),
+  destination: solanaAddress("3KzDtddx4i53FBkvCzuDmRbaMozTZoJBb1TToWhz3JfE"),
+  amount: 10000n,
+});
 
-// A more recent blockhash is set in the backend by CDP
-transaction.recentBlockhash = SYSVAR_RECENT_BLOCKHASHES_PUBKEY.toBase58();
-transaction.feePayer = new PublicKey(account.address);
+const txMsg = pipe(
+  createTransactionMessage({ version: 0 }),
+  (tx) => setTransactionMessageFeePayer(solanaAddress(account.address), tx),
+  (tx) =>
+    setTransactionMessageLifetimeUsingBlockhash(
+      { blockhash, lastValidBlockHeight },
+      tx,
+    ),
+  (tx) => appendTransactionMessageInstructions([instruction], tx),
+);
 
-const serializedTx = Buffer.from(
-  transaction.serialize({ requireAllSignatures: false })
-).toString("base64");
+const serializedTx = getBase64EncodedWireTransaction(compileTransaction(txMsg));
 
 console.log("Transaction serialized successfully");
 
@@ -416,10 +430,43 @@ const txResult = await cdp.solana.sendTransaction({
 });
 
 console.log(
-  `Transaction confirmed! Explorer link: https://explorer.solana.com/tx/${txResult.signature}?cluster=devnet`
+  `Transaction confirmed! Explorer link: https://explorer.solana.com/tx/${txResult.signature}?cluster=devnet`,
 );
 ```
 
+### EIP-7702 delegation
+
+You can create an [EIP-7702](https://eips.ethereum.org/EIPS/eip-7702) delegation for an existing EOA, upgrading it with smart account capabilities on supported networks. The delegated EOA can then use batched transactions and gas sponsorship via paymaster.
+
+```typescript
+import { CdpClient } from "@coinbase/cdp-sdk";
+import { createPublicClient, http } from "viem";
+import { baseSepolia } from "viem/chains";
+
+const cdp = new CdpClient();
+const publicClient = createPublicClient({
+  chain: baseSepolia,
+  transport: http(),
+});
+
+const account = await cdp.evm.getOrCreateAccount({ name: "MyAccount" });
+
+const { delegationOperationId } = await cdp.evm.createEvmEip7702Delegation({
+  address: account.address,
+  network: "base-sepolia",
+  enableSpendPermissions: false, // optional, defaults to false
+  idempotencyKey: "optional-uuid", // optional
+});
+
+// Wait for the delegation operation to complete
+const delegationOperation = await cdp.evm.waitForEvmEip7702DelegationOperationStatus({
+  delegationOperationId,
+});
+console.log(`Delegation confirmed (status: ${delegationOperation.status})`);
+```
+
+For a runnable example that includes faucet and receipt waiting, see [examples/typescript/evm/eip7702/createEip7702Delegation.ts](https://github.com/coinbase/cdp-sdk/blob/main/examples/typescript/evm/eip7702/createEip7702Delegation.ts).
+
 ### EVM Smart Accounts
 
 For EVM, we support Smart Accounts which are account-abstraction (ERC-4337) accounts. Currently there is only support for Base Sepolia and Base Mainnet for Smart Accounts.
@@ -754,35 +801,27 @@ await sender.transfer({
 
 For complete examples, check out [solana/account.transfer.ts](https://github.com/coinbase/cdp-sdk/blob/main/examples/typescript/solana/account.transfer.ts).
 
-You can transfer tokens between accounts using the `transfer` function, and wait for the transaction to be confirmed using the `confirmTransaction` function from `@solana/web3.js`:
+You can transfer tokens between accounts using the `transfer` function:
 
 ```typescript
-import { LAMPORTS_PER_SOL } from "@solana/web3.js";
+import { createSolanaRpc, type Signature } from "@solana/kit";
 
 const sender = await cdp.solana.createAccount();
 
-const connection = new Connection("https://api.devnet.solana.com");
-
 const { signature } = await sender.transfer({
   to: "3KzDtddx4i53FBkvCzuDmRbaMozTZoJBb1TToWhz3JfE",
-  amount: 0.01 * LAMPORTS_PER_SOL,
+  amount: 10_000_000n, // 0.01 SOL in lamports
   token: "sol",
-  network: connection,
+  network: "devnet",
 });
 
-const { blockhash, lastValidBlockHeight } = await connection.getLatestBlockhash();
+// Poll for confirmation using @solana/kit
+const rpc = createSolanaRpc("https://api.devnet.solana.com");
+const result = await rpc.getSignatureStatuses([signature as Signature]).send();
+const status = result.value[0];
 
-const confirmation = await connection.confirmTransaction(
-  {
-    signature,
-    blockhash,
-    lastValidBlockHeight,
-  },
-  "confirmed",
-);
-
-if (confirmation.value.err) {
-  console.log(`Something went wrong! Error: ${confirmation.value.err.toString()}`);
+if (status?.err) {
+  console.log(`Something went wrong! Error: ${JSON.stringify(status.err)}`);
 } else {
   console.log(
     `Transaction confirmed: Link: https://explorer.solana.com/tx/${signature}?cluster=devnet`,
@@ -801,18 +840,18 @@ const { signature } = await sender.transfer({
 });
 ```
 
-If you want to use your own Connection, you can pass one to the `network` parameter:
+If you want to use your own RPC client, you can pass one to the `network` parameter:
 
 ```typescript
-import { Connection } from "@solana/web3.js";
+import { createSolanaRpc } from "@solana/kit";
 
-const connection = new Connection("YOUR_RPC_URL");
+const rpc = createSolanaRpc("YOUR_RPC_URL");
 
 const { signature } = await sender.transfer({
   to: "3KzDtddx4i53FBkvCzuDmRbaMozTZoJBb1TToWhz3JfE",
   amount: "0.01",
   token: "usdc",
-  network: connection,
+  network: rpc,
 });
 ```
 
@@ -1079,6 +1118,8 @@ try {
 
 We currently support the following policy rules:
 
+**Server wallet rules:**
+
 - [SignEvmTransactionRule](https://docs.cdp.coinbase.com/api-reference/v2/rest-api/policy-engine/create-a-policy#signevmtransactionrule)
 - [SendEvmTransactionRule](https://docs.cdp.coinbase.com/api-reference/v2/rest-api/policy-engine/create-a-policy#sendevmtransactionrule)
 - [SignEvmMessageRule](https://docs.cdp.coinbase.com/api-reference/v2/rest-api/policy-engine/create-a-policy#signevmmessagerule)
@@ -1089,6 +1130,86 @@ We currently support the following policy rules:
 - [PrepareUserOperationRule](https://docs.cdp.coinbase.com/api-reference/v2/rest-api/policy-engine/create-a-policy#prepareuseroperationrule)
 - [SendUserOperationRule](https://docs.cdp.coinbase.com/api-reference/v2/rest-api/policy-engine/create-a-policy#senduseroperationrule)
 
+**End user rules:**
+
+- `SignEndUserEvmTransactionRule` — operation: `signEndUserEvmTransaction` (criteria: `ethValue`, `evmAddress`, `evmData`, `netUSDChange`)
+- `SendEndUserEvmTransactionRule` — operation: `sendEndUserEvmTransaction` (criteria: `ethValue`, `evmAddress`, `evmNetwork`, `evmData`, `netUSDChange`)
+- `SignEndUserEvmMessageRule` — operation: `signEndUserEvmMessage` (criteria: `evmMessage`)
+- `SignEndUserEvmTypedDataRule` — operation: `signEndUserEvmTypedData` (criteria: `evmTypedDataField`, `evmTypedDataVerifyingContract`)
+- `SignEndUserSolTransactionRule` — operation: `signEndUserSolTransaction` (criteria: `solAddress`, `solValue`, `splAddress`, `splValue`, `mintAddress`, `solData`, `programId`)
+- `SendEndUserSolTransactionRule` — operation: `sendEndUserSolTransaction` (criteria: `solAddress`, `solValue`, `splAddress`, `splValue`, `mintAddress`, `solData`, `programId`, `solNetwork`)
+- `SignEndUserSolMessageRule` — operation: `signEndUserSolMessage` (criteria: `solMessage`)
+
+End user rules use the same criteria types as their server wallet counterparts. For example, `signEndUserEvmTransaction` supports the same `ethValue`, `evmAddress`, and `evmData` criteria as `signEvmTransaction`.
+
+### End User Policies
+
+You can create policies that govern end-user operations using the same criteria types available for server wallet policies. The only difference is the `operation` value, which targets end-user-specific actions.
+
+#### End User EVM Policy
+
+This policy restricts end-user EVM transaction signing to a max value and allowlisted recipients — the same criteria used in `signEvmTransaction`:
+
+```typescript
+const policy = await cdp.policies.createPolicy({
+  policy: {
+    scope: "project",
+    description: "End User EVM Policy",
+    rules: [
+      {
+        action: "accept",
+        operation: "signEndUserEvmTransaction",
+        criteria: [
+          {
+            type: "ethValue",
+            ethValue: "1000000000000000000", // 1 ETH in wei
+            operator: "<=",
+          },
+          {
+            type: "evmAddress",
+            addresses: ["0x000000000000000000000000000000000000dEaD"],
+            operator: "in",
+          },
+        ],
+      },
+    ],
+  },
+});
+```
+
+#### End User Solana Policy
+
+This policy restricts end-user Solana transaction signing to allowlisted recipients under a SOL value threshold — the same criteria used in `signSolTransaction`:
+
+```typescript
+const policy = await cdp.policies.createPolicy({
+  policy: {
+    scope: "project",
+    description: "End User Solana Policy",
+    rules: [
+      {
+        action: "accept",
+        operation: "signEndUserSolTransaction",
+        criteria: [
+          {
+            type: "solAddress",
+            addresses: ["11111111111111111111111111111111"],
+            operator: "in",
+          },
+          {
+            type: "solValue",
+            solValue: "1000000000", // 1 SOL in lamports
+            operator: "<=",
+          },
+        ],
+      },
+    ],
+  },
+});
+```
+
+> For a comprehensive example demonstrating all 7 end-user operations, see [createEndUserPolicy.ts](https://github.com/coinbase/cdp-sdk/blob/main/examples/typescript/end-users/createEndUserPolicy.ts).
+
 ### End-user Management
 
 You can use the End User SDK to manage the users of your applications.

package/_cjs/accounts/evm/eip6492.js

@@ -0,0 +1,49 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.wrapSignatureWithEip6492IfUndeployed = wrapSignatureWithEip6492IfUndeployed;
+const viem_1 = require("viem");
+const COINBASE_SMART_WALLET_FACTORY = "0xBA5ED110eFDBa3D005bfC882d75358ACBbB85842";
+const COINBASE_SMART_WALLET_FACTORY_ABI = [
+    {
+        name: "createAccount",
+        type: "function",
+        inputs: [
+            { name: "owners", type: "bytes[]" },
+            { name: "nonce", type: "uint256" },
+        ],
+        outputs: [{ name: "account", type: "address" }],
+        stateMutability: "payable",
+    },
+];
+/**
+ * Wraps a smart account signature with EIP-6492 deployment data if the account is not yet deployed.
+ *
+ * For undeployed (counterfactual) Coinbase Smart Wallet accounts, validators cannot call
+ * `isValidSignature` on-chain. EIP-6492 embeds the factory address and calldata so that
+ * validators can simulate deployment before verifying the signature.
+ *
+ * @param publicClient - A viem public client used to check the account bytecode.
+ * @param accountAddress - The smart account address to check deployment status.
+ * @param ownerAddress - The owner address used as the factory `createAccount` argument.
+ * @param signature - The inner ERC-1271 signature to wrap.
+ * @returns The original signature if the account is deployed, or an EIP-6492 wrapped signature otherwise.
+ */
+async function wrapSignatureWithEip6492IfUndeployed(publicClient, accountAddress, ownerAddress, signature) {
+    const bytecode = await publicClient.getCode({ address: accountAddress });
+    const isDeployed = bytecode !== undefined && bytecode !== "0x";
+    if (!isDeployed) {
+        const ownerBytes = (0, viem_1.encodeAbiParameters)([{ type: "address" }], [ownerAddress]);
+        const factoryCalldata = (0, viem_1.encodeFunctionData)({
+            abi: COINBASE_SMART_WALLET_FACTORY_ABI,
+            functionName: "createAccount",
+            args: [[ownerBytes], 0n],
+        });
+        return (0, viem_1.serializeErc6492Signature)({
+            address: COINBASE_SMART_WALLET_FACTORY,
+            data: factoryCalldata,
+            signature,
+        });
+    }
+    return signature;
+}
+//# sourceMappingURL=eip6492.js.map

package/_cjs/accounts/evm/eip6492.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"eip6492.js","sourceRoot":"","sources":["../../../accounts/evm/eip6492.ts"],"names":[],"mappings":";;AAiCA,oFA0BC;AA3DD,+BAA0F;AAK1F,MAAM,6BAA6B,GAAG,4CAA4C,CAAC;AAEnF,MAAM,iCAAiC,GAAG;IACxC;QACE,IAAI,EAAE,eAAe;QACrB,IAAI,EAAE,UAAU;QAChB,MAAM,EAAE;YACN,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE;YACnC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE;SACnC;QACD,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QAC/C,eAAe,EAAE,SAAS;KAC3B;CACO,CAAC;AAEX;;;;;;;;;;;;GAYG;AACI,KAAK,UAAU,oCAAoC,CACxD,YAA0B,EAC1B,cAAuB,EACvB,YAAqB,EACrB,SAAc;IAEd,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC,CAAC;IACzE,MAAM,UAAU,GAAG,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,IAAI,CAAC;IAE/D,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,UAAU,GAAG,IAAA,0BAAmB,EAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC;QAE9E,MAAM,eAAe,GAAG,IAAA,yBAAkB,EAAC;YACzC,GAAG,EAAE,iCAAiC;YACtC,YAAY,EAAE,eAAe;YAC7B,IAAI,EAAE,CAAC,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;SACzB,CAAC,CAAC;QAEH,OAAO,IAAA,gCAAyB,EAAC;YAC/B,OAAO,EAAE,6BAA6B;YACtC,IAAI,EAAE,eAAe;YACrB,SAAS;SACV,CAAC,CAAC;IACL,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/_cjs/accounts/evm/toEvmDelegatedAccount.js

@@ -0,0 +1,27 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.toEvmDelegatedAccount = toEvmDelegatedAccount;
+const toEvmSmartAccount_js_1 = require("./toEvmSmartAccount.js");
+const index_js_1 = require("../../openapi-client/index.js");
+/**
+ * Creates an EvmSmartAccount view of a server account for use after EIP-7702 delegation.
+ * Uses the API client configured by your CdpClient instance.
+ *
+ * The returned account has the same address as the EOA and uses the server account as owner,
+ * so you can call sendUserOperation, waitForUserOperation, etc.
+ *
+ * @param account - The server account (EOA) that has been delegated via EIP-7702.
+ * @returns An EvmSmartAccount view ready for user operation submission.
+ */
+function toEvmDelegatedAccount(account) {
+    return (0, toEvmSmartAccount_js_1.toEvmSmartAccount)(index_js_1.CdpOpenApiClient, {
+        smartAccount: {
+            address: account.address,
+            owners: [account.address],
+            name: account.name,
+            policies: account.policies,
+        },
+        owner: account,
+    });
+}
+//# sourceMappingURL=toEvmDelegatedAccount.js.map

package/_cjs/accounts/evm/toEvmDelegatedAccount.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"toEvmDelegatedAccount.js","sourceRoot":"","sources":["../../../accounts/evm/toEvmDelegatedAccount.ts"],"names":[],"mappings":";;AAeA,sDAUC;AAzBD,iEAA2D;AAC3D,4DAAiE;AAIjE;;;;;;;;;GASG;AACH,SAAgB,qBAAqB,CAAC,OAAyB;IAC7D,OAAO,IAAA,wCAAiB,EAAC,2BAAgB,EAAE;QACzC,YAAY,EAAE;YACZ,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,MAAM,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC;YACzB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,QAAQ,EAAE,OAAO,CAAC,QAAQ;SAC3B;QACD,KAAK,EAAE,OAAO;KACf,CAAC,CAAC;AACL,CAAC"}