@coinbase/cdp-sdk 1.45.0 → 1.46.1

package/client/end-user/toEndUserAccount.ts

@@ -6,6 +6,32 @@ import type {
   AddEndUserEvmSmartAccountResult,
   AddEndUserSolanaAccountResult,
   AddEvmSmartAccountOptions,
+  SignEvmHashResult,
+  SignEvmTransactionResult,
+  SignEvmMessageResult,
+  SignEvmTypedDataResult,
+  SendEvmTransactionResult,
+  SendEvmAssetResult,
+  SendUserOperationResult,
+  CreateEvmEip7702DelegationForEndUserResult,
+  SignSolanaHashResult,
+  SignSolanaMessageResult,
+  SignSolanaTransactionResult,
+  SendSolanaTransactionResult,
+  SendSolanaAssetResult,
+  AccountSignEvmHashOptions,
+  AccountSignEvmTransactionOptions,
+  AccountSignEvmMessageOptions,
+  AccountSignEvmTypedDataOptions,
+  AccountSendEvmTransactionOptions,
+  AccountSendEvmAssetOptions,
+  AccountSendUserOperationOptions,
+  AccountCreateEvmEip7702DelegationOptions,
+  AccountSignSolanaHashOptions,
+  AccountSignSolanaMessageOptions,
+  AccountSignSolanaTransactionOptions,
+  AccountSendSolanaTransactionOptions,
+  AccountSendSolanaAssetOptions,
 } from "./endUser.types.js";
 import type {
   CdpOpenApiClientType,
@@ -18,11 +44,83 @@ import type {
 export type ToEndUserAccountOptions = {
   /** The end user from the API response. */
   endUser: OpenAPIEndUser;
+  /** The CDP project ID. Required for delegation operations (signing, sending). */
+  projectId?: string;
 };
 
+/**
+ * Returns the project ID or throws if not configured.
+ * Used by delegation operations that require a project ID.
+ *
+ * @param projectId - The project ID to validate.
+ * @returns The validated project ID.
+ */
+function requireProjectId(projectId: string | undefined): string {
+  if (!projectId) {
+    throw new Error(
+      "Missing required project ID for delegation operation. " +
+        "Set the CDP_PROJECT_ID environment variable or pass projectId to the CdpClient constructor.",
+    );
+  }
+
+  return projectId;
+}
+
+/**
+ * Resolves the first EVM EOA address for this end user, or throws if none exist and no override was provided.
+ *
+ * @param endUser - The OpenAPI end user.
+ * @param override - An optional address override.
+ * @returns The resolved EVM address.
+ */
+function resolveEvmAddress(endUser: OpenAPIEndUser, override?: string): string {
+  const address = override ?? endUser.evmAccountObjects[0]?.address;
+  if (!address) {
+    throw new Error(
+      "No EVM account found on this end user. Provide an explicit address or add an EVM account first.",
+    );
+  }
+  return address;
+}
+
+/**
+ * Resolves the first EVM smart account address for this end user, or throws if none exist and no override was provided.
+ *
+ * @param endUser - The OpenAPI end user.
+ * @param override - An optional address override.
+ * @returns The resolved EVM smart account address.
+ */
+function resolveEvmSmartAccountAddress(endUser: OpenAPIEndUser, override?: string): string {
+  const address = override ?? endUser.evmSmartAccountObjects[0]?.address;
+  if (!address) {
+    throw new Error(
+      "No EVM smart account found on this end user. Provide an explicit address or add an EVM smart account first.",
+    );
+  }
+  return address;
+}
+
+/**
+ * Resolves the first Solana address for this end user, or throws if none exist and no override was provided.
+ *
+ * @param endUser - The OpenAPI end user.
+ * @param override - An optional address override.
+ * @returns The resolved Solana address.
+ */
+function resolveSolanaAddress(endUser: OpenAPIEndUser, override?: string): string {
+  const address = override ?? endUser.solanaAccountObjects[0]?.address;
+  if (!address) {
+    throw new Error(
+      "No Solana account found on this end user. Provide an explicit address or add a Solana account first.",
+    );
+  }
+  return address;
+}
+
 /**
  * Creates an EndUserAccount instance with actions from an existing OpenAPI EndUser.
- * This wraps the raw API response and adds convenience methods for adding accounts.
+ * This wraps the raw API response and adds convenience methods for adding accounts
+ * and performing delegated signing/sending operations.
  *
  * @param apiClient - The API client.
  * @param options - Configuration options.
@@ -33,46 +131,252 @@ export function toEndUserAccount(
   apiClient: CdpOpenApiClientType,
   options: ToEndUserAccountOptions,
 ): EndUserAccount {
+  const { endUser, projectId } = options;
+
   const endUserAccount: EndUserAccount = {
     // Pass through all properties from the OpenAPI EndUser
-    userId: options.endUser.userId,
-    authenticationMethods: options.endUser.authenticationMethods,
-    mfaMethods: options.endUser.mfaMethods,
-    evmAccounts: options.endUser.evmAccounts,
-    evmAccountObjects: options.endUser.evmAccountObjects,
-    evmSmartAccounts: options.endUser.evmSmartAccounts,
-    evmSmartAccountObjects: options.endUser.evmSmartAccountObjects,
-    solanaAccounts: options.endUser.solanaAccounts,
-    solanaAccountObjects: options.endUser.solanaAccountObjects,
-    createdAt: options.endUser.createdAt,
-
-    // Add action methods
-    async addEvmAccount(): Promise<AddEndUserEvmAccountResult> {
-      Analytics.trackAction({
-        action: "end_user_add_evm_account",
-      });
+    userId: endUser.userId,
+    authenticationMethods: endUser.authenticationMethods,
+    mfaMethods: endUser.mfaMethods,
+    evmAccounts: endUser.evmAccounts,
+    evmAccountObjects: endUser.evmAccountObjects,
+    evmSmartAccounts: endUser.evmSmartAccounts,
+    evmSmartAccountObjects: endUser.evmSmartAccountObjects,
+    solanaAccounts: endUser.solanaAccounts,
+    solanaAccountObjects: endUser.solanaAccountObjects,
+    createdAt: endUser.createdAt,
+
+    // ─── Account Management Methods ───
 
-      return apiClient.addEndUserEvmAccount(options.endUser.userId, {});
+    async addEvmAccount(): Promise<AddEndUserEvmAccountResult> {
+      Analytics.trackAction({ action: "end_user_add_evm_account" });
+      return apiClient.addEndUserEvmAccount(endUser.userId, {});
     },
 
     async addEvmSmartAccount(
       smartAccountOptions: AddEvmSmartAccountOptions,
     ): Promise<AddEndUserEvmSmartAccountResult> {
-      Analytics.trackAction({
-        action: "end_user_add_evm_smart_account",
-      });
-
-      return apiClient.addEndUserEvmSmartAccount(options.endUser.userId, {
+      Analytics.trackAction({ action: "end_user_add_evm_smart_account" });
+      return apiClient.addEndUserEvmSmartAccount(endUser.userId, {
         enableSpendPermissions: smartAccountOptions.enableSpendPermissions,
       });
     },
 
     async addSolanaAccount(): Promise<AddEndUserSolanaAccountResult> {
-      Analytics.trackAction({
-        action: "end_user_add_solana_account",
+      Analytics.trackAction({ action: "end_user_add_solana_account" });
+      return apiClient.addEndUserSolanaAccount(endUser.userId, {});
+    },
+
+    async revokeDelegation(): Promise<void> {
+      Analytics.trackAction({ action: "end_user_revoke_delegation" });
+      await apiClient.revokeDelegationForEndUser(requireProjectId(projectId), endUser.userId, {});
+    },
+
+    // ─── Delegated EVM Sign Methods ───
+
+    async signEvmHash(opts: AccountSignEvmHashOptions): Promise<SignEvmHashResult> {
+      Analytics.trackAction({ action: "end_user_sign_evm_hash" });
+      const address = resolveEvmAddress(endUser, opts.address);
+      return apiClient.signEvmHashWithEndUserAccount(requireProjectId(projectId), endUser.userId, {
+        hash: opts.hash,
+        address,
       });
+    },
+
+    async signEvmTransaction(
+      opts: AccountSignEvmTransactionOptions,
+    ): Promise<SignEvmTransactionResult> {
+      Analytics.trackAction({ action: "end_user_sign_evm_transaction" });
+      const address = resolveEvmAddress(endUser, opts.address);
+      return apiClient.signEvmTransactionWithEndUserAccount(
+        requireProjectId(projectId),
+        endUser.userId,
+        {
+          address,
+          transaction: opts.transaction,
+        },
+      );
+    },
+
+    async signEvmMessage(opts: AccountSignEvmMessageOptions): Promise<SignEvmMessageResult> {
+      Analytics.trackAction({ action: "end_user_sign_evm_message" });
+      const address = resolveEvmAddress(endUser, opts.address);
+      return apiClient.signEvmMessageWithEndUserAccount(
+        requireProjectId(projectId),
+        endUser.userId,
+        {
+          address,
+          message: opts.message,
+        },
+      );
+    },
+
+    async signEvmTypedData(opts: AccountSignEvmTypedDataOptions): Promise<SignEvmTypedDataResult> {
+      Analytics.trackAction({ action: "end_user_sign_evm_typed_data" });
+      const address = resolveEvmAddress(endUser, opts.address);
+      return apiClient.signEvmTypedDataWithEndUserAccount(
+        requireProjectId(projectId),
+        endUser.userId,
+        {
+          address,
+          typedData: opts.typedData,
+        },
+      );
+    },
+
+    // ─── Delegated EVM Send Methods ───
+
+    async sendEvmTransaction(
+      opts: AccountSendEvmTransactionOptions,
+    ): Promise<SendEvmTransactionResult> {
+      Analytics.trackAction({ action: "end_user_send_evm_transaction" });
+      const address = resolveEvmAddress(endUser, opts.address);
+      return apiClient.sendEvmTransactionWithEndUserAccount(
+        requireProjectId(projectId),
+        endUser.userId,
+        {
+          address,
+          transaction: opts.transaction,
+          network: opts.network,
+        },
+      );
+    },
+
+    async sendEvmAsset(opts: AccountSendEvmAssetOptions): Promise<SendEvmAssetResult> {
+      Analytics.trackAction({ action: "end_user_send_evm_asset" });
+      const address = resolveEvmAddress(endUser, opts.address);
+      const asset = opts.asset ?? "usdc";
+      return apiClient.sendEvmAssetWithEndUserAccount(
+        requireProjectId(projectId),
+        endUser.userId,
+        address,
+        asset,
+        {
+          to: opts.to,
+          amount: opts.amount,
+          network: opts.network,
+          useCdpPaymaster: opts.useCdpPaymaster,
+          paymasterUrl: opts.paymasterUrl,
+        },
+      );
+    },
+
+    async sendUserOperation(
+      opts: AccountSendUserOperationOptions,
+    ): Promise<SendUserOperationResult> {
+      Analytics.trackAction({ action: "end_user_send_user_operation" });
+      const address = resolveEvmSmartAccountAddress(endUser, opts.address);
+      return apiClient.sendUserOperationWithEndUserAccount(
+        requireProjectId(projectId),
+        endUser.userId,
+        address,
+        {
+          network: opts.network,
+          calls: opts.calls,
+          useCdpPaymaster: opts.useCdpPaymaster,
+          paymasterUrl: opts.paymasterUrl,
+          dataSuffix: opts.dataSuffix,
+        },
+      );
+    },
+
+    // ─── Delegated EVM EIP-7702 Delegation Method ───
+
+    async createEvmEip7702Delegation(
+      opts: AccountCreateEvmEip7702DelegationOptions,
+    ): Promise<CreateEvmEip7702DelegationForEndUserResult> {
+      Analytics.trackAction({ action: "end_user_create_evm_eip7702_delegation" });
+      const address = resolveEvmAddress(endUser, opts.address);
+      return apiClient.createEvmEip7702DelegationWithEndUserAccount(
+        requireProjectId(projectId),
+        endUser.userId,
+        {
+          address,
+          network: opts.network,
+          enableSpendPermissions: opts.enableSpendPermissions,
+        },
+      );
+    },
+
+    // ─── Delegated Solana Sign Methods ───
+
+    async signSolanaHash(opts: AccountSignSolanaHashOptions): Promise<SignSolanaHashResult> {
+      Analytics.trackAction({ action: "end_user_sign_solana_hash" });
+      const address = resolveSolanaAddress(endUser, opts.address);
+      return apiClient.signSolanaHashWithEndUserAccount(
+        requireProjectId(projectId),
+        endUser.userId,
+        {
+          hash: opts.hash,
+          address,
+        },
+      );
+    },
+
+    async signSolanaMessage(
+      opts: AccountSignSolanaMessageOptions,
+    ): Promise<SignSolanaMessageResult> {
+      Analytics.trackAction({ action: "end_user_sign_solana_message" });
+      const address = resolveSolanaAddress(endUser, opts.address);
+      return apiClient.signSolanaMessageWithEndUserAccount(
+        requireProjectId(projectId),
+        endUser.userId,
+        {
+          address,
+          message: opts.message,
+        },
+      );
+    },
+
+    async signSolanaTransaction(
+      opts: AccountSignSolanaTransactionOptions,
+    ): Promise<SignSolanaTransactionResult> {
+      Analytics.trackAction({ action: "end_user_sign_solana_transaction" });
+      const address = resolveSolanaAddress(endUser, opts.address);
+      return apiClient.signSolanaTransactionWithEndUserAccount(
+        requireProjectId(projectId),
+        endUser.userId,
+        {
+          address,
+          transaction: opts.transaction,
+        },
+      );
+    },
+
+    // ─── Delegated Solana Send Methods ───
+
+    async sendSolanaTransaction(
+      opts: AccountSendSolanaTransactionOptions,
+    ): Promise<SendSolanaTransactionResult> {
+      Analytics.trackAction({ action: "end_user_send_solana_transaction" });
+      const address = resolveSolanaAddress(endUser, opts.address);
+      return apiClient.sendSolanaTransactionWithEndUserAccount(
+        requireProjectId(projectId),
+        endUser.userId,
+        {
+          address,
+          transaction: opts.transaction,
+          network: opts.network,
+        },
+      );
+    },
 
-      return apiClient.addEndUserSolanaAccount(options.endUser.userId, {});
+    async sendSolanaAsset(opts: AccountSendSolanaAssetOptions): Promise<SendSolanaAssetResult> {
+      Analytics.trackAction({ action: "end_user_send_solana_asset" });
+      const address = resolveSolanaAddress(endUser, opts.address);
+      const asset = opts.asset ?? "usdc";
+      return apiClient.sendSolanaAssetWithEndUserAccount(
+        requireProjectId(projectId),
+        endUser.userId,
+        address,
+        asset,
+        {
+          to: opts.to,
+          amount: opts.amount,
+          network: opts.network,
+          createRecipientAta: opts.createRecipientAta,
+        },
+      );
     },
   };
 

package/client/evm/evm.types.ts

@@ -468,8 +468,10 @@ export interface ListServerAccountsOptions {
 /**
  * A smart account that only contains the owner address.
  */
-export interface ReadonlySmartAccount
-  extends Omit<SmartAccount, "owners" | keyof SmartAccountActions | "useNetwork"> {
+export interface ReadonlySmartAccount extends Omit<
+  SmartAccount,
+  "owners" | keyof SmartAccountActions | "useNetwork"
+> {
   /** The owners of the smart account. */
   owners: Address[];
 }

package/client/solana/solana.ts

@@ -153,7 +153,7 @@ export class SolanaClient implements SolanaClientInterface {
       })();
 
       const decryptedPrivateKey = decryptWithPrivateKey(privateKey, encryptedPrivateKey);
-      return formatSolanaPrivateKey(decryptedPrivateKey);
+      return await formatSolanaPrivateKey(decryptedPrivateKey);
     } catch (error) {
       if (!(error instanceof UserInputValidationError)) {
         Analytics.trackError(error, "exportAccount");
@@ -484,18 +484,44 @@ export class SolanaClient implements SolanaClientInterface {
    * // Create a Solana account
    * const account = await cdp.solana.createAccount();
    *
-   * // Add your transaction instructions here
-   * const transaction = new Transaction()
-   *
-   * // Make sure to set requireAllSignatures to false, since signing will be done through the API
-   * const serializedTransaction = transaction.serialize({
-   *   requireAllSignatures: false,
-   * });
-   *
-   * // Base64 encode the serialized transaction
-   * const transaction = Buffer.from(serializedTransaction).toString("base64");
-   *
-   * // When you want to sign a transaction, you can do so by address and base64 encoded transaction
+   * // Build your transaction using @solana/kit
+   * import {
+   *   address as solanaAddress,
+   *   appendTransactionMessageInstructions,
+   *   compileTransaction,
+   *   createNoopSigner,
+   *   createSolanaRpc,
+   *   createTransactionMessage,
+   *   getBase64EncodedWireTransaction,
+   *   pipe,
+   *   setTransactionMessageFeePayer,
+   *   setTransactionMessageLifetimeUsingBlockhash,
+   * } from "@solana/kit";
+   * import { getTransferSolInstruction } from "@solana-program/system";
+   *
+   * const rpc = createSolanaRpc("https://api.devnet.solana.com");
+   * const { value: { blockhash, lastValidBlockHeight } } = await rpc.getLatestBlockhash().send();
+   *
+   * const txMsg = pipe(
+   *   createTransactionMessage({ version: 0 }),
+   *   (tx) => setTransactionMessageFeePayer(solanaAddress(account.address), tx),
+   *   (tx) => setTransactionMessageLifetimeUsingBlockhash(
+   *     { blockhash, lastValidBlockHeight },
+   *     tx,
+   *   ),
+   *   (tx) => appendTransactionMessageInstructions([
+   *     getTransferSolInstruction({
+   *       source: createNoopSigner(solanaAddress(account.address)),
+   *       destination: solanaAddress("3KzDtddx4i53FBkvCzuDmRbaMozTZoJBb1TToWhz3JfE"),
+   *       amount: 10000n,
+   *     }),
+   *   ], tx),
+   * );
+   *
+   * // Base64 encode the compiled transaction
+   * const transaction = getBase64EncodedWireTransaction(compileTransaction(txMsg));
+   *
+   * // Sign the transaction via the CDP API
    * const signature = await cdp.solana.signTransaction({
    *   address: account.address,
    *   transaction,

package/index.ts

@@ -15,7 +15,37 @@ export {
 export { NetworkError } from "./openapi-client/errors.js";
 export type { SpendPermission, SpendPermissionInput } from "./spend-permissions/types.js";
 export type { SpendPermissionNetwork, ListEndUsers200, EndUser } from "./openapi-client/index.js";
-export type { ListEndUsersOptions, EndUserAccount } from "./client/end-user/endUser.types.js";
+export type {
+  ListEndUsersOptions,
+  EndUserAccount,
+  RevokeDelegationForEndUserOptions,
+  SignEvmHashOptions,
+  SignEvmHashResult,
+  SignEvmTransactionOptions,
+  SignEvmTransactionResult,
+  SignEvmMessageOptions,
+  SignEvmMessageResult,
+  SignEvmTypedDataOptions,
+  SignEvmTypedDataResult,
+  SendEvmTransactionOptions,
+  SendEvmTransactionResult,
+  SendEvmAssetOptions,
+  SendEvmAssetResult,
+  SendUserOperationOptions,
+  SendUserOperationResult,
+  CreateEvmEip7702DelegationOptions as CreateEvmEip7702DelegationForEndUserOptions,
+  CreateEvmEip7702DelegationForEndUserResult,
+  SignSolanaHashOptions,
+  SignSolanaHashResult,
+  SignSolanaMessageOptions,
+  SignSolanaMessageResult,
+  SignSolanaTransactionOptions,
+  SignSolanaTransactionResult,
+  SendSolanaTransactionOptions,
+  SendSolanaTransactionResult,
+  SendSolanaAssetOptions,
+  SendSolanaAssetResult,
+} from "./client/end-user/endUser.types.js";
 export {
   SPEND_PERMISSION_MANAGER_ABI as spendPermissionManagerAbi,
   SPEND_PERMISSION_MANAGER_ADDRESS as spendPermissionManagerAddress,

package/openapi-client/cdpApiClient.ts

@@ -85,6 +85,26 @@ export const configure = (options: CdpOptions) => {
     expiresIn: options.expiresIn,
     debug: options.debugging,
   });
+
+  /*
+   * Delegated routing interceptor.
+   * Embedded Wallet API's are exposed to the developer for delegated signing
+   * via the /delegated path, which properly forwards the Authorization and
+   * X-Wallet-Auth headers from the edge.
+   *
+   * Registered after withAuth so it runs BEFORE the auth interceptor (LIFO order).
+   * This rewrites the URL first, then the auth interceptor computes JWT headers
+   * (Authorization and X-Wallet-Auth) against the rewritten URL path, ensuring
+   * the `uris` claim matches the actual request URL.
+   * The API gateway validates the JWT, strips the /delegated prefix, and forwards
+   * to the backend.
+   */
+  axiosInstance.interceptors.request.use(config => {
+    if (config.url && isDelegatedEndUserPath(config.url)) {
+      config.url = `/delegated${config.url}`;
+    }
+    return config;
+  });
 };
 
 /**
@@ -307,6 +327,20 @@ export const cdpApiClient = async <T>(
   }
 };
 
+/**
+ * Checks if the given request URL is a delegated end-user operation that should
+ * be routed through the /platform/delegated gateway prefix.
+ *
+ * These endpoints require both Authorization and X-Wallet-Auth headers to be
+ * forwarded by the API gateway, which the /delegated prefix enables.
+ *
+ * @param url - The request URL (relative, without base path).
+ * @returns True if the path should be routed through /platform/delegated.
+ */
+const isDelegatedEndUserPath = (url: string): boolean => {
+  return /^\/v2\/embedded-wallet-api\/projects\/[^/]+\/end-users\//.test(url);
+};
+
 /**
  * Validates the call to the cdpApiClient.
  *