@coras-io/embed 0.1.0

package/dist/mixins/coinbase.mixin.js

@@ -0,0 +1,979 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+import { state } from "lit/decorators.js";
+import { base, baseSepolia } from "viem/chains";
+import { createPublicClient, http, encodeFunctionData, parseUnits, formatUnits, isAddress, } from "viem";
+/**
+ * ERC-20 ABI for balance and transfer operations
+ */
+const ERC20_ABI = [
+    {
+        name: "balanceOf",
+        type: "function",
+        stateMutability: "view",
+        inputs: [{ name: "account", type: "address" }],
+        outputs: [{ name: "", type: "uint256" }],
+    },
+    {
+        name: "transfer",
+        type: "function",
+        stateMutability: "nonpayable",
+        inputs: [
+            { name: "to", type: "address" },
+            { name: "value", type: "uint256" },
+        ],
+        outputs: [{ name: "", type: "bool" }],
+    },
+    {
+        name: "decimals",
+        type: "function",
+        stateMutability: "view",
+        inputs: [],
+        outputs: [{ name: "", type: "uint8" }],
+    },
+];
+export { assertNonZeroAddress as _assertNonZeroAddress, ZERO_ADDRESS as _ZERO_ADDRESS, };
+/**
+ * Email validation regex (RFC 5322 simplified).
+ * Max 254 chars enforced separately per RFC 5321.
+ */
+const EMAIL_REGEX = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+const EMAIL_MAX_LENGTH = 254;
+/**
+ * Phone number validation regex (E.164 format).
+ * Format: +[country code][number], e.g., +14155552671
+ */
+const PHONE_REGEX = /^\+[1-9]\d{6,14}$/;
+/**
+ * UUID format validation for CDP Project ID.
+ */
+const UUID_REGEX = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+/**
+ * Token decimals for FIDA (standard ERC-20 is 18)
+ */
+const TOKEN_DECIMALS = 18;
+/**
+ * Maximum transfer amount (safety bound).
+ */
+const MAX_TRANSFER_AMOUNT = 1_000_000;
+/**
+ * Zero address constant — transfers to this address permanently burn tokens.
+ */
+const ZERO_ADDRESS = "0x0000000000000000000000000000000000000000";
+/**
+ * Validates that an address is both a valid Ethereum address and not the zero address.
+ * Zero address is technically valid by format but represents a burn address
+ * that would cause irreversible loss of funds.
+ *
+ * @throws Error if address is invalid or zero
+ */
+function assertNonZeroAddress(address, label) {
+    if (!isAddress(address) || address.toLowerCase() === ZERO_ADDRESS) {
+        throw new Error(`${label} is invalid or zero-address`);
+    }
+}
+/**
+ * localStorage key for persisting the Coinbase login email.
+ * The CDP SDK does not return the email on session restore,
+ * so we persist it at login time to autofill the billing email.
+ */
+const COINBASE_EMAIL_KEY = "coras-coinbase-email";
+export const CoinbaseMixin = (Base) => {
+    class CoinbaseMixinClass extends Base {
+        constructor() {
+            super(...arguments);
+            this.codeSent = false;
+            this.walletEmail = "";
+            this.walletEmailError = "";
+            this.isTransferPending = false;
+            this.pendingTransferAmount = "";
+            this.isMfaEnrolled = false;
+            this.mfaEnrollmentCodeSent = false;
+            this.mfaEnrollmentError = "";
+            this._mfaEnrollmentPhone = "";
+            this.mfaVerificationRequired = false;
+            this.mfaVerificationError = "";
+            this._mfaListenerUnsubscribe = null;
+            this._mfaInProgress = false;
+            this.cdpProjectId = "";
+            this.cryptoNetwork = "base";
+            this.tokenContractAddress = "0x0000000000000000000000000000000000000000";
+            this.recipientAddress = "0x0000000000000000000000000000000000000000";
+            this._isInitialized = false;
+            this._initPromise = null;
+            this._flowId = null;
+            this._cdpCore = null;
+            this._publicClient = null;
+        }
+        /**
+         * Validates an email address.
+         */
+        validateEmail(email) {
+            return email.length <= EMAIL_MAX_LENGTH && EMAIL_REGEX.test(email);
+        }
+        /**
+         * Sanitizes email input to prevent injection attacks.
+         */
+        sanitizeEmail(email) {
+            return email.trim().toLowerCase();
+        }
+        /**
+         * Validates a phone number in E.164 format.
+         */
+        validatePhone(phone) {
+            return PHONE_REGEX.test(phone);
+        }
+        /**
+         * Sanitizes phone input - removes spaces and dashes.
+         */
+        sanitizePhone(phone) {
+            return phone.replace(/[\s\-()]/g, "");
+        }
+        /**
+         * Extracts the first EVM account address from a CDP user object.
+         * Handles both string and object formats consistently.
+         */
+        extractAccountAddress(user) {
+            if (user.evmAccounts && user.evmAccounts.length > 0) {
+                const firstAccount = user.evmAccounts[0];
+                return (typeof firstAccount === "string"
+                    ? firstAccount
+                    : firstAccount.address);
+            }
+            if (user.evmAccountObjects && user.evmAccountObjects.length > 0) {
+                return user.evmAccountObjects[0].address;
+            }
+            return undefined;
+        }
+        /**
+         * Extracts the smart account address from a CDP user object.
+         * Checks evmSmartAccountObjects first (newer API), then evmSmartAccounts.
+         */
+        extractSmartAccountAddress(user) {
+            if (user.evmSmartAccountObjects &&
+                user.evmSmartAccountObjects.length > 0) {
+                const smartAccount = user.evmSmartAccountObjects[0];
+                return (typeof smartAccount === "string" ? smartAccount : smartAccount.address);
+            }
+            if (user.evmSmartAccounts && user.evmSmartAccounts.length > 0) {
+                const smartAccount = user.evmSmartAccounts[0];
+                return (typeof smartAccount === "string" ? smartAccount : smartAccount.address);
+            }
+            return undefined;
+        }
+        /**
+         * Initializes Coinbase CDP SDK for embedded wallets.
+         * This method is idempotent - calling it multiple times is safe.
+         *
+         * @param projectId - CDP Project ID from Coinbase Developer Platform
+         * @returns true if initialization succeeded, false otherwise
+         */
+        async initCoinbase(projectId) {
+            if (this._isInitialized) {
+                return true;
+            }
+            // Prevent concurrent initialization race condition
+            if (this._initPromise) {
+                return this._initPromise;
+            }
+            const pid = projectId || this.cdpProjectId;
+            if (!pid) {
+                console.error("CDP Project ID is required for initialization");
+                return false;
+            }
+            if (!UUID_REGEX.test(pid)) {
+                console.error("CDP Project ID must be a valid UUID");
+                return false;
+            }
+            // Validate addresses — misconfigured zero-address defaults would irreversibly burn tokens
+            try {
+                assertNonZeroAddress(this.recipientAddress, "Recipient address");
+                assertNonZeroAddress(this.tokenContractAddress, "Token contract address");
+            }
+            catch (e) {
+                console.error(e instanceof Error ? e.message : "Invalid address configuration");
+                return false;
+            }
+            this._initPromise = (async () => {
+                try {
+                    this._cdpCore = (await import("@coinbase/cdp-core"));
+                    // createOnLogin: "smart" ensures new users get a smart account for gas-sponsored transactions
+                    await this._cdpCore.initialize({
+                        projectId: pid,
+                        ethereum: {
+                            createOnLogin: "smart",
+                        },
+                    });
+                    this._publicClient = createPublicClient({
+                        chain: this.cryptoNetwork === "base" ? base : baseSepolia,
+                        transport: this.cryptoRpc ? http(this.cryptoRpc) : http(),
+                    });
+                    // CDP SDK calls this listener when sendUserOperation requires MFA
+                    this._mfaListenerUnsubscribe = this._cdpCore.registerMfaListener((context) => {
+                        this.handleMfaListenerTriggered(context);
+                    });
+                    this._isInitialized = true;
+                    await this.restoreSession();
+                    return true;
+                }
+                catch {
+                    console.error("Failed to initialize CDP SDK");
+                    this.cleanupCoinbase();
+                    return false;
+                }
+                finally {
+                    this._initPromise = null;
+                }
+            })();
+            return this._initPromise;
+        }
+        /**
+         * Attempts to restore an existing session
+         */
+        async restoreSession() {
+            if (!this._cdpCore)
+                return;
+            try {
+                const user = await this._cdpCore.getCurrentUser();
+                if (user) {
+                    const address = this.extractAccountAddress(user);
+                    const smartAccountAddress = this.extractSmartAccountAddress(user);
+                    if (address) {
+                        // Restore persisted email (CDP SDK doesn't return it)
+                        let email;
+                        try {
+                            email = localStorage.getItem(COINBASE_EMAIL_KEY) || undefined;
+                        }
+                        catch {
+                            // localStorage may be blocked (e.g. private browsing)
+                        }
+                        this.coinbaseSession = {
+                            address,
+                            smartAccountAddress,
+                            email,
+                            userId: user.userId,
+                            isConnected: true,
+                        };
+                        await this.checkMfaEnrolled();
+                    }
+                }
+            }
+            catch {
+                // No existing session, that's fine
+            }
+        }
+        /**
+         * Checks if the user has MFA enrolled for transaction verification.
+         * MFA enrollment protects sensitive operations like sendUserOperation.
+         *
+         * @returns true if MFA is enrolled, false otherwise
+         */
+        async checkMfaEnrolled() {
+            if (!this._cdpCore) {
+                console.warn("CDP SDK not initialized");
+                return false;
+            }
+            try {
+                const user = await this._cdpCore.getCurrentUser();
+                if (user) {
+                    // Narrow to record shape (not array) to access .totp/.sms properties
+                    const mfaMethods = user.mfaMethods;
+                    const mfaRecord = mfaMethods && !Array.isArray(mfaMethods) ? mfaMethods : null;
+                    const hasTotp = !!mfaRecord?.totp;
+                    const hasSms = !!mfaRecord?.sms;
+                    // Fallback for older SDK versions that returned different shapes
+                    const hasLegacyMfa = user.mfaEnrolled === true ||
+                        user.hasMfa === true ||
+                        (Array.isArray(user.mfaMethods) && user.mfaMethods.length > 0);
+                    const hasMfa = hasTotp || hasSms || hasLegacyMfa;
+                    this.isMfaEnrolled = hasMfa;
+                    return hasMfa;
+                }
+                return false;
+            }
+            catch {
+                console.error("Failed to check MFA enrolled status");
+                return false;
+            }
+        }
+        /**
+         * Initiates SMS MFA enrollment for transaction verification.
+         * This enrolls the phone for MFA which protects sensitive operations
+         * like sendUserOperation.
+         *
+         * NOTE: Only call this if checkMfaEnrolled() returns false.
+         * If MFA is already enrolled, sendUserOperation will automatically
+         * trigger verification via the MFA listener.
+         *
+         * @param phoneNumber - Phone number in E.164 format (e.g., +14155552671)
+         * @throws {Error} If phone is invalid or SDK is not initialized
+         */
+        async initiateMfaEnrollment(phoneNumber) {
+            if (!this._cdpCore) {
+                throw new Error("CDP SDK not initialized");
+            }
+            if (!this.coinbaseSession) {
+                throw new Error("User must be authenticated before enrolling in MFA");
+            }
+            const alreadyEnrolled = await this.checkMfaEnrolled();
+            if (alreadyEnrolled) {
+                return;
+            }
+            const sanitizedPhone = this.sanitizePhone(phoneNumber);
+            if (!this.validatePhone(sanitizedPhone)) {
+                throw new Error("Invalid phone number format. Please use E.164 format (e.g., +14155552671)");
+            }
+            try {
+                await this._cdpCore.initiateMfaEnrollment({
+                    mfaMethod: "sms",
+                    phoneNumber: sanitizedPhone,
+                });
+                this._mfaEnrollmentPhone = sanitizedPhone;
+                this.mfaEnrollmentCodeSent = true;
+                this.mfaEnrollmentError = "";
+            }
+            catch (error) {
+                const errorMessage = error instanceof Error
+                    ? error.message
+                    : typeof error === "object" && error !== null
+                        ? JSON.stringify(error)
+                        : String(error);
+                if (errorMessage.includes("already enrolled") ||
+                    errorMessage.includes("MFA already") ||
+                    errorMessage.includes("already enabled")) {
+                    this.isMfaEnrolled = true;
+                    this.mfaEnrollmentCodeSent = false;
+                    this.mfaEnrollmentError = "";
+                    return;
+                }
+                console.error("Failed to initiate MFA enrollment");
+                this.mfaEnrollmentError =
+                    "Failed to send MFA verification code. Please try again.";
+                throw new Error("Failed to send MFA verification code. Please try again.");
+            }
+        }
+        /**
+         * Submits the MFA enrollment verification code.
+         * Completes the MFA enrollment process.
+         *
+         * @param code - SMS verification code
+         * @returns true if MFA was enrolled successfully, false otherwise
+         */
+        async submitMfaEnrollment(code) {
+            if (!this._cdpCore) {
+                throw new Error("CDP SDK not initialized");
+            }
+            if (!code || code.trim().length === 0) {
+                throw new Error("MFA verification code is required");
+            }
+            try {
+                await this._cdpCore.submitMfaEnrollment({
+                    mfaMethod: "sms",
+                    mfaCode: code.trim(),
+                });
+                this.isMfaEnrolled = true;
+                this.mfaEnrollmentCodeSent = false;
+                this.mfaEnrollmentError = "";
+                return true;
+            }
+            catch {
+                console.error("MFA enrollment verification failed");
+                this.mfaEnrollmentError =
+                    "Invalid or expired verification code. Please try again.";
+                throw new Error("Invalid or expired verification code. Please try again.");
+            }
+        }
+        /**
+         * Ensures a smart account exists for the current user.
+         * Creates one if it doesn't exist. Smart accounts are required for gas sponsorship.
+         * @returns The smart account address or undefined if creation failed
+         */
+        async ensureSmartAccount() {
+            if (!this._cdpCore)
+                return undefined;
+            try {
+                const smartAccountAddress = await this._cdpCore.createEvmSmartAccount();
+                if (smartAccountAddress) {
+                    return smartAccountAddress;
+                }
+                return undefined;
+            }
+            catch {
+                console.error("Failed to create smart account");
+                return undefined;
+            }
+        }
+        /**
+         * Cleans up Coinbase resources.
+         * Safe to call multiple times.
+         */
+        cleanupCoinbase() {
+            // Unregister MFA listener before cleanup
+            if (this._mfaListenerUnsubscribe) {
+                this._mfaListenerUnsubscribe();
+                this._mfaListenerUnsubscribe = null;
+            }
+            this._cdpCore = null;
+            this._publicClient = null;
+            this._flowId = null;
+            this._isInitialized = false;
+            this._initPromise = null;
+            this.coinbaseSession = undefined;
+            this.codeSent = false;
+            this.isMfaEnrolled = false;
+            this.mfaEnrollmentCodeSent = false;
+            this.mfaEnrollmentError = "";
+            this._mfaEnrollmentPhone = "";
+            this.mfaVerificationRequired = false;
+            this.mfaVerificationError = "";
+            this._mfaInProgress = false;
+        }
+        /**
+         * Sends a verification code to the specified email address.
+         * Uses CDP's email OTP authentication.
+         *
+         * @param email - Email address to send the code to
+         * @throws {Error} If email is invalid or SDK is not initialized
+         */
+        async sendCode(email) {
+            if (!this._cdpCore) {
+                throw new Error("CDP SDK not initialized");
+            }
+            const sanitizedEmail = this.sanitizeEmail(email);
+            if (!this.validateEmail(sanitizedEmail)) {
+                throw new Error("Invalid email address format");
+            }
+            try {
+                const result = await this._cdpCore.signInWithEmail({
+                    email: sanitizedEmail,
+                });
+                this._flowId = result.flowId;
+                this.codeSent = true;
+            }
+            catch {
+                console.error("Failed to send verification code");
+                throw new Error("Failed to send verification code. Please try again.");
+            }
+        }
+        /**
+         * Authenticates user with email and verification code.
+         *
+         * @param email - User's email address
+         * @param code - Verification code received via email
+         * @returns Authentication session or undefined if login fails
+         */
+        async loginWithCode(email, code) {
+            if (!this._cdpCore) {
+                throw new Error("CDP SDK not initialized");
+            }
+            if (!this._flowId) {
+                throw new Error("No pending verification. Please request a new code.");
+            }
+            const sanitizedEmail = this.sanitizeEmail(email);
+            if (!this.validateEmail(sanitizedEmail)) {
+                throw new Error("Invalid email address format");
+            }
+            if (!code || code.trim().length === 0) {
+                throw new Error("Verification code is required");
+            }
+            let result;
+            try {
+                result = await this._cdpCore.verifyEmailOTP({
+                    flowId: this._flowId,
+                    otp: code.trim(),
+                });
+            }
+            catch {
+                console.error("Login failed");
+                throw new Error("Invalid or expired verification code");
+            }
+            if (result.user) {
+                const address = this.extractAccountAddress(result.user);
+                if (!address) {
+                    throw new Error("No wallet address returned from authentication");
+                }
+                let smartAccountAddress = this.extractSmartAccountAddress(result.user);
+                if (!smartAccountAddress) {
+                    smartAccountAddress = await this.ensureSmartAccount();
+                }
+                this.coinbaseSession = {
+                    address,
+                    smartAccountAddress,
+                    email: sanitizedEmail,
+                    userId: result.user.userId,
+                    isConnected: true,
+                };
+                // Persist email for session restore (CDP SDK doesn't return it)
+                try {
+                    localStorage.setItem(COINBASE_EMAIL_KEY, sanitizedEmail);
+                }
+                catch {
+                    // localStorage may be blocked (e.g. private browsing)
+                }
+                this.codeSent = false;
+                this._flowId = null;
+                await this.checkMfaEnrolled();
+                return this.coinbaseSession;
+            }
+            throw new Error("No wallet address returned from authentication");
+        }
+        /**
+         * Retrieves the current authenticated user/session.
+         *
+         * @returns Session object or undefined if not authenticated
+         */
+        async getUser() {
+            if (!this._cdpCore) {
+                console.warn("CDP SDK not initialized");
+                return undefined;
+            }
+            try {
+                const user = await this._cdpCore.getCurrentUser();
+                if (user) {
+                    const address = this.extractAccountAddress(user);
+                    if (address && !this.coinbaseSession) {
+                        this.coinbaseSession = {
+                            address,
+                            userId: user.userId,
+                            isConnected: true,
+                        };
+                    }
+                    return this.coinbaseSession;
+                }
+                return undefined;
+            }
+            catch {
+                console.warn("Failed to fetch user");
+                return undefined;
+            }
+        }
+        /**
+         * Retrieves the user's wallet.
+         *
+         * @returns Wallet object or null if not available
+         */
+        /**
+         * Fetches the FIDA token balance for an address.
+         *
+         * @param address - Ethereum address to query
+         * @returns Token balance in smallest unit (wei) or null if query fails
+         */
+        async getTokenBalance(address) {
+            if (!this._publicClient) {
+                console.warn("Public client not initialized");
+                return null;
+            }
+            if (!address || !isAddress(address)) {
+                console.error("Invalid Ethereum address format");
+                return null;
+            }
+            try {
+                const balance = await this._publicClient.readContract({
+                    address: this.tokenContractAddress,
+                    abi: ERC20_ABI,
+                    functionName: "balanceOf",
+                    args: [address],
+                });
+                return balance;
+            }
+            catch {
+                console.error("Failed to fetch token balance");
+                return null;
+            }
+        }
+        /**
+         * Formats token balance for display (converts from wei to human-readable).
+         */
+        formatTokenBalance(balance) {
+            return formatUnits(balance, TOKEN_DECIMALS);
+        }
+        /**
+         * Initiates a token transfer using Smart Account with gas sponsorship.
+         * The user will be prompted by CDP to confirm the transaction via SMS OTP.
+         * Gas fees are sponsored by the CDP paymaster on Base Sepolia.
+         *
+         * @param amount - Amount of tokens to transfer (in human-readable format, e.g., "100")
+         * @returns Transfer result with transaction hash or error
+         */
+        async transferTokens(amount) {
+            // Prevent concurrent transfers (double-click safety)
+            if (this.isTransferPending) {
+                return {
+                    success: false,
+                    error: "Transfer already in progress",
+                };
+            }
+            if (!this._cdpCore) {
+                return {
+                    success: false,
+                    error: "CDP SDK not initialized",
+                };
+            }
+            if (!this._publicClient) {
+                return {
+                    success: false,
+                    error: "Public client not initialized",
+                };
+            }
+            if (!this.coinbaseSession?.address) {
+                return {
+                    success: false,
+                    error: "User not authenticated",
+                };
+            }
+            // Runtime guard — misconfigured zero-address would irreversibly burn tokens
+            try {
+                assertNonZeroAddress(this.recipientAddress, "Recipient address");
+                assertNonZeroAddress(this.tokenContractAddress, "Token contract address");
+            }
+            catch (e) {
+                return {
+                    success: false,
+                    error: e instanceof Error ? e.message : "Invalid address configuration",
+                };
+            }
+            const numericAmount = parseFloat(amount);
+            if (!amount || isNaN(numericAmount) || numericAmount <= 0) {
+                return {
+                    success: false,
+                    error: "Invalid transfer amount",
+                };
+            }
+            if (numericAmount > MAX_TRANSFER_AMOUNT) {
+                return {
+                    success: false,
+                    error: `Amount exceeds maximum of ${MAX_TRANSFER_AMOUNT}`,
+                };
+            }
+            // Gas sponsorship requires ERC-4337 smart accounts, not plain EOAs
+            if (!this.coinbaseSession.smartAccountAddress) {
+                const smartAccountAddress = await this.ensureSmartAccount();
+                if (smartAccountAddress) {
+                    this.coinbaseSession = {
+                        ...this.coinbaseSession,
+                        smartAccountAddress,
+                    };
+                }
+                else {
+                    return {
+                        success: false,
+                        error: "Smart account required for gas-sponsored transfers. Please try logging in again.",
+                    };
+                }
+            }
+            try {
+                this.isTransferPending = true;
+                this.pendingTransferAmount = amount;
+                const amountInWei = parseUnits(amount, TOKEN_DECIMALS);
+                const data = encodeFunctionData({
+                    abi: ERC20_ABI,
+                    functionName: "transfer",
+                    args: [this.recipientAddress, amountInWei],
+                });
+                const smartAccountBalance = await this.getTokenBalance(this.coinbaseSession.smartAccountAddress);
+                if (smartAccountBalance === null || smartAccountBalance < amountInWei) {
+                    this.isTransferPending = false;
+                    return {
+                        success: false,
+                        error: "Insufficient FIDA token balance",
+                    };
+                }
+                const userOpResult = await this._cdpCore.sendUserOperation({
+                    evmSmartAccount: this.coinbaseSession.smartAccountAddress,
+                    network: this.cryptoNetwork,
+                    calls: [
+                        {
+                            to: this.tokenContractAddress,
+                            data,
+                            value: 0n,
+                        },
+                    ],
+                    useCdpPaymaster: true,
+                });
+                const receipt = await this.pollForUserOperationReceipt(userOpResult.userOperationHash);
+                this.isTransferPending = false;
+                this.pendingTransferAmount = "";
+                if (receipt) {
+                    return {
+                        success: true,
+                        transactionHash: receipt,
+                    };
+                }
+                else {
+                    return {
+                        success: false,
+                        error: "Transaction failed or timed out",
+                    };
+                }
+            }
+            catch (error) {
+                console.error("Transfer failed");
+                const errorMessage = error instanceof Error ? error.message : String(error);
+                this.isTransferPending = false;
+                this.pendingTransferAmount = "";
+                this.mfaVerificationRequired = false;
+                this._mfaInProgress = false;
+                // Handle user rejection
+                if (errorMessage.includes("rejected") ||
+                    errorMessage.includes("denied") ||
+                    errorMessage.includes("cancelled")) {
+                    return {
+                        success: false,
+                        error: "Transaction was cancelled by user",
+                    };
+                }
+                // Handle MFA rejection (user cancelled MFA verification)
+                if (errorMessage.includes("MFA") ||
+                    errorMessage.includes("mfa") ||
+                    errorMessage.includes("verification")) {
+                    return {
+                        success: false,
+                        error: "MFA verification was cancelled or failed",
+                    };
+                }
+                return {
+                    success: false,
+                    error: error instanceof Error ? error.message : "Unknown transfer error",
+                };
+            }
+        }
+        /**
+         * Polls for user operation status and transaction hash.
+         * Uses CDP Core's getUserOperation method which returns EvmUserOperation.
+         * The operation is complete when status is "complete" and transactionHash is populated.
+         *
+         * @param onStatusUpdate - Optional callback for progress updates
+         */
+        async pollForUserOperationReceipt(userOpHash, onStatusUpdate) {
+            if (!this._cdpCore)
+                return null;
+            if (!this.coinbaseSession?.smartAccountAddress) {
+                console.error("Smart account address not available for polling");
+                return null;
+            }
+            const maxAttempts = 60; // 120 seconds with 2s interval
+            const interval = 2000;
+            for (let attempt = 0; attempt < maxAttempts; attempt++) {
+                try {
+                    const userOp = await this._cdpCore.getUserOperation({
+                        userOperationHash: userOpHash,
+                        evmSmartAccount: this.coinbaseSession.smartAccountAddress,
+                        network: this.cryptoNetwork,
+                    });
+                    if (onStatusUpdate && userOp?.status) {
+                        onStatusUpdate(userOp.status, attempt, maxAttempts);
+                    }
+                    if (userOp?.status === "complete" && userOp?.transactionHash) {
+                        return userOp.transactionHash;
+                    }
+                    if (userOp?.status === "failed" || userOp?.status === "dropped") {
+                        console.error("User operation failed with status:", userOp?.status);
+                        return null;
+                    }
+                }
+                catch {
+                    // Receipt polling is best-effort; timeout handles the failure path
+                }
+                await new Promise((resolve) => setTimeout(resolve, interval));
+            }
+            console.error("Polling timeout after 120 seconds");
+            return null;
+        }
+        /**
+         * Handles MFA listener being triggered by CDP SDK during sendUserOperation.
+         * This is called automatically when MFA is required for a transaction.
+         */
+        async handleMfaListenerTriggered(context) {
+            // CDP may fire the MFA listener more than once per operation; guard against re-entrancy
+            if (this._mfaInProgress) {
+                return;
+            }
+            this._mfaInProgress = true;
+            const hasSms = context.methods.includes("sms");
+            if (!hasSms) {
+                console.error("SMS MFA not available");
+                this._mfaInProgress = false;
+                this.mfaVerificationError = "SMS verification not available.";
+                this.mfaVerificationRequired = true;
+                this.requestUpdate();
+                return;
+            }
+            if (!this._cdpCore)
+                return;
+            try {
+                await this._cdpCore.initiateMfaVerification({
+                    mfaMethod: "sms",
+                });
+                this.mfaVerificationRequired = true;
+                this.mfaVerificationError = "";
+                this.requestUpdate();
+            }
+            catch {
+                console.error("Failed to initiate MFA verification");
+                this.mfaVerificationError =
+                    "Failed to send verification code. Please try again.";
+                this._mfaInProgress = false;
+                // Show MFA input even on error so the user can retry
+                this.mfaVerificationRequired = true;
+                this.requestUpdate();
+            }
+        }
+        /**
+         * Initiates MFA verification for a pending transaction.
+         * This sends an SMS OTP to the user's enrolled phone number.
+         * Note: With the listener pattern, this is usually called automatically.
+         *
+         * @throws {Error} If MFA initiation fails
+         */
+        async initiateMfaVerification() {
+            if (!this._cdpCore) {
+                throw new Error("CDP SDK not initialized");
+            }
+            if (!this.isMfaEnrolled) {
+                throw new Error("MFA is not enrolled. Please complete MFA enrollment first.");
+            }
+            try {
+                await this._cdpCore.initiateMfaVerification({
+                    mfaMethod: "sms",
+                });
+                this.mfaVerificationError = "";
+            }
+            catch {
+                console.error("Failed to initiate MFA verification");
+                this.mfaVerificationError =
+                    "Failed to send verification code. Please try again.";
+                throw new Error("Failed to send verification code. Please try again.");
+            }
+        }
+        /**
+         * Submits the MFA verification code for a pending transaction.
+         * This verifies the code and resolves the pending MFA challenge,
+         * allowing the original sendUserOperation to continue.
+         *
+         * @param code - SMS verification code
+         * @returns true if verification succeeded
+         * @throws {Error} If verification fails
+         */
+        async submitMfaVerification(code) {
+            if (!this._cdpCore) {
+                throw new Error("CDP SDK not initialized");
+            }
+            if (!code || code.trim().length === 0) {
+                throw new Error("Verification code is required");
+            }
+            try {
+                await this._cdpCore.submitMfaVerification({
+                    mfaMethod: "sms",
+                    mfaCode: code.trim(),
+                });
+                this.mfaVerificationError = "";
+                this.mfaVerificationRequired = false;
+                this._mfaInProgress = false;
+                return true;
+            }
+            catch {
+                console.error("MFA verification failed");
+                this.mfaVerificationError =
+                    "Invalid or expired code. Please try again.";
+                // Don't reset _mfaInProgress here - user might retry with correct code
+                throw new Error("Invalid or expired verification code. Please try again.");
+            }
+        }
+        /**
+         * Resets MFA verification state.
+         * Call this when cancelling or completing the MFA flow.
+         */
+        resetMfaVerificationState() {
+            this.mfaVerificationRequired = false;
+            this.mfaVerificationError = "";
+            this.isTransferPending = false;
+            this.pendingTransferAmount = "";
+            this._mfaInProgress = false;
+        }
+        /**
+         * Retrieves the Coinbase access token (JWT) for authenticated API calls.
+         * The token is managed by the CDP SDK's AuthManager and refreshed automatically.
+         *
+         * @returns The access token string or null if not authenticated
+         */
+        async getCoinbaseAccessToken() {
+            if (!this._cdpCore) {
+                console.warn("CDP SDK not initialized");
+                return null;
+            }
+            try {
+                return await this._cdpCore.getAccessToken();
+            }
+            catch {
+                console.error("Failed to retrieve Coinbase access token");
+                return null;
+            }
+        }
+        disconnectedCallback() {
+            // Clean up local state so initCoinbase() can re-initialize on reconnect.
+            // Don't sign out — session persists in CDP SDK storage.
+            if (this._mfaListenerUnsubscribe) {
+                this._mfaListenerUnsubscribe();
+                this._mfaListenerUnsubscribe = null;
+            }
+            this._publicClient = null;
+            this._isInitialized = false;
+            this._initPromise = null;
+            this._flowId = null;
+            super.disconnectedCallback?.();
+        }
+    }
+    __decorate([
+        state()
+    ], CoinbaseMixinClass.prototype, "coinbaseSession", void 0);
+    __decorate([
+        state()
+    ], CoinbaseMixinClass.prototype, "codeSent", void 0);
+    __decorate([
+        state()
+    ], CoinbaseMixinClass.prototype, "walletEmail", void 0);
+    __decorate([
+        state()
+    ], CoinbaseMixinClass.prototype, "walletEmailError", void 0);
+    __decorate([
+        state()
+    ], CoinbaseMixinClass.prototype, "isTransferPending", void 0);
+    __decorate([
+        state()
+    ], CoinbaseMixinClass.prototype, "pendingTransferAmount", void 0);
+    __decorate([
+        state()
+    ], CoinbaseMixinClass.prototype, "isMfaEnrolled", void 0);
+    __decorate([
+        state()
+    ], CoinbaseMixinClass.prototype, "mfaEnrollmentCodeSent", void 0);
+    __decorate([
+        state()
+    ], CoinbaseMixinClass.prototype, "mfaEnrollmentError", void 0);
+    __decorate([
+        state()
+    ], CoinbaseMixinClass.prototype, "mfaVerificationRequired", void 0);
+    __decorate([
+        state()
+    ], CoinbaseMixinClass.prototype, "mfaVerificationError", void 0);
+    __decorate([
+        state()
+    ], CoinbaseMixinClass.prototype, "cdpProjectId", void 0);
+    __decorate([
+        state()
+    ], CoinbaseMixinClass.prototype, "cryptoRpc", void 0);
+    __decorate([
+        state()
+    ], CoinbaseMixinClass.prototype, "cryptoNetwork", void 0);
+    __decorate([
+        state()
+    ], CoinbaseMixinClass.prototype, "tokenContractAddress", void 0);
+    __decorate([
+        state()
+    ], CoinbaseMixinClass.prototype, "recipientAddress", void 0);
+    return CoinbaseMixinClass;
+};