@embarkai/ui-kit 0.4.57 → 0.4.59

package/dist/iframe/index.html

@@ -15,7 +15,7 @@
     <meta http-equiv="X-Content-Type-Options" content="nosniff" />
     <meta http-equiv="Referrer-Policy" content="strict-origin-when-cross-origin" />
 
-    <title>EmbarkAI Secure Wallet - iframe version 0.4.57</title>
+    <title>EmbarkAI Secure Wallet - iframe version 0.4.59</title>
 
     <!-- Styles will be injected by build process -->
     <style>

package/dist/iframe/main.js

@@ -480,35 +480,26 @@ __export(server_backup_exports, {
   backupToServer: () => backupToServer,
   restoreFromServer: () => restoreFromServer
 });
-async function getShareVaultToken(scopes, accessToken) {
-  const headers = {
-    "Content-Type": "application/json"
-  };
-  if (accessToken) {
-    headers["Authorization"] = `Bearer ${accessToken}`;
-  }
-  const response = await fetch(`${TSS_URL}/api/auth/token/exchange`, {
-    method: "POST",
-    headers,
-    credentials: "include",
-    body: JSON.stringify({
+async function getShareVaultToken(tokenClient, scopes, accessToken) {
+  const data = await tokenClient.apiCall(
+    "POST",
+    "/api/auth/token/exchange",
+    {
       scopes,
       audience: "lumia-passport-share-vault-service",
       // TODO: embarkai audience ?
       ttl: 300
-    })
-  });
-  if (!response.ok) {
-    throw new Error(`Failed to get Share Vault token: ${response.status}`);
-  }
-  const data = await response.json();
+    },
+    void 0,
+    accessToken
+  );
   if (!data?.resourceToken) {
     throw new Error("Invalid token response");
   }
   return data.resourceToken;
 }
-async function uploadShareToVault(encryptedShare, accessToken) {
-  const token = await getShareVaultToken(["share:put"], accessToken);
+async function uploadShareToVault(tokenClient, encryptedShare, accessToken) {
+  const token = await getShareVaultToken(tokenClient, ["share:put"], accessToken);
   const idempotencyKey = crypto.randomUUID ? crypto.randomUUID() : `backup-${Date.now()}`;
   const response = await fetch(`${SHARE_VAULT_URL}/v1/shares/me`, {
     method: "PUT",
@@ -531,10 +522,10 @@ async function backupToServer(data, tokenClient, password, accessToken) {
   } else {
     encryptedShare = await envelopeEncryptKeyshare(data, data.userId);
   }
-  await uploadShareToVault(encryptedShare, accessToken);
+  await uploadShareToVault(tokenClient, encryptedShare, accessToken);
 }
-async function downloadShareFromVault(accessToken) {
-  const token = await getShareVaultToken(["share:get"], accessToken);
+async function downloadShareFromVault(tokenClient, accessToken) {
+  const token = await getShareVaultToken(tokenClient, ["share:get"], accessToken);
   const response = await fetch(`${SHARE_VAULT_URL}/v1/shares/me`, {
     method: "GET",
     headers: {
@@ -560,7 +551,7 @@ async function restoreFromServer(userId, tokenClient, password, accessToken) {
   console.log("[iframe][restoreFromServer] Starting restore for userId:", userId);
   console.log("[iframe][restoreFromServer] Using password:", !!password);
   console.log("[iframe][restoreFromServer] Downloading share from vault...");
-  const envelope = await downloadShareFromVault(accessToken);
+  const envelope = await downloadShareFromVault(tokenClient, accessToken);
   console.log("[iframe][restoreFromServer] Envelope encryption method:", envelope.encryptionMethod);
   const { envelopeDecryptKeyshare: envelopeDecryptKeyshare2, envelopeDecryptKeyshareWithPassword: envelopeDecryptKeyshareWithPassword2 } = await Promise.resolve().then(() => (init_crypto_utils(), crypto_utils_exports));
   const backupData = password ? await envelopeDecryptKeyshareWithPassword2(envelope, password) : await envelopeDecryptKeyshare2(envelope, userId);
@@ -570,12 +561,11 @@ async function restoreFromServer(userId, tokenClient, password, accessToken) {
   console.log("[iframe][restoreFromServer] Decryption successful, returning backup data");
   return backupData;
 }
-var SHARE_VAULT_URL, TSS_URL;
+var SHARE_VAULT_URL;
 var init_server_backup = __esm({
   "src/iframe/lib/backup/server-backup.ts"() {
     init_crypto_utils();
     SHARE_VAULT_URL = "https://api.embarkai.io/vault";
-    TSS_URL = "https://api.embarkai.io/tss";
   }
 });
 
@@ -2075,6 +2065,39 @@ function getCloudProviders() {
 init_local_backup();
 init_server_backup();
 
+// src/lib/errors.ts
+var AccountAbstractionError = class _AccountAbstractionError extends Error {
+  constructor(message, code) {
+    super(message);
+    this.code = code;
+    this.name = "LumiaPassportError";
+    if (Error.captureStackTrace) {
+      Error.captureStackTrace(this, _AccountAbstractionError);
+    }
+  }
+};
+var _UserRejectedError = class _UserRejectedError extends AccountAbstractionError {
+  constructor(message = "User rejected transaction") {
+    super(message, _UserRejectedError.CODE);
+    this.name = "UserRejectedError";
+  }
+};
+_UserRejectedError.CODE = "USER_REJECTED";
+var UserRejectedError = _UserRejectedError;
+var _SessionExpiredError = class _SessionExpiredError extends AccountAbstractionError {
+  constructor(message = "Session expired, please log in again") {
+    super(message, _SessionExpiredError.CODE);
+    this.name = "SessionExpiredError";
+  }
+};
+_SessionExpiredError.CODE = "SESSION_EXPIRED";
+var SessionExpiredError = _SessionExpiredError;
+var ErrorCodes = {
+  MPC_SIGNING_ERROR: "MPC_SIGNING_ERROR",
+  USER_REJECTED: UserRejectedError.CODE,
+  SESSION_EXPIRED: SessionExpiredError.CODE
+};
+
 // src/iframe/lib/token-refresh-client.ts
 var TokenRefreshApiClient = class {
   constructor() {
@@ -2105,32 +2128,48 @@ var TokenRefreshApiClient = class {
         // Send cookies
       });
       if (response.status === 401 && accessToken) {
-        console.log("[iframe][TokenRefresh] Got 401, checking if TOKEN_EXPIRED...");
+        console.log("[iframe][TokenRefresh] Got 401, inspecting error body...");
+        let errorData = null;
+        let parseFailed = false;
         try {
-          const errorData = await response.json();
-          if (errorData.error_code === "TOKEN_EXPIRED" || errorData.action === "REFRESH_TOKEN") {
-            console.log("[iframe][TokenRefresh] TOKEN_EXPIRED detected, requesting new token from parent...");
-            const newToken = await this.requestNewTokenFromParent();
-            if (newToken) {
-              console.log("[iframe][TokenRefresh] \u2705 Got new token, retrying request...");
-              headers["Authorization"] = `Bearer ${newToken}`;
-              const retryResponse = await fetch(url, {
-                method,
-                headers,
-                body: body ? JSON.stringify(body) : void 0,
-                credentials: "include"
-              });
-              if (!retryResponse.ok) {
-                const retryErrorText = await retryResponse.text();
-                throw new Error(`API call failed after token refresh (${retryResponse.status}): ${retryErrorText}`);
-              }
-              return await retryResponse.json();
-            } else {
-              throw new Error("Failed to refresh access token");
+          errorData = await response.json();
+        } catch (parseError) {
+          console.error("[iframe][TokenRefresh] Failed to parse 401 response, will attempt refresh:", parseError);
+          parseFailed = true;
+        }
+        if (errorData && (errorData.error_code === "SESSION_NOT_FOUND" || errorData.action === "REAUTHENTICATE")) {
+          console.error("[iframe][TokenRefresh] \u274C Session expired, re-authentication required");
+          throw new SessionExpiredError();
+        }
+        if (parseFailed || errorData && (errorData.error_code === "TOKEN_EXPIRED" || errorData.action === "REFRESH_TOKEN")) {
+          console.log("[iframe][TokenRefresh] TOKEN_EXPIRED detected, requesting new token from parent...");
+          const refresh = await this.requestNewTokenFromParent();
+          if (!refresh.token) {
+            if (refresh.sessionDead === false) {
+              console.error("[iframe][TokenRefresh] Token refresh temporarily unavailable");
+              throw new Error("Token refresh temporarily unavailable, please retry");
             }
+            console.error("[iframe][TokenRefresh] \u274C Token refresh failed, re-authentication required");
+            throw new SessionExpiredError();
           }
-        } catch (parseError) {
-          console.error("[iframe][TokenRefresh] Failed to parse 401 response:", parseError);
+          const newToken = refresh.token;
+          console.log("[iframe][TokenRefresh] \u2705 Got new token, retrying request...");
+          headers["Authorization"] = `Bearer ${newToken}`;
+          const retryResponse = await fetch(url, {
+            method,
+            headers,
+            body: body ? JSON.stringify(body) : void 0,
+            credentials: "include"
+          });
+          if (retryResponse.status === 401) {
+            console.error("[iframe][TokenRefresh] \u274C Still 401 after token refresh, re-authentication required");
+            throw new SessionExpiredError();
+          }
+          if (!retryResponse.ok) {
+            const retryErrorText = await retryResponse.text();
+            throw new Error(`API call failed after token refresh (${retryResponse.status}): ${retryErrorText}`);
+          }
+          return await retryResponse.json();
         }
         throw new Error(`API call failed (401): Authentication required`);
       }
@@ -2152,11 +2191,11 @@ var TokenRefreshApiClient = class {
       console.log("[iframe][TokenRefresh] Token refresh already in progress, waiting...");
       return this.pendingTokenRefresh;
     }
-    this.pendingTokenRefresh = new Promise((resolve, reject) => {
+    this.pendingTokenRefresh = new Promise((resolve) => {
       const messageId = `token_refresh_${Date.now()}_${Math.random().toString(36).substring(2, 15)}`;
       const timeout = setTimeout(() => {
         cleanup();
-        reject(new Error("Token refresh timeout"));
+        resolve({ token: null, sessionDead: false });
       }, 3e4);
       const messageHandler = (event) => {
         const message = event.data;
@@ -2165,12 +2204,10 @@ var TokenRefreshApiClient = class {
           cleanup();
           if (message.accessToken) {
             console.log("[iframe][TokenRefresh] \u2705 Received new token from parent");
-            resolve(message.accessToken);
-          } else if (message.error) {
-            console.error("[iframe][TokenRefresh] \u274C Token refresh failed:", message.error);
-            reject(new Error(message.error));
+            resolve({ token: message.accessToken });
           } else {
-            reject(new Error("Invalid token refresh response"));
+            console.error("[iframe][TokenRefresh] \u274C Token refresh failed:", message.error);
+            resolve({ token: null, sessionDead: message.sessionDead !== false });
           }
         }
       };
@@ -2193,16 +2230,10 @@ var TokenRefreshApiClient = class {
         console.log("[iframe][TokenRefresh] \u{1F4E4} Sent IFRAME_MSG_REQUEST_NEW_TOKEN to parent");
       } else {
         cleanup();
-        reject(new Error("No parent window available"));
+        resolve({ token: null, sessionDead: false });
       }
     });
-    try {
-      return await this.pendingTokenRefresh;
-    } catch (error) {
-      this.pendingTokenRefresh = null;
-      console.error("[iframe][TokenRefresh] Token refresh failed:", error);
-      return null;
-    }
+    return this.pendingTokenRefresh;
   }
 };
 
@@ -5405,30 +5436,6 @@ var SdkChannelManager = class {
   }
 };
 
-// src/lib/errors.ts
-var AccountAbstractionError = class _AccountAbstractionError extends Error {
-  constructor(message, code) {
-    super(message);
-    this.code = code;
-    this.name = "LumiaPassportError";
-    if (Error.captureStackTrace) {
-      Error.captureStackTrace(this, _AccountAbstractionError);
-    }
-  }
-};
-var _UserRejectedError = class _UserRejectedError extends AccountAbstractionError {
-  constructor(message = "User rejected transaction") {
-    super(message, _UserRejectedError.CODE);
-    this.name = "UserRejectedError";
-  }
-};
-_UserRejectedError.CODE = "USER_REJECTED";
-var UserRejectedError = _UserRejectedError;
-var ErrorCodes = {
-  MPC_SIGNING_ERROR: "MPC_SIGNING_ERROR",
-  USER_REJECTED: UserRejectedError.CODE
-};
-
 // src/iframe/lib/secure-messenger.ts
 var SecureMessenger = class {
   constructor() {
@@ -6391,7 +6398,7 @@ var SigningManager = class extends TokenRefreshApiClient {
 };
 
 // src/iframe/main.ts
-var IFRAME_VERSION = "0.4.57";
+var IFRAME_VERSION = "0.4.59";
 var IframeWallet = class {
   constructor() {
     console.log("=".repeat(60));