@phantom/embedded-provider-core 1.0.0-beta.8 → 1.0.0

package/dist/index.mjs

@@ -1,139 +1,25 @@
 // src/embedded-provider.ts
-import { AddressType, PhantomClient } from "@phantom/client";
-import { randomUUID } from "@phantom/utils";
-import { base64urlEncode } from "@phantom/base64url";
-import bs582 from "bs58";
+import { base64urlEncode, stringToBase64url } from "@phantom/base64url";
+import { AddressType, PhantomClient, SpendingLimitError } from "@phantom/client";
 import {
-  parseMessage,
-  parseTransactionToBase64Url,
   parseSignMessageResponse,
-  parseTransactionResponse
+  parseTransactionResponse,
+  parseToKmsTransaction
 } from "@phantom/parsers";
+import { randomUUID } from "@phantom/utils";
+import { Buffer } from "buffer";
+import bs582 from "bs58";
 
 // src/constants.ts
 var AUTHENTICATOR_EXPIRATION_TIME_MS = 7 * 24 * 60 * 60 * 1e3;
 var AUTHENTICATOR_RENEWAL_WINDOW_MS = 2 * 24 * 60 * 60 * 1e3;
-
-// src/auth/jwt-auth.ts
-var JWTAuth = class {
-  async authenticate(options) {
-    if (!options.jwtToken || typeof options.jwtToken !== "string") {
-      throw new Error("Invalid JWT token: token must be a non-empty string");
-    }
-    const jwtParts = options.jwtToken.split(".");
-    if (jwtParts.length !== 3) {
-      throw new Error("Invalid JWT token format: token must have 3 parts separated by dots");
-    }
-    try {
-      const response = await fetch("/api/auth/jwt", {
-        method: "POST",
-        headers: {
-          "Content-Type": "application/json",
-          Authorization: `Bearer ${options.jwtToken}`,
-          "X-PHANTOM-APPID": options.appId
-        },
-        body: JSON.stringify({
-          appId: options.appId,
-          customAuthData: options.customAuthData
-        })
-      });
-      if (!response.ok) {
-        let errorMessage = `HTTP ${response.status}`;
-        try {
-          const errorData = await response.json();
-          errorMessage = errorData.message || errorData.error || errorMessage;
-        } catch {
-          errorMessage = response.statusText || errorMessage;
-        }
-        switch (response.status) {
-          case 400:
-            throw new Error(`Invalid JWT authentication request: ${errorMessage}`);
-          case 401:
-            throw new Error(`JWT token is invalid or expired: ${errorMessage}`);
-          case 403:
-            throw new Error(`JWT authentication forbidden: ${errorMessage}`);
-          case 404:
-            throw new Error(`JWT authentication endpoint not found: ${errorMessage}`);
-          case 429:
-            throw new Error(`Too many JWT authentication requests: ${errorMessage}`);
-          case 500:
-          case 502:
-          case 503:
-          case 504:
-            throw new Error(`JWT authentication server error: ${errorMessage}`);
-          default:
-            throw new Error(`JWT authentication failed: ${errorMessage}`);
-        }
-      }
-      let result;
-      try {
-        result = await response.json();
-      } catch (parseError) {
-        throw new Error("Invalid response from JWT authentication server: response is not valid JSON");
-      }
-      if (!result.walletId) {
-        throw new Error("Invalid JWT authentication response: missing walletId");
-      }
-      return {
-        walletId: result.walletId,
-        provider: "jwt",
-        userInfo: result.userInfo || {}
-      };
-    } catch (error) {
-      if (error instanceof TypeError && error.message.includes("fetch")) {
-        throw new Error("JWT authentication failed: network error or invalid endpoint");
-      }
-      if (error instanceof Error) {
-        throw error;
-      }
-      throw new Error(`JWT authentication error: ${String(error)}`);
-    }
-  }
-};
-
-// src/utils/session.ts
-function generateSessionId() {
-  return "session_" + Math.random().toString(36).substring(2, 15) + Math.random().toString(36).substring(2, 15) + "_" + Date.now();
-}
-
-// src/utils/retry.ts
-async function retryWithBackoff(operation, operationName, logger, maxRetries = 3, baseDelay = 1e3) {
-  let lastError;
-  for (let attempt = 1; attempt <= maxRetries; attempt++) {
-    try {
-      logger.log("EMBEDDED_PROVIDER", `Attempting ${operationName}`, {
-        attempt,
-        maxRetries
-      });
-      return await operation();
-    } catch (error) {
-      lastError = error;
-      logger.warn("EMBEDDED_PROVIDER", `${operationName} failed`, {
-        attempt,
-        maxRetries,
-        error: error instanceof Error ? error.message : String(error)
-      });
-      if (attempt === maxRetries) {
-        logger.error("EMBEDDED_PROVIDER", `${operationName} failed after ${maxRetries} attempts`, {
-          finalError: error instanceof Error ? error.message : String(error)
-        });
-        break;
-      }
-      const delay = baseDelay * Math.pow(2, attempt - 1);
-      logger.log("EMBEDDED_PROVIDER", `Retrying ${operationName} in ${delay}ms`, {
-        attempt: attempt + 1,
-        delay
-      });
-      await new Promise((resolve) => setTimeout(resolve, delay));
-    }
-  }
-  throw lastError;
-}
+var EMBEDDED_PROVIDER_AUTH_TYPES = ["google", "apple", "phantom"];
 
 // src/chains/SolanaChain.ts
 import { EventEmitter } from "eventemitter3";
 import { NetworkId } from "@phantom/constants";
 import bs58 from "bs58";
+import { parseSolanaSignedTransaction } from "@phantom/parsers";
 var EmbeddedSolanaChain = class {
   constructor(provider) {
     this.provider = provider;
@@ -170,8 +56,17 @@ var EmbeddedSolanaChain = class {
       publicKey: this._publicKey || ""
     };
   }
-  signTransaction(_transaction) {
-    return Promise.reject(new Error("signTransaction is not supported in embedded provider. Use signAndSendTransaction instead."));
+  async signTransaction(transaction) {
+    this.ensureConnected();
+    const result = await this.provider.signTransaction({
+      transaction,
+      networkId: this.currentNetworkId
+    });
+    const signedTransaction = parseSolanaSignedTransaction(result.rawTransaction);
+    if (!signedTransaction) {
+      throw new Error("Failed to parse signed transaction");
+    }
+    return signedTransaction;
   }
   async signAndSendTransaction(transaction) {
     this.ensureConnected();
@@ -184,8 +79,10 @@ var EmbeddedSolanaChain = class {
     }
     return { signature: result.hash };
   }
-  signAllTransactions(_transactions) {
-    return Promise.reject(new Error("signAllTransactions is not supported in embedded provider. Use signAndSendAllTransactions instead."));
+  async signAllTransactions(transactions) {
+    this.ensureConnected();
+    const results = await Promise.all(transactions.map((tx) => this.signTransaction(tx)));
+    return results;
   }
   async signAndSendAllTransactions(transactions) {
     const results = await Promise.all(transactions.map((tx) => this.signAndSendTransaction(tx)));
@@ -255,10 +152,8 @@ var EmbeddedSolanaChain = class {
 };
 
 // src/chains/EthereumChain.ts
-import { EventEmitter as EventEmitter2 } from "eventemitter3";
 import { NetworkId as NetworkId2, chainIdToNetworkId, networkIdToChainId } from "@phantom/constants";
-import { base64urlDecode } from "@phantom/base64url";
-import { Buffer } from "buffer";
+import { EventEmitter as EventEmitter2 } from "eventemitter3";
 var EmbeddedEthereumChain = class {
   constructor(provider) {
     this.provider = provider;
@@ -316,18 +211,25 @@ var EmbeddedEthereumChain = class {
     });
   }
   async signTransaction(transaction) {
+    let networkId = this.currentNetworkId;
+    if (transaction.chainId) {
+      const numericChainId = typeof transaction.chainId === "number" ? transaction.chainId : parseInt(transaction.chainId, 16);
+      const txNetworkId = chainIdToNetworkId(numericChainId);
+      if (txNetworkId) {
+        networkId = txNetworkId;
+      }
+    }
     const result = await this.provider.signTransaction({
       transaction,
-      networkId: this.currentNetworkId
+      networkId
     });
-    try {
-      const signatureBytes = base64urlDecode(result.rawTransaction);
-      return "0x" + Buffer.from(signatureBytes).toString("hex");
-    } catch (error) {
-      return result.rawTransaction.startsWith("0x") ? result.rawTransaction : "0x" + result.rawTransaction;
-    }
+    return result.rawTransaction;
   }
   async sendTransaction(transaction) {
+    if (transaction.chainId) {
+      const numericChainId = typeof transaction.chainId === "number" ? transaction.chainId : parseInt(transaction.chainId, 16);
+      await this.switchChain(numericChainId);
+    }
     const result = await this.provider.signAndSendTransaction({
       transaction,
       networkId: this.currentNetworkId
@@ -338,12 +240,13 @@ var EmbeddedEthereumChain = class {
     return result.hash;
   }
   switchChain(chainId) {
-    const networkId = chainIdToNetworkId(chainId);
+    const numericChainId = typeof chainId === "string" ? chainId.toLowerCase().startsWith("0x") ? parseInt(chainId, 16) : parseInt(chainId, 10) : chainId;
+    const networkId = chainIdToNetworkId(numericChainId);
     if (!networkId) {
       throw new Error(`Unsupported chainId: ${chainId}`);
     }
     this.currentNetworkId = networkId;
-    this.eventEmitter.emit("chainChanged", `0x${chainId.toString(16)}`);
+    this.eventEmitter.emit("chainChanged", `0x${numericChainId.toString(16)}`);
     return Promise.resolve();
   }
   getChainId() {
@@ -388,7 +291,7 @@ var EmbeddedEthereumChain = class {
     switch (args.method) {
       case "personal_sign": {
         const [message, _address] = args.params;
-        const result = await this.provider.signMessage({
+        const result = await this.provider.signEthereumMessage({
           message,
           networkId: this.currentNetworkId
         });
@@ -396,10 +299,9 @@ var EmbeddedEthereumChain = class {
       }
       case "eth_signTypedData_v4": {
         const [_typedDataAddress, typedDataStr] = args.params;
-        const _typedData = JSON.parse(typedDataStr);
-        const typedDataResult = await this.provider.signMessage({
-          message: typedDataStr,
-          // Pass the stringified typed data as message
+        const typedData = JSON.parse(typedDataStr);
+        const typedDataResult = await this.provider.signTypedDataV4({
+          typedData,
           networkId: this.currentNetworkId
         });
         return typedDataResult.signature;
@@ -453,6 +355,45 @@ var EmbeddedEthereumChain = class {
   }
 };
 
+// src/utils/retry.ts
+async function retryWithBackoff(operation, operationName, logger, maxRetries = 3, baseDelay = 1e3) {
+  let lastError;
+  for (let attempt = 1; attempt <= maxRetries; attempt++) {
+    try {
+      logger.log("EMBEDDED_PROVIDER", `Attempting ${operationName}`, {
+        attempt,
+        maxRetries
+      });
+      return await operation();
+    } catch (error) {
+      lastError = error;
+      logger.warn("EMBEDDED_PROVIDER", `${operationName} failed`, {
+        attempt,
+        maxRetries,
+        error: error instanceof Error ? error.message : String(error)
+      });
+      if (attempt === maxRetries) {
+        logger.error("EMBEDDED_PROVIDER", `${operationName} failed after ${maxRetries} attempts`, {
+          finalError: error instanceof Error ? error.message : String(error)
+        });
+        break;
+      }
+      const delay = baseDelay * Math.pow(2, attempt - 1);
+      logger.log("EMBEDDED_PROVIDER", `Retrying ${operationName} in ${delay}ms`, {
+        attempt: attempt + 1,
+        delay
+      });
+      await new Promise((resolve) => setTimeout(resolve, delay));
+    }
+  }
+  throw lastError;
+}
+
+// src/utils/session.ts
+function generateSessionId() {
+  return "session_" + Math.random().toString(36).substring(2, 15) + Math.random().toString(36).substring(2, 15) + "_" + Date.now();
+}
+
 // src/embedded-provider.ts
 var EmbeddedProvider = class {
   constructor(config, platform, logger) {
@@ -469,9 +410,9 @@ var EmbeddedProvider = class {
     this.platform = platform;
     this.storage = platform.storage;
     this.authProvider = platform.authProvider;
+    this.phantomAppProvider = platform.phantomAppProvider;
     this.urlParamsAccessor = platform.urlParamsAccessor;
     this.stamper = platform.stamper;
-    this.jwtAuth = new JWTAuth();
     this.solana = new EmbeddedSolanaChain(this);
     this.ethereum = new EmbeddedEthereumChain(this);
     this.logger.info("EMBEDDED_PROVIDER", "EmbeddedProvider initialized");
@@ -588,10 +529,16 @@ var EmbeddedProvider = class {
       }
     }
     if (session.status === "completed" && !this.isSessionValid(session)) {
-      this.logger.warn("EMBEDDED_PROVIDER", "Session invalid due to authenticator expiration", {
-        sessionId: session.sessionId,
-        authenticatorExpiresAt: session.authenticatorExpiresAt
-      });
+      this.logger.warn(
+        "EMBEDDED_PROVIDER",
+        "Session invalid due to authenticator expiration, will regenerate keypair",
+        {
+          sessionId: session.sessionId,
+          authenticatorExpiresAt: session.authenticatorExpiresAt,
+          currentTime: Date.now(),
+          expired: session.authenticatorExpiresAt < Date.now()
+        }
+      );
       await this.storage.clearSession();
       return null;
     }
@@ -606,7 +553,11 @@ var EmbeddedProvider = class {
     this.logger.log("EMBEDDED_PROVIDER", "Getting existing session");
     let session = await this.storage.getSession();
     session = await this.validateAndCleanSession(session);
-    if (session && session.status === "completed") {
+    if (!session) {
+      this.logger.log("EMBEDDED_PROVIDER", "No existing session found");
+      return null;
+    }
+    if (session.status === "completed") {
       this.logger.info("EMBEDDED_PROVIDER", "Using existing completed session", {
         sessionId: session.sessionId,
         walletId: session.walletId
@@ -622,18 +573,19 @@ var EmbeddedProvider = class {
       const result = {
         walletId: this.walletId,
         addresses: this.addresses,
-        status: "completed"
+        status: "completed",
+        authUserId: session.authUserId,
+        authProvider: session.authProvider
       };
       this.emit("connect", {
-        walletId: this.walletId,
-        addresses: this.addresses,
+        ...result,
         source: "existing-session"
       });
       return result;
     }
     this.logger.log("EMBEDDED_PROVIDER", "No completed session found, checking for redirect resume");
     if (this.authProvider.resumeAuthFromRedirect) {
-      const authResult = this.authProvider.resumeAuthFromRedirect();
+      const authResult = this.authProvider.resumeAuthFromRedirect(session.authProvider);
       if (authResult) {
         this.logger.info("EMBEDDED_PROVIDER", "Resuming from redirect", {
           walletId: authResult.walletId,
@@ -665,13 +617,10 @@ var EmbeddedProvider = class {
    * This ensures only supported auth providers are used and required tokens are present.
    */
   validateAuthOptions(authOptions) {
-    if (!authOptions)
-      return;
-    if (authOptions.provider && !["google", "apple", "jwt"].includes(authOptions.provider)) {
-      throw new Error(`Invalid auth provider: ${authOptions.provider}. Must be "google", "apple", or "jwt"`);
-    }
-    if (authOptions.provider === "jwt" && !authOptions.jwtToken) {
-      throw new Error("JWT token is required when using JWT authentication");
+    if (!EMBEDDED_PROVIDER_AUTH_TYPES.includes(authOptions.provider)) {
+      throw new Error(
+        `Invalid auth provider: ${authOptions.provider}. Must be ${EMBEDDED_PROVIDER_AUTH_TYPES.join(", ")}`
+      );
     }
   }
   /*
@@ -731,8 +680,7 @@ var EmbeddedProvider = class {
           addressCount: result.addresses.length
         });
         this.emit("connect", {
-          walletId: result.walletId,
-          addresses: result.addresses,
+          ...result,
           source: "auto-connect"
         });
         return;
@@ -750,40 +698,46 @@ var EmbeddedProvider = class {
         error: error instanceof Error ? error.message : "Auto-connect failed",
         source: "auto-connect"
       });
+      await this.storage.setShouldClearPreviousSession(true);
     }
   }
   /*
    * We use this method to initialize the stamper and create an organization for new sessions.
    * This is the first step when no existing session is found and we need to set up a new wallet.
    */
-  async createOrganizationAndStamper() {
+  async initializeStamper() {
     this.logger.log("EMBEDDED_PROVIDER", "Initializing stamper");
-    const stamperInfo = await this.stamper.init();
-    this.logger.log("EMBEDDED_PROVIDER", "Stamper initialized", {
+    await this.stamper.init();
+    this.logger.log("EMBEDDED_PROVIDER", "Resetting keypair to avoid conflicts with existing keypairs");
+    const stamperInfo = await this.stamper.resetKeyPair();
+    this.logger.log("EMBEDDED_PROVIDER", "Stamper initialized with fresh keypair", {
       publicKey: stamperInfo.publicKey,
       keyId: stamperInfo.keyId,
       algorithm: this.stamper.algorithm
     });
-    this.logger.log("EMBEDDED_PROVIDER", "Creating temporary PhantomClient");
-    const tempClient = new PhantomClient(
-      {
-        apiBaseUrl: this.config.apiBaseUrl,
-        headers: {
-          ...this.platform.analyticsHeaders || {}
-        }
-      },
-      this.stamper
-    );
+    const expiresInMs = AUTHENTICATOR_EXPIRATION_TIME_MS;
+    this.logger.info("EMBEDDED_PROVIDER", "Stamper ready for auth flow with fresh keypair", {
+      publicKey: stamperInfo.publicKey,
+      keyId: stamperInfo.keyId
+    });
+    return { stamperInfo, expiresInMs };
+  }
+  async createOrganizationForAppWallet(stamperInfo, expiresInMs) {
+    const tempClient = new PhantomClient({
+      apiBaseUrl: this.config.apiBaseUrl,
+      headers: {
+        ...this.platform.analyticsHeaders || {}
+      }
+    });
     const platformName = this.platform.name || "unknown";
     const shortPubKey = stamperInfo.publicKey.slice(0, 8);
     const organizationName = `${this.config.appId.substring(0, 8)}-${platformName}-${shortPubKey}`;
-    this.logger.log("EMBEDDED_PROVIDER", "Creating organization", {
+    this.logger.log("EMBEDDED_PROVIDER", "Creating organization for app-wallet", {
       organizationName,
       publicKey: stamperInfo.publicKey,
       platform: platformName
     });
     const base64urlPublicKey = base64urlEncode(bs582.decode(stamperInfo.publicKey));
-    const expiresInMs = AUTHENTICATOR_EXPIRATION_TIME_MS;
     const username = `user-${randomUUID()}`;
     const { organizationId } = await tempClient.createOrganization(organizationName, [
       {
@@ -794,27 +748,25 @@ var EmbeddedProvider = class {
             authenticatorName: `auth-${shortPubKey}`,
             authenticatorKind: "keypair",
             publicKey: base64urlPublicKey,
-            algorithm: "Ed25519"
-            // Commented for now until KMS supports fully expirable organizations
-            // expiresInMs: expiresInMs,
+            algorithm: "Ed25519",
+            expiresInMs
           }
         ]
       }
     ]);
-    this.logger.info("EMBEDDED_PROVIDER", "Organization created", { organizationId });
-    return { organizationId, stamperInfo, expiresInMs, username };
+    this.logger.info("EMBEDDED_PROVIDER", "Organization created for app-wallet", { organizationId });
+    return organizationId;
   }
   async connect(authOptions) {
     try {
       this.logger.info("EMBEDDED_PROVIDER", "Starting embedded provider connect", {
-        authOptions: authOptions ? {
-          provider: authOptions.provider,
-          hasJwtToken: !!authOptions.jwtToken
-        } : void 0
+        authOptions: {
+          provider: authOptions.provider
+        }
       });
       this.emit("connect_start", {
         source: "manual-connect",
-        authOptions: authOptions ? { provider: authOptions.provider } : void 0
+        authOptions: { provider: authOptions.provider }
       });
       const existingResult = await this.tryExistingConnection(false);
       if (existingResult) {
@@ -823,23 +775,26 @@ var EmbeddedProvider = class {
           addressCount: existingResult.addresses.length
         });
         this.emit("connect", {
-          walletId: existingResult.walletId,
-          addresses: existingResult.addresses,
+          ...existingResult,
           source: "manual-existing"
         });
         return existingResult;
       }
       this.validateAuthOptions(authOptions);
-      this.logger.info("EMBEDDED_PROVIDER", "No existing connection, creating new auth flow");
-      const { organizationId, stamperInfo, expiresInMs, username } = await this.createOrganizationAndStamper();
-      const session = await this.handleAuthFlow(organizationId, stamperInfo, authOptions, expiresInMs, username);
+      this.logger.info(
+        "EMBEDDED_PROVIDER",
+        "No existing connection available, creating new auth flow with fresh keypair"
+      );
+      const { stamperInfo, expiresInMs } = await this.initializeStamper();
+      const session = await this.handleAuthFlow(stamperInfo.publicKey, stamperInfo, authOptions, expiresInMs);
       if (!session) {
         return {
           addresses: [],
-          status: "pending"
+          status: "pending",
+          authProvider: authOptions.provider
         };
       }
-      if (!authOptions || authOptions.provider === "jwt" || this.config.embeddedWalletType === "app-wallet") {
+      if (this.config.embeddedWalletType === "app-wallet") {
         session.lastUsed = Date.now();
         await this.storage.saveSession(session);
       }
@@ -848,11 +803,12 @@ var EmbeddedProvider = class {
       const result = {
         walletId: this.walletId,
         addresses: this.addresses,
-        status: "completed"
+        status: "completed",
+        authUserId: session?.authUserId,
+        authProvider: session?.authProvider
       };
       this.emit("connect", {
-        walletId: this.walletId,
-        addresses: this.addresses,
+        ...result,
         source: "manual"
       });
       return result;
@@ -893,8 +849,10 @@ var EmbeddedProvider = class {
       throw new Error(`Embedded wallet connection failed: ${String(error)}`);
     }
   }
-  async disconnect() {
+  async disconnect(shouldClearPreviousSession = true) {
     const wasConnected = this.client !== null;
+    await this.storage.setShouldClearPreviousSession(shouldClearPreviousSession);
+    this.logger.log("EMBEDDED_PROVIDER", "Set flag to clear previous session on next login");
     await this.storage.clearSession();
     this.client = null;
     this.walletId = null;
@@ -915,12 +873,44 @@ var EmbeddedProvider = class {
       walletId: this.walletId,
       message: params.message
     });
-    const parsedMessage = parseMessage(params.message);
     const session = await this.storage.getSession();
     const derivationIndex = session?.accountDerivationIndex ?? 0;
-    const rawResponse = await this.client.signMessage({
+    const rawResponse = await this.client.signUtf8Message({
+      walletId: this.walletId,
+      message: params.message,
+      networkId: params.networkId,
+      derivationIndex
+    });
+    this.logger.info("EMBEDDED_PROVIDER", "Message signed successfully", {
+      walletId: this.walletId,
+      message: params.message
+    });
+    return parseSignMessageResponse(rawResponse, params.networkId);
+  }
+  async signEthereumMessage(params) {
+    if (!this.client || !this.walletId) {
+      throw new Error("Not connected");
+    }
+    await this.ensureValidAuthenticator();
+    this.logger.info("EMBEDDED_PROVIDER", "Signing message", {
+      walletId: this.walletId,
+      message: params.message
+    });
+    const looksLikeHex = (str) => /^0x[0-9a-fA-F]+$/.test(str);
+    const normalizedMessage = (() => {
+      if (looksLikeHex(params.message)) {
+        const hexPayload = params.message.slice(2);
+        const normalizedHex = hexPayload.length % 2 === 0 ? hexPayload : `0${hexPayload}`;
+        return Buffer.from(normalizedHex, "hex").toString("utf8");
+      }
+      return params.message;
+    })();
+    const base64UrlMessage = stringToBase64url(normalizedMessage);
+    const session = await this.storage.getSession();
+    const derivationIndex = session?.accountDerivationIndex ?? 0;
+    const rawResponse = await this.client.ethereumSignMessage({
       walletId: this.walletId,
-      message: parsedMessage.base64url,
+      message: base64UrlMessage,
       networkId: params.networkId,
       derivationIndex
     });
@@ -930,6 +920,28 @@ var EmbeddedProvider = class {
     });
     return parseSignMessageResponse(rawResponse, params.networkId);
   }
+  async signTypedDataV4(params) {
+    if (!this.client || !this.walletId) {
+      throw new Error("Not connected");
+    }
+    await this.ensureValidAuthenticator();
+    this.logger.info("EMBEDDED_PROVIDER", "Signing typed data", {
+      walletId: this.walletId,
+      typedData: params.typedData
+    });
+    const session = await this.storage.getSession();
+    const derivationIndex = session?.accountDerivationIndex ?? 0;
+    const rawResponse = await this.client.ethereumSignTypedData({
+      walletId: this.walletId,
+      typedData: params.typedData,
+      networkId: params.networkId,
+      derivationIndex
+    });
+    this.logger.info("EMBEDDED_PROVIDER", "Typed data signed successfully", {
+      walletId: this.walletId
+    });
+    return parseSignMessageResponse(rawResponse, params.networkId);
+  }
   async signTransaction(params) {
     if (!this.client || !this.walletId) {
       throw new Error("Not connected");
@@ -939,7 +951,7 @@ var EmbeddedProvider = class {
       walletId: this.walletId,
       networkId: params.networkId
     });
-    const parsedTransaction = await parseTransactionToBase64Url(params.transaction, params.networkId);
+    const parsedTransaction = await parseToKmsTransaction(params.transaction, params.networkId);
     const session = await this.storage.getSession();
     const derivationIndex = session?.accountDerivationIndex ?? 0;
     this.logger.log("EMBEDDED_PROVIDER", "Parsed transaction for signing", {
@@ -947,12 +959,20 @@ var EmbeddedProvider = class {
       transaction: parsedTransaction,
       derivationIndex
     });
+    const transactionPayload = parsedTransaction.parsed;
+    if (!transactionPayload) {
+      throw new Error("Failed to parse transaction: no valid encoding found");
+    }
+    const account = this.getAddressForNetwork(params.networkId);
+    if (!account) {
+      throw new Error(`No address found for network ${params.networkId}`);
+    }
     const rawResponse = await this.client.signTransaction({
       walletId: this.walletId,
-      transaction: parsedTransaction.base64url,
+      transaction: transactionPayload,
       networkId: params.networkId,
       derivationIndex,
-      account: this.getAddressForNetwork(params.networkId)
+      account
     });
     this.logger.info("EMBEDDED_PROVIDER", "Transaction signed successfully", {
       walletId: this.walletId,
@@ -970,7 +990,7 @@ var EmbeddedProvider = class {
       walletId: this.walletId,
       networkId: params.networkId
     });
-    const parsedTransaction = await parseTransactionToBase64Url(params.transaction, params.networkId);
+    const parsedTransaction = await parseToKmsTransaction(params.transaction, params.networkId);
     const session = await this.storage.getSession();
     const derivationIndex = session?.accountDerivationIndex ?? 0;
     this.logger.log("EMBEDDED_PROVIDER", "Parsed transaction for signing", {
@@ -978,13 +998,29 @@ var EmbeddedProvider = class {
       transaction: parsedTransaction,
       derivationIndex
     });
-    const rawResponse = await this.client.signAndSendTransaction({
-      walletId: this.walletId,
-      transaction: parsedTransaction.base64url,
-      networkId: params.networkId,
-      derivationIndex,
-      account: this.getAddressForNetwork(params.networkId)
-    });
+    const transactionPayload = parsedTransaction.parsed;
+    if (!transactionPayload) {
+      throw new Error("Failed to parse transaction: no valid encoding found");
+    }
+    const account = this.getAddressForNetwork(params.networkId);
+    if (!account) {
+      throw new Error(`No address found for network ${params.networkId}`);
+    }
+    let rawResponse;
+    try {
+      rawResponse = await this.client.signAndSendTransaction({
+        walletId: this.walletId,
+        transaction: transactionPayload,
+        networkId: params.networkId,
+        derivationIndex,
+        account
+      });
+    } catch (error) {
+      if (error instanceof SpendingLimitError) {
+        this.emit("spending_limit_reached", { error });
+      }
+      throw error;
+    }
     this.logger.info("EMBEDDED_PROVIDER", "Transaction signed and sent successfully", {
       walletId: this.walletId,
       networkId: params.networkId,
@@ -1004,24 +1040,25 @@ var EmbeddedProvider = class {
    * It handles app-wallet creation directly or routes to JWT/redirect authentication for user-wallets.
    * Returns null for redirect flows since they don't complete synchronously.
    */
-  async handleAuthFlow(organizationId, stamperInfo, authOptions, expiresInMs, username) {
+  async handleAuthFlow(publicKey, stamperInfo, authOptions, expiresInMs) {
     if (this.config.embeddedWalletType === "user-wallet") {
       this.logger.info("EMBEDDED_PROVIDER", "Creating user-wallet, routing authentication", {
-        authProvider: authOptions?.provider || "phantom-connect"
+        authProvider: authOptions.provider
       });
-      if (authOptions?.provider === "jwt") {
-        return await this.handleJWTAuth(organizationId, stamperInfo, authOptions, expiresInMs, username);
+      if (authOptions.provider === "phantom") {
+        return await this.handlePhantomAuth(publicKey, stamperInfo, expiresInMs);
       } else {
         this.logger.info("EMBEDDED_PROVIDER", "Starting redirect-based authentication flow", {
-          organizationId,
+          publicKey,
           provider: authOptions?.provider
         });
-        return await this.handleRedirectAuth(organizationId, stamperInfo, authOptions, username);
+        return await this.handleRedirectAuth(publicKey, stamperInfo, authOptions);
       }
     } else {
       this.logger.info("EMBEDDED_PROVIDER", "Creating app-wallet", {
-        organizationId
+        publicKey
       });
+      const organizationId = await this.createOrganizationForAppWallet(stamperInfo, expiresInMs);
       const tempClient = new PhantomClient(
         {
           apiBaseUrl: this.config.apiBaseUrl,
@@ -1041,8 +1078,8 @@ var EmbeddedProvider = class {
         organizationId,
         appId: this.config.appId,
         stamperInfo,
-        authProvider: "app-wallet",
-        userInfo: { embeddedWalletType: this.config.embeddedWalletType },
+        authProvider: "device",
+        // For now app wallets have no auth provider.
         accountDerivationIndex: 0,
         // App wallets default to index 0
         status: "completed",
@@ -1050,8 +1087,7 @@ var EmbeddedProvider = class {
         lastUsed: now,
         authenticatorCreatedAt: now,
         authenticatorExpiresAt: Date.now() + expiresInMs,
-        lastRenewalAttempt: void 0,
-        username
+        lastRenewalAttempt: void 0
       };
       await this.storage.saveSession(session);
       this.logger.info("EMBEDDED_PROVIDER", "App-wallet created successfully", { walletId, organizationId });
@@ -1059,43 +1095,56 @@ var EmbeddedProvider = class {
     }
   }
   /*
-   * We use this method to handle JWT-based authentication for user-wallets.
-   * It authenticates using the provided JWT token and creates a completed session.
+   * We use this method to handle Phantom app-based authentication for user-wallets.
+   * This method uses the PhantomAppProvider to authenticate via the browser extension or mobile app.
+   *
+   * NOTE: Mobile deeplink support is not yet implemented. If we wanted to support mobile deeplinks,
+   * we would:
+   * 1. Check if the app provider is available using phantomAppProvider.isAvailable()
+   * 2. If not available, generate a deeplink (phantom://auth?...)
+   * 3. Save a pending session before opening the deeplink
+   * 4. Start a polling mechanism to check for auth completion
+   * 5. Update the session when the mobile app completes the auth
    */
-  async handleJWTAuth(organizationId, stamperInfo, authOptions, expiresInMs, username) {
-    this.logger.info("EMBEDDED_PROVIDER", "Using JWT authentication flow");
-    if (!authOptions.jwtToken) {
-      this.logger.error("EMBEDDED_PROVIDER", "JWT token missing for JWT authentication");
-      throw new Error("JWT token is required for JWT authentication");
+  async handlePhantomAuth(publicKey, stamperInfo, expiresInMs) {
+    this.logger.info("EMBEDDED_PROVIDER", "Starting Phantom authentication flow");
+    const isAvailable = this.phantomAppProvider.isAvailable();
+    if (!isAvailable) {
+      this.logger.error("EMBEDDED_PROVIDER", "Phantom app not available");
+      throw new Error(
+        "Phantom app is not available. Please install the Phantom browser extension or mobile app to use this authentication method."
+      );
     }
-    this.logger.log("EMBEDDED_PROVIDER", "Starting JWT authentication");
-    const authResult = await this.jwtAuth.authenticate({
-      organizationId,
+    this.logger.info("EMBEDDED_PROVIDER", "Phantom app detected, proceeding with authentication");
+    const sessionId = generateSessionId();
+    const authResult = await this.phantomAppProvider.authenticate({
+      publicKey,
       appId: this.config.appId,
-      jwtToken: authOptions.jwtToken,
-      customAuthData: authOptions.customAuthData
+      sessionId
     });
-    const walletId = authResult.walletId;
-    this.logger.info("EMBEDDED_PROVIDER", "JWT authentication completed", { walletId });
+    this.logger.info("EMBEDDED_PROVIDER", "Phantom authentication completed", {
+      walletId: authResult.walletId,
+      organizationId: authResult.organizationId
+    });
+    const effectiveExpiresInMs = authResult.expiresInMs > 0 ? authResult.expiresInMs : expiresInMs;
     const now = Date.now();
     const session = {
-      sessionId: generateSessionId(),
-      walletId,
-      organizationId,
+      sessionId,
+      walletId: authResult.walletId,
+      organizationId: authResult.organizationId,
       appId: this.config.appId,
       stamperInfo,
-      authProvider: authResult.provider,
-      userInfo: authResult.userInfo,
+      authProvider: "phantom",
       accountDerivationIndex: authResult.accountDerivationIndex,
       status: "completed",
       createdAt: now,
       lastUsed: now,
       authenticatorCreatedAt: now,
-      authenticatorExpiresAt: Date.now() + expiresInMs,
+      authenticatorExpiresAt: now + effectiveExpiresInMs,
       lastRenewalAttempt: void 0,
-      username
+      authUserId: authResult.authUserId
     };
-    this.logger.log("EMBEDDED_PROVIDER", "Saving JWT session");
+    this.logger.log("EMBEDDED_PROVIDER", "Saving Phantom session");
     await this.storage.saveSession(session);
     return session;
   }
@@ -1104,9 +1153,9 @@ var EmbeddedProvider = class {
    * It saves a temporary session before redirecting to prevent losing state during the redirect flow.
    * Session timestamp is updated before redirect to prevent race conditions.
    */
-  async handleRedirectAuth(organizationId, stamperInfo, authOptions, username) {
+  async handleRedirectAuth(publicKey, stamperInfo, authOptions) {
     this.logger.info("EMBEDDED_PROVIDER", "Using Phantom Connect authentication flow (redirect-based)", {
-      provider: authOptions?.provider,
+      provider: authOptions.provider,
       hasRedirectUrl: !!this.config.authOptions.redirectUrl,
       authUrl: this.config.authOptions.authUrl
     });
@@ -1114,13 +1163,13 @@ var EmbeddedProvider = class {
     const sessionId = generateSessionId();
     const tempSession = {
       sessionId,
-      walletId: `temp-${now}`,
+      walletId: `temp-wallet-${now}`,
+      // Temporary ID, will be updated after redirect
+      organizationId: `temp-org-${now}`,
       // Temporary ID, will be updated after redirect
-      organizationId,
       appId: this.config.appId,
       stamperInfo,
-      authProvider: "phantom-connect",
-      userInfo: { provider: authOptions?.provider },
+      authProvider: authOptions.provider,
       accountDerivationIndex: void 0,
       // Will be set when redirect completes
       status: "pending",
@@ -1128,8 +1177,7 @@ var EmbeddedProvider = class {
       lastUsed: now,
       authenticatorCreatedAt: now,
       authenticatorExpiresAt: now + AUTHENTICATOR_EXPIRATION_TIME_MS,
-      lastRenewalAttempt: void 0,
-      username: username || `user-${randomUUID()}`
+      lastRenewalAttempt: void 0
     };
     this.logger.log("EMBEDDED_PROVIDER", "Saving temporary session before redirect", {
       sessionId: tempSession.sessionId,
@@ -1137,32 +1185,53 @@ var EmbeddedProvider = class {
     });
     tempSession.lastUsed = Date.now();
     await this.storage.saveSession(tempSession);
+    const shouldClearPreviousSession = await this.storage.getShouldClearPreviousSession();
     this.logger.info("EMBEDDED_PROVIDER", "Starting Phantom Connect redirect", {
-      organizationId,
+      publicKey,
       appId: this.config.appId,
       provider: authOptions?.provider,
-      authUrl: this.config.authOptions.authUrl
+      authUrl: this.config.authOptions.authUrl,
+      clearPreviousSession: shouldClearPreviousSession,
+      allowRefresh: !shouldClearPreviousSession
     });
     const authResult = await this.authProvider.authenticate({
-      organizationId,
+      publicKey,
       appId: this.config.appId,
       provider: authOptions?.provider,
       redirectUrl: this.config.authOptions.redirectUrl,
-      customAuthData: authOptions?.customAuthData,
       authUrl: this.config.authOptions.authUrl,
-      sessionId
+      sessionId,
+      // OAuth session management - defaults to allowing refresh unless user explicitly logged out
+      clearPreviousSession: shouldClearPreviousSession,
+      // true only after logout
+      allowRefresh: !shouldClearPreviousSession
+      // false only after logout
     });
     if (authResult && "walletId" in authResult) {
       this.logger.info("EMBEDDED_PROVIDER", "Authentication completed after redirect", {
         walletId: authResult.walletId,
+        organizationId: authResult.organizationId,
         provider: authResult.provider
       });
       tempSession.walletId = authResult.walletId;
+      tempSession.organizationId = authResult.organizationId;
       tempSession.authProvider = authResult.provider || tempSession.authProvider;
       tempSession.accountDerivationIndex = authResult.accountDerivationIndex;
+      tempSession.authUserId = authResult.authUserId;
       tempSession.status = "completed";
       tempSession.lastUsed = Date.now();
+      if (authResult.expiresInMs > 0) {
+        const now2 = Date.now();
+        tempSession.authenticatorCreatedAt = now2;
+        tempSession.authenticatorExpiresAt = now2 + authResult.expiresInMs;
+        this.logger.log("EMBEDDED_PROVIDER", "Updated authenticator expiration from immediate auth response", {
+          expiresInMs: authResult.expiresInMs,
+          expiresAt: new Date(tempSession.authenticatorExpiresAt).toISOString()
+        });
+      }
       await this.storage.saveSession(tempSession);
+      await this.storage.setShouldClearPreviousSession(false);
+      this.logger.log("EMBEDDED_PROVIDER", "Cleared logout flag after successful authentication");
       return tempSession;
     }
     this.logger.info("EMBEDDED_PROVIDER", "Redirect authentication initiated, waiting for redirect completion");
@@ -1175,16 +1244,31 @@ var EmbeddedProvider = class {
     }
     session.walletId = authResult.walletId;
     session.authProvider = authResult.provider || session.authProvider;
+    session.organizationId = authResult.organizationId;
     session.accountDerivationIndex = authResult.accountDerivationIndex;
+    session.authUserId = authResult.authUserId;
     session.status = "completed";
     session.lastUsed = Date.now();
+    if (authResult.expiresInMs > 0) {
+      const now = Date.now();
+      session.authenticatorCreatedAt = now;
+      session.authenticatorExpiresAt = now + authResult.expiresInMs;
+      this.logger.log("EMBEDDED_PROVIDER", "Updated authenticator expiration from auth response", {
+        expiresInMs: authResult.expiresInMs,
+        expiresAt: new Date(session.authenticatorExpiresAt).toISOString()
+      });
+    }
     await this.storage.saveSession(session);
+    await this.storage.setShouldClearPreviousSession(false);
+    this.logger.log("EMBEDDED_PROVIDER", "Cleared logout flag after successful authentication");
     await this.initializeClientFromSession(session);
     await this.ensureValidAuthenticator();
     return {
       walletId: this.walletId,
       addresses: this.addresses,
-      status: "completed"
+      status: "completed",
+      authUserId: session.authUserId,
+      authProvider: session.authProvider
     };
   }
   /*
@@ -1199,7 +1283,7 @@ var EmbeddedProvider = class {
     const now = Date.now();
     if (!session.authenticatorExpiresAt) {
       this.logger.warn("EMBEDDED_PROVIDER", "Session missing authenticator timing - treating as invalid session");
-      await this.disconnect();
+      await this.disconnect(false);
       throw new Error("Invalid session - missing authenticator timing");
     }
     const timeUntilExpiry = session.authenticatorExpiresAt - now;
@@ -1209,86 +1293,9 @@ var EmbeddedProvider = class {
     });
     if (timeUntilExpiry <= 0) {
       this.logger.error("EMBEDDED_PROVIDER", "Authenticator has expired, disconnecting");
-      await this.disconnect();
+      await this.disconnect(false);
       throw new Error("Authenticator expired");
     }
-    const renewalWindow = AUTHENTICATOR_RENEWAL_WINDOW_MS;
-    if (timeUntilExpiry <= renewalWindow) {
-      this.logger.info("EMBEDDED_PROVIDER", "Authenticator needs renewal", {
-        expiresAt: new Date(session.authenticatorExpiresAt).toISOString(),
-        timeUntilExpiry,
-        renewalWindow
-      });
-      try {
-        await this.renewAuthenticator(session);
-        this.logger.info("EMBEDDED_PROVIDER", "Authenticator renewed successfully");
-      } catch (error) {
-        this.logger.error("EMBEDDED_PROVIDER", "Failed to renew authenticator", {
-          error: error instanceof Error ? error.message : String(error)
-        });
-      }
-    }
-  }
-  /*
-   * We use this method to perform silent authenticator renewal.
-   * It generates a new keypair, creates a new authenticator, and switches to it.
-   */
-  async renewAuthenticator(session) {
-    if (!this.client) {
-      throw new Error("Client not initialized");
-    }
-    this.logger.info("EMBEDDED_PROVIDER", "Starting authenticator renewal");
-    try {
-      const newKeyInfo = await this.stamper.rotateKeyPair();
-      this.logger.log("EMBEDDED_PROVIDER", "Generated new keypair for renewal", {
-        newKeyId: newKeyInfo.keyId,
-        newPublicKey: newKeyInfo.publicKey
-      });
-      const base64urlPublicKey = base64urlEncode(bs582.decode(newKeyInfo.publicKey));
-      const expiresInMs = AUTHENTICATOR_EXPIRATION_TIME_MS;
-      let authenticatorResult;
-      try {
-        authenticatorResult = await this.client.createAuthenticator({
-          organizationId: session.organizationId,
-          username: session.username,
-          authenticatorName: `auth-${newKeyInfo.keyId.substring(0, 8)}`,
-          authenticator: {
-            authenticatorName: `auth-${newKeyInfo.keyId.substring(0, 8)}`,
-            authenticatorKind: "keypair",
-            publicKey: base64urlPublicKey,
-            algorithm: "Ed25519"
-            // Commented for now until KMS supports fully expiring organizations
-            // expiresInMs: expiresInMs,
-          },
-          replaceExpirable: true
-        });
-      } catch (error) {
-        this.logger.error("EMBEDDED_PROVIDER", "Failed to create new authenticator", {
-          error: error instanceof Error ? error.message : String(error)
-        });
-        await this.stamper.rollbackRotation();
-        throw new Error(
-          `Failed to create new authenticator: ${error instanceof Error ? error.message : String(error)}`
-        );
-      }
-      this.logger.info("EMBEDDED_PROVIDER", "Created new authenticator", {
-        authenticatorId: authenticatorResult.id
-      });
-      await this.stamper.commitRotation(authenticatorResult.id || "unknown");
-      const now = Date.now();
-      session.stamperInfo = newKeyInfo;
-      session.authenticatorCreatedAt = now;
-      session.authenticatorExpiresAt = Date.now() + expiresInMs;
-      session.lastRenewalAttempt = now;
-      await this.storage.saveSession(session);
-      this.logger.info("EMBEDDED_PROVIDER", "Authenticator renewal completed successfully", {
-        newKeyId: newKeyInfo.keyId,
-        expiresAt: new Date(Date.now() + expiresInMs).toISOString()
-      });
-    } catch (error) {
-      await this.stamper.rollbackRotation();
-      throw error;
-    }
   }
   /*
    * We use this method to initialize the PhantomClient and fetch wallet addresses from a completed session.
@@ -1320,10 +1327,10 @@ var EmbeddedProvider = class {
 export {
   AUTHENTICATOR_EXPIRATION_TIME_MS,
   AUTHENTICATOR_RENEWAL_WINDOW_MS,
+  EMBEDDED_PROVIDER_AUTH_TYPES,
   EmbeddedEthereumChain,
   EmbeddedProvider,
   EmbeddedSolanaChain,
-  JWTAuth,
   generateSessionId,
   retryWithBackoff
 };