@phantom/embedded-provider-core 1.0.2 → 1.0.4

package/dist/index.d.mts

@@ -1,7 +1,7 @@
 import { AddressType, SpendingLimitError } from '@phantom/client';
 import { NetworkId, ClientSideSdkHeaders } from '@phantom/constants';
 import { ParsedSignatureResult, ParsedTransactionResult } from '@phantom/parsers';
-import { StamperWithKeyManagement, Transaction, VersionedTransaction } from '@phantom/sdk-types';
+import { Algorithm, StamperWithKeyManagement, Transaction, VersionedTransaction } from '@phantom/sdk-types';
 import { ISolanaChain, IEthereumChain, EthTransactionRequest } from '@phantom/chain-interfaces';
 
 interface WalletAddress {
@@ -44,8 +44,13 @@ interface EmbeddedProviderConfig {
     apiBaseUrl: string;
     appId: string;
     authOptions: {
-        authUrl: string;
-        redirectUrl: string;
+        authUrl?: string;
+        redirectUrl?: string;
+    };
+    /** When also provided, the Auth2 PKCE flow is used instead of the legacy Phantom Connect flow. */
+    unstable__auth2Options?: {
+        authApiBaseUrl: string;
+        clientId: string;
     };
     embeddedWalletType: "app-wallet" | "user-wallet" | (string & Record<never, never>);
     addressTypes: AddressType[];
@@ -77,6 +82,9 @@ interface Session {
     lastRenewalAttempt?: number;
     accountDerivationIndex?: number;
     authUserId?: string;
+    pkceCodeVerifier?: string;
+    salt?: string;
+    bearerToken?: string;
 }
 interface EmbeddedStorage {
     getSession(): Promise<Session | null>;
@@ -113,6 +121,7 @@ interface AuthResult {
     accountDerivationIndex: number;
     expiresInMs: number;
     authUserId?: string;
+    bearerToken?: string;
 }
 interface PhantomConnectOptions {
     publicKey: string;
@@ -123,10 +132,11 @@ interface PhantomConnectOptions {
     sessionId: string;
     clearPreviousSession?: boolean;
     allowRefresh?: boolean;
+    algorithm?: Algorithm;
 }
 interface AuthProvider {
     authenticate(options: PhantomConnectOptions): Promise<void | AuthResult>;
-    resumeAuthFromRedirect?(provider: EmbeddedProviderAuthType): AuthResult | null;
+    resumeAuthFromRedirect?(provider: EmbeddedProviderAuthType): Promise<AuthResult | null>;
 }
 interface PhantomAppAuthOptions {
     publicKey: string;
@@ -163,6 +173,7 @@ interface ConnectStartEventData {
     authOptions?: {
         provider?: string;
     };
+    walletId?: string;
 }
 interface ConnectErrorEventData {
     error: string;
@@ -215,6 +226,11 @@ declare class EmbeddedProvider {
     private createOrganizationForAppWallet;
     connect(authOptions: AuthOptions): Promise<ConnectResult>;
     disconnect(shouldClearPreviousSession?: boolean): Promise<void>;
+    /**
+     * Handles errors from signing operations.
+     * Disconnects the user if the server returns a 401/403 (revoked or expired authenticator).
+     */
+    private handleSigningError;
     signMessage(params: SignMessageParams): Promise<ParsedSignatureResult>;
     signEthereumMessage(params: SignMessageParams): Promise<ParsedSignatureResult>;
     signTypedDataV4(params: SignTypedDataV4Params): Promise<ParsedSignatureResult>;
@@ -240,12 +256,11 @@ declare function retryWithBackoff<T>(operation: () => Promise<T>, operationName:
 declare class EmbeddedSolanaChain implements ISolanaChain {
     private provider;
     private currentNetworkId;
-    private _connected;
     private _publicKey;
     private eventEmitter;
     constructor(provider: EmbeddedProvider);
-    get connected(): boolean;
     get publicKey(): string | null;
+    get isConnected(): boolean;
     private ensureConnected;
     signMessage(message: string | Uint8Array): Promise<{
         signature: Uint8Array;
@@ -266,11 +281,8 @@ declare class EmbeddedSolanaChain implements ISolanaChain {
     }>;
     disconnect(): Promise<void>;
     switchNetwork(network: "mainnet" | "devnet"): Promise<void>;
-    getPublicKey(): Promise<string | null>;
-    isConnected(): boolean;
     private setupEventListeners;
     private syncInitialState;
-    private updateConnectionState;
     on(event: string, listener: (...args: any[]) => void): void;
     off(event: string, listener: (...args: any[]) => void): void;
 }
@@ -281,11 +293,9 @@ declare class EmbeddedSolanaChain implements ISolanaChain {
 declare class EmbeddedEthereumChain implements IEthereumChain {
     private provider;
     private currentNetworkId;
-    private _connected;
     private _accounts;
     private eventEmitter;
     constructor(provider: EmbeddedProvider);
-    get connected(): boolean;
     get chainId(): string;
     get accounts(): string[];
     private ensureConnected;

package/dist/index.d.ts

@@ -1,7 +1,7 @@
 import { AddressType, SpendingLimitError } from '@phantom/client';
 import { NetworkId, ClientSideSdkHeaders } from '@phantom/constants';
 import { ParsedSignatureResult, ParsedTransactionResult } from '@phantom/parsers';
-import { StamperWithKeyManagement, Transaction, VersionedTransaction } from '@phantom/sdk-types';
+import { Algorithm, StamperWithKeyManagement, Transaction, VersionedTransaction } from '@phantom/sdk-types';
 import { ISolanaChain, IEthereumChain, EthTransactionRequest } from '@phantom/chain-interfaces';
 
 interface WalletAddress {
@@ -44,8 +44,13 @@ interface EmbeddedProviderConfig {
     apiBaseUrl: string;
     appId: string;
     authOptions: {
-        authUrl: string;
-        redirectUrl: string;
+        authUrl?: string;
+        redirectUrl?: string;
+    };
+    /** When also provided, the Auth2 PKCE flow is used instead of the legacy Phantom Connect flow. */
+    unstable__auth2Options?: {
+        authApiBaseUrl: string;
+        clientId: string;
     };
     embeddedWalletType: "app-wallet" | "user-wallet" | (string & Record<never, never>);
     addressTypes: AddressType[];
@@ -77,6 +82,9 @@ interface Session {
     lastRenewalAttempt?: number;
     accountDerivationIndex?: number;
     authUserId?: string;
+    pkceCodeVerifier?: string;
+    salt?: string;
+    bearerToken?: string;
 }
 interface EmbeddedStorage {
     getSession(): Promise<Session | null>;
@@ -113,6 +121,7 @@ interface AuthResult {
     accountDerivationIndex: number;
     expiresInMs: number;
     authUserId?: string;
+    bearerToken?: string;
 }
 interface PhantomConnectOptions {
     publicKey: string;
@@ -123,10 +132,11 @@ interface PhantomConnectOptions {
     sessionId: string;
     clearPreviousSession?: boolean;
     allowRefresh?: boolean;
+    algorithm?: Algorithm;
 }
 interface AuthProvider {
     authenticate(options: PhantomConnectOptions): Promise<void | AuthResult>;
-    resumeAuthFromRedirect?(provider: EmbeddedProviderAuthType): AuthResult | null;
+    resumeAuthFromRedirect?(provider: EmbeddedProviderAuthType): Promise<AuthResult | null>;
 }
 interface PhantomAppAuthOptions {
     publicKey: string;
@@ -163,6 +173,7 @@ interface ConnectStartEventData {
     authOptions?: {
         provider?: string;
     };
+    walletId?: string;
 }
 interface ConnectErrorEventData {
     error: string;
@@ -215,6 +226,11 @@ declare class EmbeddedProvider {
     private createOrganizationForAppWallet;
     connect(authOptions: AuthOptions): Promise<ConnectResult>;
     disconnect(shouldClearPreviousSession?: boolean): Promise<void>;
+    /**
+     * Handles errors from signing operations.
+     * Disconnects the user if the server returns a 401/403 (revoked or expired authenticator).
+     */
+    private handleSigningError;
     signMessage(params: SignMessageParams): Promise<ParsedSignatureResult>;
     signEthereumMessage(params: SignMessageParams): Promise<ParsedSignatureResult>;
     signTypedDataV4(params: SignTypedDataV4Params): Promise<ParsedSignatureResult>;
@@ -240,12 +256,11 @@ declare function retryWithBackoff<T>(operation: () => Promise<T>, operationName:
 declare class EmbeddedSolanaChain implements ISolanaChain {
     private provider;
     private currentNetworkId;
-    private _connected;
     private _publicKey;
     private eventEmitter;
     constructor(provider: EmbeddedProvider);
-    get connected(): boolean;
     get publicKey(): string | null;
+    get isConnected(): boolean;
     private ensureConnected;
     signMessage(message: string | Uint8Array): Promise<{
         signature: Uint8Array;
@@ -266,11 +281,8 @@ declare class EmbeddedSolanaChain implements ISolanaChain {
     }>;
     disconnect(): Promise<void>;
     switchNetwork(network: "mainnet" | "devnet"): Promise<void>;
-    getPublicKey(): Promise<string | null>;
-    isConnected(): boolean;
     private setupEventListeners;
     private syncInitialState;
-    private updateConnectionState;
     on(event: string, listener: (...args: any[]) => void): void;
     off(event: string, listener: (...args: any[]) => void): void;
 }
@@ -281,11 +293,9 @@ declare class EmbeddedSolanaChain implements ISolanaChain {
 declare class EmbeddedEthereumChain implements IEthereumChain {
     private provider;
     private currentNetworkId;
-    private _connected;
     private _accounts;
     private eventEmitter;
     constructor(provider: EmbeddedProvider);
-    get connected(): boolean;
     get chainId(): string;
     get accounts(): string[];
     private ensureConnected;

package/dist/index.js

@@ -63,21 +63,19 @@ var EmbeddedSolanaChain = class {
   constructor(provider) {
     this.provider = provider;
     this.currentNetworkId = import_constants.NetworkId.SOLANA_MAINNET;
-    this._connected = false;
     this._publicKey = null;
     this.eventEmitter = new import_eventemitter3.EventEmitter();
     this.setupEventListeners();
     this.syncInitialState();
   }
-  // Wallet adapter compliant properties
-  get connected() {
-    return this._connected;
-  }
   get publicKey() {
     return this._publicKey;
   }
+  get isConnected() {
+    return this._publicKey !== null;
+  }
   ensureConnected() {
-    if (!this.provider.isConnected()) {
+    if (!this.isConnected) {
       throw new Error("Solana chain not available. Ensure SDK is connected.");
     }
   }
@@ -135,7 +133,7 @@ var EmbeddedSolanaChain = class {
     const solanaAddr = addresses.find((a) => a.addressType === "Solana");
     if (!solanaAddr)
       throw new Error("No Solana address found");
-    this.updateConnectionState(true, solanaAddr.address);
+    this._publicKey = solanaAddr.address;
     return Promise.resolve({ publicKey: solanaAddr.address });
   }
   async disconnect() {
@@ -145,41 +143,25 @@ var EmbeddedSolanaChain = class {
     this.currentNetworkId = network === "mainnet" ? import_constants.NetworkId.SOLANA_MAINNET : import_constants.NetworkId.SOLANA_DEVNET;
     return Promise.resolve();
   }
-  getPublicKey() {
-    if (!this.provider.isConnected())
-      return Promise.resolve(null);
-    const addresses = this.provider.getAddresses();
-    const solanaAddr = addresses.find((a) => a.addressType === "Solana");
-    return Promise.resolve(solanaAddr?.address || null);
-  }
-  isConnected() {
-    return this._connected && this.provider.isConnected();
-  }
   setupEventListeners() {
     this.provider.on("connect", (data) => {
       const solanaAddress = data.addresses?.find((addr) => addr.addressType === "Solana");
       if (solanaAddress) {
-        this.updateConnectionState(true, solanaAddress.address);
+        this._publicKey = solanaAddress.address;
         this.eventEmitter.emit("connect", solanaAddress.address);
       }
     });
     this.provider.on("disconnect", () => {
-      this.updateConnectionState(false, null);
+      this._publicKey = null;
       this.eventEmitter.emit("disconnect");
     });
   }
   syncInitialState() {
-    if (this.provider.isConnected()) {
-      const addresses = this.provider.getAddresses();
-      const solanaAddress = addresses.find((a) => a.addressType === "Solana");
-      if (solanaAddress) {
-        this.updateConnectionState(true, solanaAddress.address);
-      }
-    }
-  }
-  updateConnectionState(connected, publicKey) {
-    this._connected = connected;
-    this._publicKey = publicKey;
+    if (!this.provider.isConnected())
+      return;
+    const addresses = this.provider.getAddresses();
+    const solanaAddr = addresses.find((a) => a.addressType === "Solana");
+    this._publicKey = solanaAddr?.address || null;
   }
   // Event methods for interface compliance
   on(event, listener) {
@@ -197,16 +179,11 @@ var EmbeddedEthereumChain = class {
   constructor(provider) {
     this.provider = provider;
     this.currentNetworkId = import_constants2.NetworkId.ETHEREUM_MAINNET;
-    this._connected = false;
     this._accounts = [];
     this.eventEmitter = new import_eventemitter32.EventEmitter();
     this.setupEventListeners();
     this.syncInitialState();
   }
-  // EIP-1193 compliant properties
-  get connected() {
-    return this._connected;
-  }
   get chainId() {
     const chainId = (0, import_constants2.networkIdToChainId)(this.currentNetworkId) || 1;
     return `0x${chainId.toString(16)}`;
@@ -230,7 +207,7 @@ var EmbeddedEthereumChain = class {
     }
     const addresses = this.provider.getAddresses();
     const ethAddresses = addresses.filter((a) => a.addressType === "Ethereum").map((a) => a.address);
-    this.updateConnectionState(true, ethAddresses);
+    this.updateConnectionState(ethAddresses);
     return Promise.resolve(ethAddresses);
   }
   async disconnect() {
@@ -296,19 +273,19 @@ var EmbeddedEthereumChain = class {
     return this.request({ method: "eth_accounts" });
   }
   isConnected() {
-    return this._connected && this.provider.isConnected();
+    return this.provider.isConnected() && this._accounts.length > 0;
   }
   setupEventListeners() {
     this.provider.on("connect", (data) => {
       const ethAddresses = data.addresses?.filter((addr) => addr.addressType === "Ethereum")?.map((addr) => addr.address) || [];
       if (ethAddresses.length > 0) {
-        this.updateConnectionState(true, ethAddresses);
+        this.updateConnectionState(ethAddresses);
         this.eventEmitter.emit("connect", { chainId: this.chainId });
         this.eventEmitter.emit("accountsChanged", ethAddresses);
       }
     });
     this.provider.on("disconnect", () => {
-      this.updateConnectionState(false, []);
+      this.updateConnectionState([]);
       this.eventEmitter.emit("disconnect", { code: 4900, message: "Provider disconnected" });
       this.eventEmitter.emit("accountsChanged", []);
     });
@@ -318,12 +295,11 @@ var EmbeddedEthereumChain = class {
       const addresses = this.provider.getAddresses();
       const ethAddresses = addresses.filter((a) => a.addressType === "Ethereum").map((a) => a.address);
       if (ethAddresses.length > 0) {
-        this.updateConnectionState(true, ethAddresses);
+        this.updateConnectionState(ethAddresses);
       }
     }
   }
-  updateConnectionState(connected, accounts) {
-    this._connected = connected;
+  updateConnectionState(accounts) {
     this._accounts = accounts;
   }
   async handleEmbeddedRequest(args) {
@@ -551,7 +527,8 @@ var EmbeddedProvider = class {
     });
     if (session.status !== "completed") {
       const urlSessionId = this.urlParamsAccessor.getParam("session_id");
-      if (session.status === "pending" && !urlSessionId) {
+      const urlCode = this.urlParamsAccessor.getParam("code");
+      if (session.status === "pending" && !urlSessionId && !urlCode) {
         this.logger.warn("EMBEDDED_PROVIDER", "Session mismatch detected - pending session without redirect context", {
           sessionId: session.sessionId,
           status: session.status
@@ -624,7 +601,7 @@ var EmbeddedProvider = class {
     }
     this.logger.log("EMBEDDED_PROVIDER", "No completed session found, checking for redirect resume");
     if (this.authProvider.resumeAuthFromRedirect) {
-      const authResult = this.authProvider.resumeAuthFromRedirect(session.authProvider);
+      const authResult = await this.authProvider.resumeAuthFromRedirect(session.authProvider);
       if (authResult) {
         this.logger.info("EMBEDDED_PROVIDER", "Resuming from redirect", {
           walletId: authResult.walletId,
@@ -787,7 +764,7 @@ var EmbeddedProvider = class {
             authenticatorName: `auth-${shortPubKey}`,
             authenticatorKind: "keypair",
             publicKey: base64urlPublicKey,
-            algorithm: "Ed25519",
+            algorithm: this.stamper.algorithm,
             expiresInMs
           }
         ]
@@ -903,6 +880,21 @@ var EmbeddedProvider = class {
       });
     }
   }
+  /**
+   * Handles errors from signing operations.
+   * Disconnects the user if the server returns a 401/403 (revoked or expired authenticator).
+   */
+  async handleSigningError(error) {
+    if ((0, import_client.isAuthenticationError)(error)) {
+      this.logger.warn("EMBEDDED_PROVIDER", "Authenticator rejected by server (401/403), disconnecting", { error });
+      await this.disconnect(false);
+      throw new Error("Authenticator revoked");
+    }
+    if (error instanceof import_client.SpendingLimitError) {
+      this.emit("spending_limit_reached", { error });
+    }
+    throw error;
+  }
   async signMessage(params) {
     if (!this.client || !this.walletId) {
       throw new Error("Not connected");
@@ -919,7 +911,7 @@ var EmbeddedProvider = class {
       message: params.message,
       networkId: params.networkId,
       derivationIndex
-    });
+    }).catch((error) => this.handleSigningError(error));
     this.logger.info("EMBEDDED_PROVIDER", "Message signed successfully", {
       walletId: this.walletId,
       message: params.message
@@ -952,7 +944,7 @@ var EmbeddedProvider = class {
       message: base64UrlMessage,
       networkId: params.networkId,
       derivationIndex
-    });
+    }).catch((error) => this.handleSigningError(error));
     this.logger.info("EMBEDDED_PROVIDER", "Message signed successfully", {
       walletId: this.walletId,
       message: params.message
@@ -975,7 +967,7 @@ var EmbeddedProvider = class {
       typedData: params.typedData,
       networkId: params.networkId,
       derivationIndex
-    });
+    }).catch((error) => this.handleSigningError(error));
     this.logger.info("EMBEDDED_PROVIDER", "Typed data signed successfully", {
       walletId: this.walletId
     });
@@ -1012,7 +1004,7 @@ var EmbeddedProvider = class {
       networkId: params.networkId,
       derivationIndex,
       account
-    });
+    }).catch((error) => this.handleSigningError(error));
     this.logger.info("EMBEDDED_PROVIDER", "Transaction signed successfully", {
       walletId: this.walletId,
       networkId: params.networkId,
@@ -1045,21 +1037,13 @@ var EmbeddedProvider = class {
     if (!account) {
       throw new Error(`No address found for network ${params.networkId}`);
     }
-    let rawResponse;
-    try {
-      rawResponse = await this.client.signAndSendTransaction({
-        walletId: this.walletId,
-        transaction: transactionPayload,
-        networkId: params.networkId,
-        derivationIndex,
-        account
-      });
-    } catch (error) {
-      if (error instanceof import_client.SpendingLimitError) {
-        this.emit("spending_limit_reached", { error });
-      }
-      throw error;
-    }
+    const rawResponse = await this.client.signAndSendTransaction({
+      walletId: this.walletId,
+      transaction: transactionPayload,
+      networkId: params.networkId,
+      derivationIndex,
+      account
+    }).catch((error) => this.handleSigningError(error));
     this.logger.info("EMBEDDED_PROVIDER", "Transaction signed and sent successfully", {
       walletId: this.walletId,
       networkId: params.networkId,
@@ -1243,8 +1227,9 @@ var EmbeddedProvider = class {
       // OAuth session management - defaults to allowing refresh unless user explicitly logged out
       clearPreviousSession: shouldClearPreviousSession,
       // true only after logout
-      allowRefresh: !shouldClearPreviousSession
+      allowRefresh: !shouldClearPreviousSession,
       // false only after logout
+      algorithm: this.stamper.algorithm
     });
     if (authResult && "walletId" in authResult) {
       this.logger.info("EMBEDDED_PROVIDER", "Authentication completed after redirect", {
@@ -1257,6 +1242,7 @@ var EmbeddedProvider = class {
       tempSession.authProvider = authResult.provider || tempSession.authProvider;
       tempSession.accountDerivationIndex = authResult.accountDerivationIndex;
       tempSession.authUserId = authResult.authUserId;
+      tempSession.bearerToken = authResult.bearerToken;
       tempSession.status = "completed";
       tempSession.lastUsed = Date.now();
       if (authResult.expiresInMs > 0) {
@@ -1286,6 +1272,7 @@ var EmbeddedProvider = class {
     session.organizationId = authResult.organizationId;
     session.accountDerivationIndex = authResult.accountDerivationIndex;
     session.authUserId = authResult.authUserId;
+    session.bearerToken = authResult.bearerToken;
     session.status = "completed";
     session.lastUsed = Date.now();
     if (authResult.expiresInMs > 0) {
@@ -1355,7 +1342,8 @@ var EmbeddedProvider = class {
         organizationId: session.organizationId,
         headers: {
           ...this.platform.analyticsHeaders || {},
-          ...session.authUserId ? { "x-auth-user-id": session.authUserId } : {}
+          ...session.authUserId ? { "x-auth-user-id": session.authUserId } : {},
+          ...session.bearerToken ? { Authorization: session.bearerToken } : {}
         }
       },
       this.stamper