@phantom/embedded-provider-core 1.0.3 → 1.0.5

package/dist/index.d.mts

@@ -44,8 +44,13 @@ interface EmbeddedProviderConfig {
     apiBaseUrl: string;
     appId: string;
     authOptions: {
-        authUrl: string;
-        redirectUrl: string;
+        authUrl?: string;
+        redirectUrl?: string;
+    };
+    /** When also provided, the Auth2 PKCE flow is used instead of the legacy Phantom Connect flow. */
+    unstable__auth2Options?: {
+        authApiBaseUrl: string;
+        clientId: string;
     };
     embeddedWalletType: "app-wallet" | "user-wallet" | (string & Record<never, never>);
     addressTypes: AddressType[];
@@ -77,6 +82,9 @@ interface Session {
     lastRenewalAttempt?: number;
     accountDerivationIndex?: number;
     authUserId?: string;
+    pkceCodeVerifier?: string;
+    salt?: string;
+    bearerToken?: string;
 }
 interface EmbeddedStorage {
     getSession(): Promise<Session | null>;
@@ -113,6 +121,7 @@ interface AuthResult {
     accountDerivationIndex: number;
     expiresInMs: number;
     authUserId?: string;
+    bearerToken?: string;
 }
 interface PhantomConnectOptions {
     publicKey: string;
@@ -127,7 +136,7 @@ interface PhantomConnectOptions {
 }
 interface AuthProvider {
     authenticate(options: PhantomConnectOptions): Promise<void | AuthResult>;
-    resumeAuthFromRedirect?(provider: EmbeddedProviderAuthType): AuthResult | null;
+    resumeAuthFromRedirect?(provider: EmbeddedProviderAuthType): Promise<AuthResult | null>;
 }
 interface PhantomAppAuthOptions {
     publicKey: string;
@@ -217,6 +226,11 @@ declare class EmbeddedProvider {
     private createOrganizationForAppWallet;
     connect(authOptions: AuthOptions): Promise<ConnectResult>;
     disconnect(shouldClearPreviousSession?: boolean): Promise<void>;
+    /**
+     * Handles errors from signing operations.
+     * Disconnects the user if the server returns a 401/403 (revoked or expired authenticator).
+     */
+    private handleSigningError;
     signMessage(params: SignMessageParams): Promise<ParsedSignatureResult>;
     signEthereumMessage(params: SignMessageParams): Promise<ParsedSignatureResult>;
     signTypedDataV4(params: SignTypedDataV4Params): Promise<ParsedSignatureResult>;

package/dist/index.d.ts

@@ -44,8 +44,13 @@ interface EmbeddedProviderConfig {
     apiBaseUrl: string;
     appId: string;
     authOptions: {
-        authUrl: string;
-        redirectUrl: string;
+        authUrl?: string;
+        redirectUrl?: string;
+    };
+    /** When also provided, the Auth2 PKCE flow is used instead of the legacy Phantom Connect flow. */
+    unstable__auth2Options?: {
+        authApiBaseUrl: string;
+        clientId: string;
     };
     embeddedWalletType: "app-wallet" | "user-wallet" | (string & Record<never, never>);
     addressTypes: AddressType[];
@@ -77,6 +82,9 @@ interface Session {
     lastRenewalAttempt?: number;
     accountDerivationIndex?: number;
     authUserId?: string;
+    pkceCodeVerifier?: string;
+    salt?: string;
+    bearerToken?: string;
 }
 interface EmbeddedStorage {
     getSession(): Promise<Session | null>;
@@ -113,6 +121,7 @@ interface AuthResult {
     accountDerivationIndex: number;
     expiresInMs: number;
     authUserId?: string;
+    bearerToken?: string;
 }
 interface PhantomConnectOptions {
     publicKey: string;
@@ -127,7 +136,7 @@ interface PhantomConnectOptions {
 }
 interface AuthProvider {
     authenticate(options: PhantomConnectOptions): Promise<void | AuthResult>;
-    resumeAuthFromRedirect?(provider: EmbeddedProviderAuthType): AuthResult | null;
+    resumeAuthFromRedirect?(provider: EmbeddedProviderAuthType): Promise<AuthResult | null>;
 }
 interface PhantomAppAuthOptions {
     publicKey: string;
@@ -217,6 +226,11 @@ declare class EmbeddedProvider {
     private createOrganizationForAppWallet;
     connect(authOptions: AuthOptions): Promise<ConnectResult>;
     disconnect(shouldClearPreviousSession?: boolean): Promise<void>;
+    /**
+     * Handles errors from signing operations.
+     * Disconnects the user if the server returns a 401/403 (revoked or expired authenticator).
+     */
+    private handleSigningError;
     signMessage(params: SignMessageParams): Promise<ParsedSignatureResult>;
     signEthereumMessage(params: SignMessageParams): Promise<ParsedSignatureResult>;
     signTypedDataV4(params: SignTypedDataV4Params): Promise<ParsedSignatureResult>;

package/dist/index.js

@@ -527,7 +527,8 @@ var EmbeddedProvider = class {
     });
     if (session.status !== "completed") {
       const urlSessionId = this.urlParamsAccessor.getParam("session_id");
-      if (session.status === "pending" && !urlSessionId) {
+      const urlCode = this.urlParamsAccessor.getParam("code");
+      if (session.status === "pending" && !urlSessionId && !urlCode) {
         this.logger.warn("EMBEDDED_PROVIDER", "Session mismatch detected - pending session without redirect context", {
           sessionId: session.sessionId,
           status: session.status
@@ -600,7 +601,7 @@ var EmbeddedProvider = class {
     }
     this.logger.log("EMBEDDED_PROVIDER", "No completed session found, checking for redirect resume");
     if (this.authProvider.resumeAuthFromRedirect) {
-      const authResult = this.authProvider.resumeAuthFromRedirect(session.authProvider);
+      const authResult = await this.authProvider.resumeAuthFromRedirect(session.authProvider);
       if (authResult) {
         this.logger.info("EMBEDDED_PROVIDER", "Resuming from redirect", {
           walletId: authResult.walletId,
@@ -879,6 +880,21 @@ var EmbeddedProvider = class {
       });
     }
   }
+  /**
+   * Handles errors from signing operations.
+   * Disconnects the user if the server returns a 401/403 (revoked or expired authenticator).
+   */
+  async handleSigningError(error) {
+    if ((0, import_client.isAuthenticationError)(error)) {
+      this.logger.warn("EMBEDDED_PROVIDER", "Authenticator rejected by server (401/403), disconnecting", { error });
+      await this.disconnect(false);
+      throw new Error("Authenticator revoked");
+    }
+    if (error instanceof import_client.SpendingLimitError) {
+      this.emit("spending_limit_reached", { error });
+    }
+    throw error;
+  }
   async signMessage(params) {
     if (!this.client || !this.walletId) {
       throw new Error("Not connected");
@@ -895,7 +911,7 @@ var EmbeddedProvider = class {
       message: params.message,
       networkId: params.networkId,
       derivationIndex
-    });
+    }).catch((error) => this.handleSigningError(error));
     this.logger.info("EMBEDDED_PROVIDER", "Message signed successfully", {
       walletId: this.walletId,
       message: params.message
@@ -928,7 +944,7 @@ var EmbeddedProvider = class {
       message: base64UrlMessage,
       networkId: params.networkId,
       derivationIndex
-    });
+    }).catch((error) => this.handleSigningError(error));
     this.logger.info("EMBEDDED_PROVIDER", "Message signed successfully", {
       walletId: this.walletId,
       message: params.message
@@ -951,7 +967,7 @@ var EmbeddedProvider = class {
       typedData: params.typedData,
       networkId: params.networkId,
       derivationIndex
-    });
+    }).catch((error) => this.handleSigningError(error));
     this.logger.info("EMBEDDED_PROVIDER", "Typed data signed successfully", {
       walletId: this.walletId
     });
@@ -988,7 +1004,7 @@ var EmbeddedProvider = class {
       networkId: params.networkId,
       derivationIndex,
       account
-    });
+    }).catch((error) => this.handleSigningError(error));
     this.logger.info("EMBEDDED_PROVIDER", "Transaction signed successfully", {
       walletId: this.walletId,
       networkId: params.networkId,
@@ -1021,21 +1037,13 @@ var EmbeddedProvider = class {
     if (!account) {
       throw new Error(`No address found for network ${params.networkId}`);
     }
-    let rawResponse;
-    try {
-      rawResponse = await this.client.signAndSendTransaction({
-        walletId: this.walletId,
-        transaction: transactionPayload,
-        networkId: params.networkId,
-        derivationIndex,
-        account
-      });
-    } catch (error) {
-      if (error instanceof import_client.SpendingLimitError) {
-        this.emit("spending_limit_reached", { error });
-      }
-      throw error;
-    }
+    const rawResponse = await this.client.signAndSendTransaction({
+      walletId: this.walletId,
+      transaction: transactionPayload,
+      networkId: params.networkId,
+      derivationIndex,
+      account
+    }).catch((error) => this.handleSigningError(error));
     this.logger.info("EMBEDDED_PROVIDER", "Transaction signed and sent successfully", {
       walletId: this.walletId,
       networkId: params.networkId,
@@ -1234,6 +1242,7 @@ var EmbeddedProvider = class {
       tempSession.authProvider = authResult.provider || tempSession.authProvider;
       tempSession.accountDerivationIndex = authResult.accountDerivationIndex;
       tempSession.authUserId = authResult.authUserId;
+      tempSession.bearerToken = authResult.bearerToken;
       tempSession.status = "completed";
       tempSession.lastUsed = Date.now();
       if (authResult.expiresInMs > 0) {
@@ -1263,6 +1272,7 @@ var EmbeddedProvider = class {
     session.organizationId = authResult.organizationId;
     session.accountDerivationIndex = authResult.accountDerivationIndex;
     session.authUserId = authResult.authUserId;
+    session.bearerToken = authResult.bearerToken;
     session.status = "completed";
     session.lastUsed = Date.now();
     if (authResult.expiresInMs > 0) {
@@ -1332,7 +1342,8 @@ var EmbeddedProvider = class {
         organizationId: session.organizationId,
         headers: {
           ...this.platform.analyticsHeaders || {},
-          ...session.authUserId ? { "x-auth-user-id": session.authUserId } : {}
+          ...session.authUserId ? { "x-auth-user-id": session.authUserId } : {},
+          ...session.bearerToken ? { Authorization: session.bearerToken } : {}
         }
       },
       this.stamper