@portal-hq/web 3.17.0 → 3.18.0-alpha.0

package/src/mpc/index.ts

@@ -44,6 +44,27 @@ import type {
 import type {
   GetTransactionHistoryParams,
   GetTransactionHistoryResponse,
+  NoahGetPaymentMethodsRequest,
+  MeldCreateCustomerRequest,
+  MeldCreateCustomerResponse,
+  MeldSearchCustomerResponse,
+  MeldGetRetailQuoteRequest,
+  MeldGetRetailQuoteResponse,
+  MeldCreateRetailWidgetRequest,
+  MeldCreateRetailWidgetResponse,
+  MeldSearchRetailTransactionsParams,
+  MeldSearchRetailTransactionsResponse,
+  MeldGetRetailTransactionResponse,
+  MeldDiscoveryParams,
+  MeldGetServiceProvidersResponse,
+  MeldGetCountriesResponse,
+  MeldGetFiatCurrenciesResponse,
+  MeldGetCryptoCurrenciesResponse,
+  MeldGetPaymentMethodsResponse,
+  MeldGetDefaultsResponse,
+  MeldGetBuyLimitsResponse,
+  MeldGetSellLimitsResponse,
+  MeldGetKycLimitsResponse,
 } from '../shared/types'
 import {
   YieldXyzEnterRequest,
@@ -138,7 +159,7 @@ import {
 } from '../../hypernative'
 import { generateTraceId } from '../shared/trace'
 
-const WEB_SDK_VERSION = '3.17.0'
+const WEB_SDK_VERSION = '3.18.0-alpha.0'
 
 class Mpc {
   public iframe?: HTMLIFrameElement
@@ -365,6 +386,8 @@ class Mpc {
     param: string,
     options?: RawSignOptions,
   ): Promise<string> {
+    const traceId = options?.traceId ?? generateTraceId()
+    sdkLogger.debug(`[Portal MPC] rawSign started | traceId=${traceId}`)
     return this.handleRequestToIframeAndPost({
       methodMessage: 'portal:mpc:rawSign',
       errorMessage: 'portal:mpc:rawSignError',
@@ -376,7 +399,7 @@ class Mpc {
           signatureApprovalMemo: options.signatureApprovalMemo,
         }),
       },
-      traceId: options?.traceId,
+      traceId,
     })
   }
 
@@ -906,15 +929,191 @@ class Mpc {
     })
   }
 
-  public async getPaymentMethods(): Promise<NoahGetPaymentMethodsResponse> {
+  public async getPaymentMethods(
+    data?: NoahGetPaymentMethodsRequest,
+  ): Promise<NoahGetPaymentMethodsResponse> {
     return this.handleRequestToIframeAndPost({
       methodMessage: 'portal:noah:getPaymentMethods',
       errorMessage: 'portal:noah:getPaymentMethodsError',
       resultMessage: 'portal:noah:getPaymentMethodsResult',
+      data,
+    })
+  }
+
+  public async meldCreateCustomer(
+    data: MeldCreateCustomerRequest,
+  ): Promise<MeldCreateCustomerResponse> {
+    return this.handleRequestToIframeAndPost({
+      methodMessage: 'portal:meld:createCustomer',
+      errorMessage: 'portal:meld:createCustomerError',
+      resultMessage: 'portal:meld:createCustomerResult',
+      data,
+    })
+  }
+
+  public async meldSearchCustomer(): Promise<MeldSearchCustomerResponse> {
+    return this.handleRequestToIframeAndPost({
+      methodMessage: 'portal:meld:searchCustomer',
+      errorMessage: 'portal:meld:searchCustomerError',
+      resultMessage: 'portal:meld:searchCustomerResult',
       data: {},
     })
   }
 
+  public async meldGetRetailQuote(
+    data: MeldGetRetailQuoteRequest,
+  ): Promise<MeldGetRetailQuoteResponse> {
+    return this.handleRequestToIframeAndPost({
+      methodMessage: 'portal:meld:getRetailQuote',
+      errorMessage: 'portal:meld:getRetailQuoteError',
+      resultMessage: 'portal:meld:getRetailQuoteResult',
+      data,
+    })
+  }
+
+  public async meldCreateRetailWidget(
+    data: MeldCreateRetailWidgetRequest,
+  ): Promise<MeldCreateRetailWidgetResponse> {
+    return this.handleRequestToIframeAndPost({
+      methodMessage: 'portal:meld:createRetailWidget',
+      errorMessage: 'portal:meld:createRetailWidgetError',
+      resultMessage: 'portal:meld:createRetailWidgetResult',
+      data,
+    })
+  }
+
+  public async meldSearchRetailTransactions(
+    data?: MeldSearchRetailTransactionsParams,
+  ): Promise<MeldSearchRetailTransactionsResponse> {
+    return this.handleRequestToIframeAndPost({
+      methodMessage: 'portal:meld:searchRetailTransactions',
+      errorMessage: 'portal:meld:searchRetailTransactionsError',
+      resultMessage: 'portal:meld:searchRetailTransactionsResult',
+      data,
+    })
+  }
+
+  public async meldGetRetailTransactionBySession(
+    sessionId: string,
+  ): Promise<MeldGetRetailTransactionResponse> {
+    return this.handleRequestToIframeAndPost({
+      methodMessage: 'portal:meld:getRetailTransactionBySession',
+      errorMessage: 'portal:meld:getRetailTransactionBySessionError',
+      resultMessage: 'portal:meld:getRetailTransactionBySessionResult',
+      data: sessionId,
+    })
+  }
+
+  public async meldGetRetailTransaction(
+    id: string,
+  ): Promise<MeldGetRetailTransactionResponse> {
+    return this.handleRequestToIframeAndPost({
+      methodMessage: 'portal:meld:getRetailTransaction',
+      errorMessage: 'portal:meld:getRetailTransactionError',
+      resultMessage: 'portal:meld:getRetailTransactionResult',
+      data: id,
+    })
+  }
+
+  public async meldGetServiceProviders(
+    data?: MeldDiscoveryParams,
+  ): Promise<MeldGetServiceProvidersResponse> {
+    return this.handleRequestToIframeAndPost({
+      methodMessage: 'portal:meld:getServiceProviders',
+      errorMessage: 'portal:meld:getServiceProvidersError',
+      resultMessage: 'portal:meld:getServiceProvidersResult',
+      data: data ?? {},
+    })
+  }
+
+  public async meldGetCountries(
+    data?: MeldDiscoveryParams,
+  ): Promise<MeldGetCountriesResponse> {
+    return this.handleRequestToIframeAndPost({
+      methodMessage: 'portal:meld:getCountries',
+      errorMessage: 'portal:meld:getCountriesError',
+      resultMessage: 'portal:meld:getCountriesResult',
+      data: data ?? {},
+    })
+  }
+
+  public async meldGetFiatCurrencies(
+    data?: MeldDiscoveryParams,
+  ): Promise<MeldGetFiatCurrenciesResponse> {
+    return this.handleRequestToIframeAndPost({
+      methodMessage: 'portal:meld:getFiatCurrencies',
+      errorMessage: 'portal:meld:getFiatCurrenciesError',
+      resultMessage: 'portal:meld:getFiatCurrenciesResult',
+      data: data ?? {},
+    })
+  }
+
+  public async meldGetCryptoCurrencies(
+    data?: MeldDiscoveryParams,
+  ): Promise<MeldGetCryptoCurrenciesResponse> {
+    return this.handleRequestToIframeAndPost({
+      methodMessage: 'portal:meld:getCryptoCurrencies',
+      errorMessage: 'portal:meld:getCryptoCurrenciesError',
+      resultMessage: 'portal:meld:getCryptoCurrenciesResult',
+      data: data ?? {},
+    })
+  }
+
+  public async meldGetPaymentMethods(
+    data?: MeldDiscoveryParams,
+  ): Promise<MeldGetPaymentMethodsResponse> {
+    return this.handleRequestToIframeAndPost({
+      methodMessage: 'portal:meld:getPaymentMethods',
+      errorMessage: 'portal:meld:getPaymentMethodsError',
+      resultMessage: 'portal:meld:getPaymentMethodsResult',
+      data: data ?? {},
+    })
+  }
+
+  public async meldGetDefaults(
+    data?: MeldDiscoveryParams,
+  ): Promise<MeldGetDefaultsResponse> {
+    return this.handleRequestToIframeAndPost({
+      methodMessage: 'portal:meld:getDefaults',
+      errorMessage: 'portal:meld:getDefaultsError',
+      resultMessage: 'portal:meld:getDefaultsResult',
+      data: data ?? {},
+    })
+  }
+
+  public async meldGetBuyLimits(
+    data?: MeldDiscoveryParams,
+  ): Promise<MeldGetBuyLimitsResponse> {
+    return this.handleRequestToIframeAndPost({
+      methodMessage: 'portal:meld:getBuyLimits',
+      errorMessage: 'portal:meld:getBuyLimitsError',
+      resultMessage: 'portal:meld:getBuyLimitsResult',
+      data: data ?? {},
+    })
+  }
+
+  public async meldGetSellLimits(
+    data?: MeldDiscoveryParams,
+  ): Promise<MeldGetSellLimitsResponse> {
+    return this.handleRequestToIframeAndPost({
+      methodMessage: 'portal:meld:getSellLimits',
+      errorMessage: 'portal:meld:getSellLimitsError',
+      resultMessage: 'portal:meld:getSellLimitsResult',
+      data: data ?? {},
+    })
+  }
+
+  public async meldGetKycLimits(
+    data?: MeldDiscoveryParams,
+  ): Promise<MeldGetKycLimitsResponse> {
+    return this.handleRequestToIframeAndPost({
+      methodMessage: 'portal:meld:getKycLimits',
+      errorMessage: 'portal:meld:getKycLimitsError',
+      resultMessage: 'portal:meld:getKycLimitsResult',
+      data: data ?? {},
+    })
+  }
+
   public async getSwapsQuoteV2(
     data: ZeroExQuoteRequest,
     options?: ZeroExOptions,
@@ -1203,6 +1402,16 @@ class Mpc {
     traceId?: string
   }): Promise<ResponseType> {
     // Single traceId per operation: use provided or generate. Propagates to iframe and all internal REST/MPC calls.
+    if (
+      !providedTraceId &&
+      (methodMessage.startsWith('portal:wasm:') ||
+        methodMessage.startsWith('portal:mpc:') ||
+        methodMessage.startsWith('portal:accountAbstraction:'))
+    ) {
+      sdkLogger.debug(
+        `[Portal] No traceId propagated to handleRequestToIframeAndPost for method=${methodMessage}; generating a new one.`,
+      )
+    }
     const traceId = providedTraceId ?? generateTraceId()
     sdkLogger.debug(
       '[Portal] request traceId:',
@@ -1490,6 +1699,41 @@ class Mpc {
         const address = await this.getAddress()
         this.portal.address = address
 
+        // Detect if wallet shares were cleared from storage (e.g., Safari ITP).
+        // Must be awaited before triggerReady so the event fires before app callbacks run.
+        try {
+          const [client, shares] = await Promise.all([
+            this.getClient(),
+            this.checkSharesOnDevice(),
+          ])
+          const completedWallets = client.wallets.filter((w) =>
+            w.signingSharePairs.some((sp) => sp.status === 'completed'),
+          )
+          const requiredCurves = completedWallets.map((w) => w.curve)
+          const walletOnDevice =
+            requiredCurves.length > 0 &&
+            requiredCurves.every(
+              (curve) => !!shares[curve as keyof SharesOnDeviceResponse],
+            )
+          // No completed wallets means the user is in initial setup — no prior
+          // device state to have been lost.
+          const isInitialSetup = completedWallets.length === 0
+          const shouldEmitWalletNotOnDevice =
+            !isInitialSetup && !walletOnDevice && !client.ejectedAt
+          if (shouldEmitWalletNotOnDevice) {
+            const isBackedUp = client.wallets.some((w) =>
+              w.backupSharePairs.some((bp) => bp.status === 'completed'),
+            )
+            this.portal.triggerWalletNotOnDevice({
+              clientId: client.id,
+              isBackedUp,
+              reason: 'storage_cleared',
+            })
+          }
+        } catch (detectionError) {
+          sdkLogger.warn('[Portal] walletNotOnDevice detection failed (initialization continues):', detectionError)
+        }
+
         // Trigger the ready callback
         this.portal.triggerReady()
       }

package/src/provider/index.test.ts

@@ -869,6 +869,169 @@ describe('Provider', () => {
           )
         })
       })
+
+      describe('tron_signTypedData', () => {
+        const mockTypedData = {
+          domain: { name: 'Permit2', version: '1', chainId: 3448148188 },
+          types: {
+            TokenPermissions: [
+              { name: 'token', type: 'address' },
+              { name: 'amount', type: 'uint256' },
+            ],
+          },
+          value: { token: 'TXYZopYRdj2D9XRtbG411XZZ3kM5VkAeBf', amount: '1000000' },
+        }
+
+        it('should throw an error if no chainId is provided alongside tron_signTypedData', async () => {
+          await expect(
+            provider.request({
+              method: RequestMethod.tron_signTypedData,
+              params: [mockTypedData],
+            }),
+          ).rejects.toThrow(
+            new Error(
+              '[PortalProvider] Chain ID is required for the operation',
+            ),
+          )
+        })
+
+        it('should throw an error if malformed chainId is provided alongside tron_signTypedData', async () => {
+          const chainId = 'unsupported:chain'
+          await expect(
+            provider.request({
+              chainId,
+              method: RequestMethod.tron_signTypedData,
+              params: [mockTypedData],
+            }),
+          ).rejects.toThrow(
+            new Error(
+              `[PortalProvider] Chain ID must be prefixed with "tron:" for the operation, got ${chainId}`,
+            ),
+          )
+        })
+
+        it('should successfully handle a tron_signTypedData request with object params', async () => {
+          const result = await provider.request({
+            chainId: 'tron:nile',
+            method: RequestMethod.tron_signTypedData,
+            params: [mockTypedData],
+          })
+
+          expect(result).toEqual(mockSignedHash)
+          expect(portal.mpc.sign).toHaveBeenCalledWith({
+            chainId: 'tron:nile',
+            method: RequestMethod.tron_signTypedData,
+            params: JSON.stringify(mockTypedData),
+            rpcUrl: '',
+            sponsorGas: undefined,
+            traceId: 'mock-trace-id-12345',
+          })
+          expect(provider.emit).toHaveBeenCalledWith(
+            'portal_signatureReceived',
+            {
+              chainId: 'tron:nile',
+              method: RequestMethod.tron_signTypedData,
+              params: [mockTypedData],
+              signature: result,
+            },
+          )
+        })
+
+        it('should successfully handle a tron_signTypedData request with pre-stringified params', async () => {
+          const stringifiedData = JSON.stringify(mockTypedData)
+          const result = await provider.request({
+            chainId: 'tron:nile',
+            method: RequestMethod.tron_signTypedData,
+            params: [stringifiedData],
+          })
+
+          expect(result).toEqual(mockSignedHash)
+          expect(portal.mpc.sign).toHaveBeenCalledWith({
+            chainId: 'tron:nile',
+            method: RequestMethod.tron_signTypedData,
+            params: stringifiedData,
+            rpcUrl: '',
+            sponsorGas: undefined,
+            traceId: 'mock-trace-id-12345',
+          })
+        })
+
+        it('should throw if params is an invalid JSON string', async () => {
+          await expect(
+            provider.request({
+              chainId: 'tron:nile',
+              method: RequestMethod.tron_signTypedData,
+              params: ['not valid json {'],
+            }),
+          ).rejects.toThrow(
+            '[PortalProvider] tron_signTypedData params must be valid JSON',
+          )
+        })
+
+        it('should throw if object params is missing "domain"', async () => {
+          const { domain: _omitted, ...withoutDomain } = mockTypedData
+          await expect(
+            provider.request({
+              chainId: 'tron:nile',
+              method: RequestMethod.tron_signTypedData,
+              params: [withoutDomain],
+            }),
+          ).rejects.toThrow(
+            '[PortalProvider] tron_signTypedData params must include "domain", "types", and "value"',
+          )
+        })
+
+        it('should throw if object params is missing "types"', async () => {
+          const { types: _omitted, ...withoutTypes } = mockTypedData
+          await expect(
+            provider.request({
+              chainId: 'tron:nile',
+              method: RequestMethod.tron_signTypedData,
+              params: [withoutTypes],
+            }),
+          ).rejects.toThrow(
+            '[PortalProvider] tron_signTypedData params must include "domain", "types", and "value"',
+          )
+        })
+
+        it('should throw if object params is missing "value"', async () => {
+          const { value: _omitted, ...withoutValue } = mockTypedData
+          await expect(
+            provider.request({
+              chainId: 'tron:nile',
+              method: RequestMethod.tron_signTypedData,
+              params: [withoutValue],
+            }),
+          ).rejects.toThrow(
+            '[PortalProvider] tron_signTypedData params must include "domain", "types", and "value"',
+          )
+        })
+
+        it('should throw if pre-stringified params is missing "types"', async () => {
+          const { types: _omitted, ...withoutTypes } = mockTypedData
+          await expect(
+            provider.request({
+              chainId: 'tron:nile',
+              method: RequestMethod.tron_signTypedData,
+              params: [JSON.stringify(withoutTypes)],
+            }),
+          ).rejects.toThrow(
+            '[PortalProvider] tron_signTypedData params must include "domain", "types", and "value"',
+          )
+        })
+
+        it('should not require an rpcUrl (sends empty string)', async () => {
+          await provider.request({
+            chainId: 'tron:nile',
+            method: RequestMethod.tron_signTypedData,
+            params: [mockTypedData],
+          })
+
+          expect(portal.mpc.sign).toHaveBeenCalledWith(
+            expect.objectContaining({ rpcUrl: '' }),
+          )
+        })
+      })
     })
 
     describe('Signer methods without auto-approval', () => {
@@ -1655,6 +1818,76 @@ describe('Provider', () => {
           )
         })
       })
+
+      describe('tron_signTypedData', () => {
+        const mockTypedData = {
+          domain: { name: 'Permit2', version: '1', chainId: 3448148188 },
+          types: {
+            TokenPermissions: [
+              { name: 'token', type: 'address' },
+              { name: 'amount', type: 'uint256' },
+            ],
+          },
+          value: { token: 'TXYZopYRdj2D9XRtbG411XZZ3kM5VkAeBf', amount: '1000000' },
+        }
+
+        it('should successfully handle an approved tron_signTypedData request', async () => {
+          provider.on('portal_signingRequested', () => {
+            provider.emit('portal_signingApproved', {
+              method: RequestMethod.tron_signTypedData,
+              params: [mockTypedData],
+            })
+          })
+          const result = await provider.request({
+            chainId: 'tron:nile',
+            method: RequestMethod.tron_signTypedData,
+            params: [mockTypedData],
+          })
+
+          expect(mockSigningRequestedHandler).toHaveBeenCalledWith({
+            method: RequestMethod.tron_signTypedData,
+            params: [mockTypedData],
+          })
+          expect(result).toEqual(mockSignedHash)
+          expect(portal.mpc.sign).toHaveBeenCalledWith({
+            chainId: 'tron:nile',
+            method: RequestMethod.tron_signTypedData,
+            params: JSON.stringify(mockTypedData),
+            rpcUrl: '',
+            sponsorGas: undefined,
+            traceId: 'mock-trace-id-12345',
+          })
+          expect(mockSignatureReceivedHandler).toHaveBeenCalledWith({
+            chainId: 'tron:nile',
+            method: RequestMethod.tron_signTypedData,
+            params: [mockTypedData],
+            signature: result,
+          })
+        })
+
+        it('should successfully handle a rejected tron_signTypedData request', async () => {
+          provider.on('portal_signingRequested', () => {
+            provider.emit('portal_signingRejected', {
+              method: RequestMethod.tron_signTypedData,
+              params: [mockTypedData],
+            })
+          })
+
+          const result = await provider.request({
+            chainId: 'tron:nile',
+            method: RequestMethod.tron_signTypedData,
+            params: [mockTypedData],
+          })
+          expect(mockSigningRequestedHandler).toHaveBeenCalledWith({
+            method: RequestMethod.tron_signTypedData,
+            params: [mockTypedData],
+          })
+          expect(result).toEqual(undefined)
+          expect(mockConsoleWarn).toHaveBeenCalledWith(
+            "[PortalProvider] Request for signing method 'tron_signTypedData' could not be completed because it was not approved by the user.",
+          )
+        })
+      })
     })
 
     describe('Non-signer methods', () => {

package/src/provider/index.ts

@@ -3,6 +3,7 @@ import { ProviderRpcError, RpcErrorCodes } from './errors'
 import Portal from '../index'
 import { sdkLogger } from '../logger'
 import { generateTraceId, X_PORTAL_TRACE_ID_HEADER } from '../shared/trace'
+import { isPortalHostedUrl } from '../shared/rpc/auth'
 
 import type {
   EventHandler,
@@ -137,6 +138,7 @@ export enum RequestMethod {
 
   // TRON Wallet Methods
   tron_sendTransaction = 'tron_sendTransaction',
+  tron_signTypedData = 'tron_signTypedData',
 }
 
 const passiveSignerMethods = [
@@ -161,6 +163,7 @@ const signerMethods = [
   RequestMethod.sol_signMessage,
   RequestMethod.sol_signTransaction,
   RequestMethod.tron_sendTransaction,
+  RequestMethod.tron_signTypedData,
 ]
 
 const iframeProxiedMethodStrings: string[] = [
@@ -450,6 +453,8 @@ class Provider {
       )
     }
 
+    const rpcUrl = this.portal.getRpcUrl(chainId)
+
     const requestBody = {
       body: JSON.stringify({
         jsonrpc: '2.0',
@@ -460,11 +465,22 @@ class Provider {
       method: 'POST',
       headers: {
         'Content-Type': 'application/json',
+        // Portal's /rpc gateway authenticates via `Authorization: Bearer <token>`.
+        // It accepts two credential types (backend middleware: clientAuthMiddleware):
+        //   • apiKey  — ClientApiKey: persistent, no expiry. Preferred when set.
+        //   • authToken — ClientSessionToken: short-lived, auto-refreshing.
+        // Both grant identical permissions at the RPC layer.
+        // The distinction (apiKey-only for /service MPC routes) does not apply here.
+        // Header is injected only for Portal-owned hostnames to prevent credential
+        // leakage to third-party RPC providers.
+        ...(isPortalHostedUrl(rpcUrl) && (this.portal.apiKey ?? this.portal.authToken)
+          ? { Authorization: `Bearer ${this.portal.apiKey ?? this.portal.authToken}` }
+          : {}),
         ...(traceId && { [X_PORTAL_TRACE_ID_HEADER]: traceId }),
       },
     }
 
-    const result = await fetch(this.portal.getRpcUrl(chainId), requestBody)
+    const result = await fetch(rpcUrl, requestBody)
 
     return result.json()
   }
@@ -559,6 +575,22 @@ class Provider {
         })
         return result
       }
+      case RequestMethod.tron_signTypedData: {
+        this.enforceTronChainId(chainId)
+        const result = await this.portal.mpc.sign({
+          chainId: chainId as string,
+          method,
+          params: this.buildParams(method, params),
+          // tron_signTypedData is a sign-only method; MPC does not require an RPC client for it
+          rpcUrl: '',
+          sponsorGas,
+          traceId,
+          ...(signatureApprovalMemo !== undefined && {
+            signatureApprovalMemo,
+          }),
+        })
+        return result
+      }
       default:
         throw new Error(
           '[PortalProvider] Method "' + method + '" not supported',
@@ -618,6 +650,37 @@ class Provider {
           params = [txParams]
         }
         break
+      case RequestMethod.tron_signTypedData: {
+        const data = Array.isArray(txParams) ? txParams[0] : txParams
+        let parsed: unknown
+        if (typeof data === 'string') {
+          try {
+            parsed = JSON.parse(data)
+          } catch {
+            throw new Error(
+              '[PortalProvider] tron_signTypedData params must be valid JSON',
+            )
+          }
+          params = data
+        } else {
+          parsed = data
+          params = JSON.stringify(data, (_key, value) =>
+            typeof value === 'bigint' ? value.toString() : value,
+          )
+        }
+        if (
+          typeof parsed !== 'object' ||
+          parsed === null ||
+          !('domain' in parsed) ||
+          !('types' in parsed) ||
+          !('value' in parsed)
+        ) {
+          throw new Error(
+            '[PortalProvider] tron_signTypedData params must include "domain", "types", and "value"',
+          )
+        }
+        break
+      }
       default:
         if (Array.isArray(txParams)) {
           params = txParams[0]