@use-glyph/sdk-react 2.1.12 → 2.2.0

package/README.md

@@ -6,9 +6,66 @@ Dashboard ⚙️: [https://useglyph.io/](https://useglyph.io/)
 
 Documentation 📝: [https://docs.useglyph.io/](https://docs.useglyph.io/)
 
-## Diagnostics
+## Wallet compatibility (2.2.0)
+
+Tested with wagmi `2.19.5`, viem `2.57.5`, RainbowKit `2.2.11`,
+Privy React `3.48.1`, Privy wagmi `4.0.19`, and Relay SDK `3.2.0`.
+Keep the app's Relay version aligned when passing `RelayChain` values to Glyph.
+Privy uses nested viem `2.56.5`; do not force a global viem override.
+
+React 18 and 19 are supported. ConnectKit `1.9.2` requires React 18.
+Dynamic's Glyph connector `4.5.0` requires cross-app-connect `0.2.3`;
+other tested adapters use cross-app-connect `0.7.3`.
+Do not force those separate adapter generations onto one version.
+
+See the integration-specific installation commands in the documentation.
+The examples cover native, Privy, RainbowKit, ConnectKit, cross-app, and Dynamic integrations.
+User login and wallet confirmation remain required; installing this SDK does not
+grant an agent permission to sign or send transactions.
+
+## Dependency security
+
+Wallet peers remain external to the SDK bundle. Compatibility is not a clean-audit
+guarantee. Audit the consuming application's resolved dependency graph, including
+its wallet adapters. Overrides in the SDK source workspace do not propagate to
+consuming applications. See the [security policy and guidance](https://github.com/yuga-labs/glyph-sdk-react/blob/main/SECURITY.md).
+Legacy Dynamic/Solana dependencies still include an unpatched `bigint-buffer`
+advisory; track its upstream replacement before enabling affected server-side code.
+
+## SDK diagnostics
 
 SDK debug and informational logs are disabled by default. Warnings and errors remain visible.
 Import `setGlyphDebugLogging` from `@use-glyph/sdk-react` and call it with `true` for temporary diagnostics.
 Call it with `false` to disable diagnostics again. Third-party wallet logging is separate.
 Authentication logs never contain signatures, tokens, nonces, or raw provider errors.
+
+## Wallet sign-in and recovery
+
+For the EIP1193 strategy, `useGlyph()` exposes `signIn(): Promise<boolean>`,
+`needsSignature`, and `authError`. Existing `login()` uses the same sign-in path.
+Call `signIn()` directly from a fresh click; do not await a fetch first. It returns
+`false` if message preparation is pending, a popup needs activation, or sign-in
+fails. Wait for `ready`, then offer another click. `askForSignature={false}` prepares
+only; it never automatically signs. A rejected or blocked attempt never starts an
+automatic signing retry loop.
+
+`onAuthError` receives only a static reason (`popup_blocked`, `rejected`,
+`verify_failed`, or `network`), message and optional `retryAt`. No alert or raw
+provider error is exposed. A 429 blocks authentication requests and signing until
+`Retry-After`; missing headers use bounded backoff. A current credential's 401
+clears that session and prepares a message for manual retry. A 403 does not log out,
+and late old responses cannot revoke replacement credentials.
+
+Persistence binds the wallet, API origin and connector family (`id`, `type`).
+Recreating wagmi configuration on reload can restore that scoped credential without
+another signature. Live callbacks also bind the connector instance (`uid`): a
+committed live scope change revokes old callbacks, forgets the old record and
+requires sign-in. Normal unmount and StrictMode replay retain persistence; explicit
+logout and external disconnect clear it. Restored credentials still face server
+session checks. Legacy unbound token/nonce records are cleared, so an existing user
+may need one new sign-in; the SDK does not guess their wallet or origin binding.
+
+Privy retains its existing login and wallet-selection behavior. Its `signIn()`
+returns `true` when the login call completes, which does not guarantee an EVM wallet
+or Glyph authentication. Check `authenticated` for wallet/API readiness. Privy
+reports `needsSignature: false` and `authError: null`.

package/dist/EIP1193Strategy.js

@@ -1,153 +1,405 @@
-import { jsx as J } from "react/jsx-runtime";
-import { useState as u, useEffect as h, useCallback as s } from "react";
-import { useAccount as R, useDisconnect as q, useSignMessage as z, useSignTypedData as H, useSendTransaction as Q, useAccountEffect as V } from "wagmi";
-import { c as X, W as A, b as Z, a as U } from "./index.js";
-const T = "__glyph-widget-token__", I = "__glyph-widget-nonce__", a = X("EIP1193Strategy"), re = ({
-  children: x,
-  glyphUrl: c,
-  onLogin: M,
-  onLogout: P,
-  askForSignature: m = !0
-}) => {
-  const [j, i] = u(!1), [L, f] = u(null), { address: t, isConnected: n, chainId: _ } = R(), { disconnectAsync: v } = q(), { signMessageAsync: y } = z(), { signTypedDataAsync: k } = H(), { sendTransactionAsync: C } = Q(), [l, p] = u(() => {
-    if (typeof window > "u")
-      return null;
+import { jsx as U } from "react/jsx-runtime";
+import { useRef as O, useMemo as q, useSyncExternalStore as z, useEffect as W, useCallback as D } from "react";
+import { useAccount as $, useDisconnect as B, useSignMessage as K, useSignTypedData as X, useSendTransaction as H, useAccountEffect as Q } from "wagmi";
+import { c as V, g as Y, G as Z, W as ee, b as te } from "./index.js";
+class v extends Error {
+  constructor(n, a, s) {
+    super(a), this.reason = n, this.retryAfterMs = s;
+  }
+  reason;
+  retryAfterMs;
+}
+function re(t) {
+  try {
+    const n = new URL(t);
+    return ["http:", "https:"].includes(n.protocol) && !n.username && !n.password ? n.origin : null;
+  } catch {
+    return null;
+  }
+}
+function j() {
+  return typeof navigator > "u" ? !1 : navigator.userActivation?.isActive ?? !0;
+}
+function ne(t) {
+  try {
+    let n = t;
+    for (let a = 0; n && a < 5; a++) {
+      const s = n, c = [s.message, s.details].filter((f) => typeof f == "string").map((f) => f.slice(0, 4096)).join(" ");
+      if (s.code === 4001 || /user (rejected|denied|cancel)/i.test(c))
+        return new v("rejected", "The signature request was rejected.");
+      if (/failed to initialize request|popup.*block|pop-up.*block/i.test(c))
+        return new v("popup_blocked", "Open sign-in from a click to allow the wallet popup.");
+      n = s.cause;
+    }
+  } catch {
+  }
+  return new v("network", "The signature request failed.");
+}
+async function ae(t, n, a) {
+  if (t.status === 429) {
+    const u = t.headers.get("Retry-After");
+    t.body?.cancel().catch(() => {
+    });
+    const S = u?.trim() ? Number(u) : NaN, E = u ? Date.parse(u) : NaN, k = Number.isFinite(S) && S >= 0 ? S * 1e3 : Number.isFinite(E) ? Math.max(0, E - Date.now()) : 0;
+    throw new v(
+      "network",
+      "Sign-in is rate limited. Try again later.",
+      Number.isSafeInteger(k) && k > 0 ? k : 0
+    );
+  }
+  if (!t.ok)
+    throw t.body?.cancel().catch(() => {
+    }), new v(n, "The authentication request was rejected.");
+  const s = t.body?.getReader();
+  if (!s) throw new v(n, "The authentication response was invalid.");
+  const c = () => {
+    s.cancel().catch(() => {
+    });
+  };
+  a.addEventListener("abort", c, { once: !0 }), a.aborted && c();
+  const f = [];
+  let r = 0;
+  try {
+    for (; ; ) {
+      if (a.aborted) throw new v("network", "The authentication request timed out.");
+      const u = await s.read();
+      if (a.aborted) throw new v("network", "The authentication request timed out.");
+      if (u.done) break;
+      if (r += u.value.byteLength, r > 65536) throw new v(n, "The authentication response was invalid.");
+      f.push(u.value);
+    }
+  } finally {
+    a.removeEventListener("abort", c), c(), s.releaseLock();
+  }
+  const h = new Uint8Array(r);
+  let y = 0;
+  for (const u of f)
+    h.set(u, y), y += u.byteLength;
+  let d;
+  try {
+    d = JSON.parse(new TextDecoder("utf-8", { fatal: !0 }).decode(h));
+  } catch {
+    throw new v(n, "The authentication response was invalid.");
+  }
+  if (!d || typeof d != "object" || Array.isArray(d))
+    throw new v("network", "The authentication response was invalid.");
+  return d;
+}
+const R = (t, n) => typeof t == "string" && t.trim().length > 0 && t.length <= n;
+async function J(t, n, a, s) {
+  const c = new AbortController(), f = c.signal, r = () => c.abort();
+  a.aborted ? r() : a.addEventListener("abort", r, { once: !0 });
+  const h = performance.now(), y = setTimeout(() => c.abort(), 1e4);
+  try {
+    const d = await fetch(t, { ...n, signal: f, redirect: "error", credentials: "omit" }), u = await ae(d, s, f);
+    if (f.aborted || performance.now() - h >= 1e4)
+      throw new v("network", "The authentication request timed out.");
+    return u;
+  } finally {
+    a.removeEventListener("abort", r), clearTimeout(y), c.abort();
+  }
+}
+async function se(t, n, a) {
+  const s = await J(new URL(`/api/widget/auth/message/${n}`, t), {}, a, "network");
+  if (!R(s.message, 16384) || !R(s.nonce, 1024))
+    throw new v("network", "The sign-in message was invalid.");
+  return { message: s.message, nonce: s.nonce };
+}
+async function oe(t, n, a, s, c) {
+  const f = await J(
+    new URL(`/api/widget/auth/verify/${n}`, t),
+    {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ signature: a, nonce: s })
+    },
+    c,
+    "verify_failed"
+  );
+  if (!R(f.token, 16384))
+    throw new v("verify_failed", "Signature verification returned no token.");
+  return f.token;
+}
+function ie(t) {
+  return t instanceof v ? { reason: t.reason, message: t.message } : { reason: "network", message: "Authentication failed." };
+}
+function ce(t) {
+  let n = !1, a = 0, s = !1, c = !1, f = !1, r, h, y = 0, d = 0, u = new AbortController(), S, E;
+  const k = /* @__PURE__ */ new Set(), I = `__glyph-wallet-session-v2__:${JSON.stringify([t.origin, t.address.toLowerCase(), t.connector])}`;
+  let _ = Object.freeze({
+    generation: a,
+    ready: !1,
+    authenticated: !1,
+    needsSignature: !1,
+    authError: null,
+    apiFetch: null
+  });
+  const i = (e = a) => n && a === e && t.isCurrent(), w = (e) => {
+    _ = Object.freeze({ ..._, ...e, generation: a });
+    for (const o of k) o();
+  }, N = (e) => {
     try {
-      return localStorage.getItem(T);
+      t.storage && e(t.storage);
     } catch {
-      return a.warn("Error reading session token"), null;
     }
-  }), [g, O] = u(null), [o, w] = u(() => {
-    if (typeof window > "u")
-      return null;
+  }, x = (e) => {
     try {
-      return localStorage.getItem(I);
+      e();
     } catch {
-      return a.warn("Error reading session nonce"), null;
     }
-  });
-  h(() => {
+  }, l = (e, o) => async (b, A) => {
+    const T = () => {
+      if (!i(o) || r !== e) throw new Error("Glyph wallet session changed");
+    };
+    T();
+    let g;
     try {
-      !l || !o ? (localStorage.removeItem(T), localStorage.removeItem(I)) : (localStorage.setItem(T, l), localStorage.setItem(I, o));
+      if (g = new URL(b, t.origin), g.origin !== t.origin || g.username || g.password) throw new Error();
     } catch {
-      a.error("Error saving session token");
+      throw new Error("Unsupported Glyph request URL");
     }
-  }, [o, l]);
-  const b = s(
-    async (e) => {
+    const p = A?.signal ? AbortSignal.any([A.signal, u.signal]) : u.signal, F = await V(t.origin, void 0, {
+      Authorization: `Bearer ${e.token}`,
+      "x-evm-address": t.address,
+      "x-glyph-nonce": e.nonce
+    })(g.href, { ...A, signal: p, redirect: "error" });
+    return T(), F.status === 401 && (M(!0), P(new v("verify_failed", "The wallet session expired. Sign in again."), a), L()), F;
+  }, P = (e, o) => {
+    if (!i(o)) return;
+    let b = ie(e);
+    if (e instanceof v && e.retryAfterMs !== void 0) {
+      d++;
+      const A = e.retryAfterMs || Math.min(3e4 * 2 ** Math.min(d - 1, 5), 6e5);
+      y = Math.min(Number.MAX_SAFE_INTEGER, Date.now() + A), b = { ...b, retryAt: y };
+    }
+    w({ authError: b, needsSignature: !0 }), i(o) && x(() => t.onAuthError(b));
+  }, m = (e) => {
+    clearTimeout(E), !(!i(e) || !y) && (E = setTimeout(
+      () => {
+        i(e) && (Date.now() < y ? m(e) : (y = 0, L()));
+      },
+      Math.max(1, Math.min(2147483647, y - Date.now()))
+    ));
+  }, L = () => {
+    if (!i() || r || h || S) return S ?? Promise.resolve();
+    const e = a;
+    if (Date.now() < y)
+      return m(e), Promise.resolve();
+    if (f = !0, w({ ready: !1 }), !i(e)) return Promise.resolve();
+    const o = se(t.origin, t.address, u.signal).then((b) => {
+      i(e) && (h = b);
+    }).catch((b) => {
+      P(b, e);
+    }).finally(() => {
+      !i(e) || S !== o || (S = void 0, f = !1, w({ ready: !c, needsSignature: !r }), y && m(e));
+    });
+    return S = o, o;
+  }, M = (e) => {
+    a++, u.abort(), u = new AbortController(), clearTimeout(E), r = void 0, h = void 0, S = void 0, c = !1, f = !1, s = !0, e && N((o) => o.removeItem(I)), w({ ready: n, authenticated: !1, apiFetch: null, authError: null, needsSignature: !1 });
+  }, C = (e) => {
+    if (!i(e) || c) return Promise.resolve(!1);
+    if (s = !0, r) return Promise.resolve(!0);
+    if (Date.now() < y)
+      return w({
+        authError: { reason: "network", message: "Sign-in is rate limited. Try again later.", retryAt: y },
+        needsSignature: !0
+      }), Promise.resolve(!1);
+    if (!h)
+      return L(), w({ needsSignature: !0 }), Promise.resolve(!1);
+    if (t.popup && !(t.activation ?? j)())
+      return w({ needsSignature: !0 }), Promise.resolve(!1);
+    const o = h;
+    if (c = !0, w({ ready: !1, needsSignature: !1, authError: null }), !i(e)) return Promise.resolve(!1);
+    let b;
+    try {
+      b = t.sign(o.message);
+    } catch (A) {
+      b = Promise.reject(A);
+    }
+    return (async () => {
       try {
-        return await fetch(
-          `${c || A}/api/widget/auth/message/${e}`
-        ).then((d) => d.json());
-      } catch {
-        throw a.error("Can't fetch message to sign"), new Error("Failed to fetch the message to sign.");
+        let A;
+        try {
+          A = await b;
+        } catch (g) {
+          throw ne(g);
+        }
+        if (!i(e)) return !1;
+        const T = await oe(
+          t.origin,
+          t.address,
+          A,
+          o.nonce,
+          u.signal
+        );
+        return i(e) ? (r = { token: T, nonce: o.nonce }, d = 0, y = 0, N((g) => g.setItem(I, JSON.stringify(r))), w({ authenticated: !0, apiFetch: l(r, e), authError: null }), i(e) && x(t.onLogin), i(e) && !!r) : !1;
+      } catch (A) {
+        return i(e) && (h = void 0, r = void 0, N((T) => T.removeItem(I)), w({ authenticated: !1, apiFetch: null }), P(A, e)), !1;
+      } finally {
+        i(e) && (c = !1, w({ ready: !f, needsSignature: !r }), r || L());
       }
+    })();
+  };
+  return {
+    subscribe(e) {
+      return k.add(e), () => {
+        k.delete(e);
+      };
     },
-    [c]
-  ), D = s(
-    async (e, r, d) => {
-      try {
-        return await fetch(`${c || A}/api/widget/auth/verify/${e}`, {
-          method: "POST",
-          body: JSON.stringify({ signature: r, nonce: d })
-        }).then((B) => B.json());
-      } catch {
-        throw a.error("Can't verify signature"), new Error("Signature verification failed.");
+    getSnapshot: () => _,
+    current: i,
+    signIn: C,
+    automatic() {
+      if (!(!i() || s || !h || r || c)) {
+        if (t.popup && !(t.activation ?? j)()) {
+          s = !0, w({ needsSignature: !0 });
+          return;
+        }
+        C(a);
       }
     },
-    [c]
-  );
-  h(() => {
-    !t || !n || o || (i(!0), b(t).then(({ message: e, nonce: r }) => {
-      O(e), w(r), i(!1);
-    }).finally(() => {
-      i(!1);
-    }));
-  }, [t, n, b, o]), h(() => {
-    if (!l || !o) return;
-    const e = Z(c || A, async () => l, {
-      "x-evm-address": t,
-      "x-glyph-nonce": o
+    start() {
+      n = !0, N((e) => {
+        e.removeItem("__glyph-widget-token__"), e.removeItem("__glyph-widget-nonce__");
+        try {
+          const o = JSON.parse(e.getItem(I) ?? "null");
+          o && typeof o.token == "string" && o.token.trim() && o.token.length <= 16384 && typeof o.nonce == "string" && o.nonce.trim() && o.nonce.length <= 1024 && (r = o);
+        } catch {
+        }
+      }), w({ ready: !0, authenticated: !!r, apiFetch: r ? l(r, a) : null }), r || L();
+    },
+    stop(e = !1) {
+      const o = s;
+      n = !1, M(e), s = o;
+    },
+    logout() {
+      i() && M(!0);
+    },
+    // A replaced instance shares its family's persistence key, but no longer
+    // owns it. Committed scope cleanup already forgets the departing record.
+    forget() {
+      i() && M(!0);
+    }
+  };
+}
+const G = te("EIP1193Strategy"), ge = ({
+  children: t,
+  glyphUrl: n,
+  onLogin: a,
+  onLogout: s,
+  onAuthError: c,
+  askForSignature: f = !0
+}) => {
+  const { address: r, isConnected: h, chainId: y, connector: d } = $(), { disconnectAsync: u } = B(), { signMessageAsync: S } = K(), { signTypedDataAsync: E } = X(), { sendTransactionAsync: k } = H(), I = re(n || ee), _ = O(null), i = O({ onLogin: a, onLogout: s, onAuthError: c, signMessageAsync: S });
+  i.current = { onLogin: a, onLogout: s, onAuthError: c, signMessageAsync: S };
+  const w = O(!1), N = O(null), x = q(
+    () => ({ family: JSON.stringify([d?.id, d?.type]), uid: d?.uid }),
+    [d?.id, d?.type, d?.uid]
+  ), l = q(() => {
+    const g = ce({
+      address: r ?? "",
+      origin: I ?? "",
+      connector: x.family,
+      popup: d?.type === "privy" || d?.id === Y.id,
+      isCurrent: () => _.current === g && !!r && h && !!I,
+      sign: (p) => i.current.signMessageAsync({ account: r, message: p }),
+      onLogin: () => {
+        w.current = !1, i.current.onLogin?.();
+      },
+      onAuthError: (p) => i.current.onAuthError?.(p),
+      storage: typeof window > "u" ? void 0 : {
+        getItem: (p) => window.localStorage.getItem(p),
+        setItem: (p, F) => window.localStorage.setItem(p, F),
+        removeItem: (p) => window.localStorage.removeItem(p)
+      }
     });
-    f(() => e);
-  }, [l, t, c, o]);
-  const $ = s(async () => {
-    await v();
-  }, [v]), E = s(async () => {
-    if (a.log("authenticate"), !t) {
-      a.error("no wallet connected.");
-      return;
+    return g;
+  }, [r, h, I, x, d?.type, d?.id]);
+  _.current = l;
+  const P = h ? l : N.current;
+  h && (N.current = l);
+  const m = z(l.subscribe, l.getSnapshot, l.getSnapshot);
+  W(() => (l.start(), () => l.stop(_.current !== l)), [l]), W(() => {
+    f && l.automatic();
+  }, [l, m, f]);
+  const L = D(() => l.signIn(m.generation), [l, m.generation]), M = D(() => {
+    if (!w.current) {
+      w.current = !0;
+      try {
+        i.current.onLogout?.();
+      } catch {
+        G.error("Logout callback failed");
+      }
     }
-    try {
-      if (!t || !n || !g || !o) {
-        f(null), i(!1);
-        return;
+  }, []), C = D(async () => {
+    if (l.current(m.generation)) {
+      l.logout(), M();
+      try {
+        await u();
+      } catch {
+        G.error("Wallet disconnect failed");
       }
-      i(!0);
-      const e = await y({ account: t, message: g }), r = (await D(t, e, o))?.token;
-      p(r);
-    } catch (e) {
-      a.error("Authentication failed"), e?.message?.toLowerCase?.().includes?.("user rejected") || await alert(
-        "Authentication failed - your browser could be blocking the popups. Allow popups or try to manually click sign in."
-      ), f(null), p(null), w(null);
-    } finally {
-      i(!1), M?.();
     }
-  }, [t, n, g, o, y, D]), F = s(async () => {
-    w(null), p(null), i(!1), f(null), P?.();
-  }, []), K = s(
-    async ({ message: e }) => {
-      if (!t || !n)
-        throw new Error("Wallet not connected");
-      return y({ account: t, message: e });
-    },
-    [t, n, y]
-  ), G = s(
-    async ({ data: e }) => {
-      if (!t || !n)
-        throw new Error("Wallet not connected");
-      const r = e.types, d = e.primaryType, S = e.message;
-      return k({ types: r, primaryType: d, message: S });
+  }, [l, m.generation, M, u]);
+  Q({
+    onDisconnect: () => {
+      P?.forget(), (_.current === P || !h) && M();
+    }
+  });
+  const e = D(() => {
+    if (!l.current(m.generation)) throw new Error("Glyph wallet session changed");
+  }, [l, m.generation]), o = D(
+    async ({ message: g }) => {
+      e();
+      const p = await S({ account: r, message: g });
+      return e(), p;
     },
-    [t, n, k]
-  ), Y = s(
-    async ({ transaction: e }) => {
-      if (!t || !n) throw new Error("Wallet not connected");
-      return C({ ...e, chainId: e.chainId || _ });
+    [e, r, S]
+  ), b = D(
+    async ({ data: g }) => {
+      e();
+      const p = await E({
+        types: g.types,
+        primaryType: g.primaryType,
+        message: g.message
+      });
+      return e(), p;
     },
-    [t, n, C, _]
-  ), [N, W] = u(!1);
-  return V({
-    onConnect: () => {
-      m && W(!0);
+    [e, E]
+  ), A = D(
+    async ({ transaction: g }) => {
+      e();
+      const p = await k({
+        ...g,
+        chainId: g.chainId || y
+      });
+      return e(), p;
     },
-    onDisconnect: () => {
-      F();
-    }
-  }), h(() => {
-    m && n && t && N && o && g && (E(), W(!1));
-  }, [n, t, E, N, o, g, m]), /* @__PURE__ */ J(
-    U.Provider,
+    [e, k, y]
+  ), T = l.current(m.generation);
+  return /* @__PURE__ */ U(
+    Z.Provider,
     {
       value: {
-        ready: !j && !!o,
-        authenticated: n && !!t && l !== null,
-        glyphUrl: c,
-        // Pass as string to avoid type error (we are passing fallback value in useGlyph hook at a common place)
-        hideWidget: !n || !t,
-        login: E,
-        logout: $,
-        // on disconnect, logoutSideEffect is called and clears states
-        signMessage: K,
-        signTypedData: G,
-        sendTransaction: Y,
-        apiFetch: L
+        ready: m.ready,
+        authenticated: T && m.authenticated,
+        glyphUrl: n,
+        hideWidget: !h || !r,
+        login: L,
+        signIn: L,
+        needsSignature: T && m.needsSignature,
+        authError: T ? m.authError : null,
+        logout: C,
+        signMessage: o,
+        signTypedData: b,
+        sendTransaction: A,
+        apiFetch: T ? m.apiFetch : null
       },
-      children: x
+      children: t
     }
   );
 };
 export {
-  re as default
+  ge as default
 };
 //# sourceMappingURL=EIP1193Strategy.js.map