@vue-solana/core 4.0.0-rc.0 → 4.0.0

package/README.md

@@ -7,6 +7,16 @@
 
 Framework-agnostic Solana primitives for Vue Solana libraries and apps that want shared RPC, wallet, and transaction helpers without installing a Vue plugin.
 
+## Related packages
+
+This package is part of the Vue Solana family. Choose based on your app framework:
+
+- [`@vue-solana/core`](https://www.npmjs.com/package/@vue-solana/core) — framework-agnostic Solana primitives: Kit RPC client helpers, wallet types, Android MWA registration, iOS browser wallet helpers, message signing, token account reads, and transaction helpers. **Use this directly** when you want shared RPC/wallet/transaction helpers without installing a Vue plugin (non-Vue apps, server/relayer code, or your own framework integration).
+- [`@vue-solana/vue`](https://www.npmjs.com/package/@vue-solana/vue) — Vue 3 plugin plus composables for RPC, account, balance, wallet, message signing, live data, and transactions. **Use this** in plain Vue 3 apps (Vite, etc.).
+- [`@vue-solana/nuxt`](https://www.npmjs.com/package/@vue-solana/nuxt) — Nuxt module that installs the Vue plugin and auto-imports the composables. **Use this** in Nuxt 3/4 apps.
+
+This package (`@vue-solana/core`) is the foundation the other two build on; most apps should install `@vue-solana/vue` or `@vue-solana/nuxt` rather than this package directly.
+
 Use this package directly when you want Kit RPC client helpers, shared wallet types, Android Mobile Wallet Adapter registration helpers, message signing support, token account reads, and transaction helpers without installing the Vue plugin.
 
 `@vue-solana/core` builds on `@solana/kit`. It exposes `createSolanaClient()` and re-exports all of `@solana/kit` from `@vue-solana/core/kit`. The legacy `@solana/web3-compat` surface and the `web3` subpaths were removed in v2.0.0; transactions flow through the packages as raw `Uint8Array` wire bytes.
@@ -185,6 +195,7 @@ The client-sent API is the official Kit `ClientWithTransactionSending` capabilit
 | `getSolanaIosWallets(options?)` | Builds iOS browser wallet entries (Phantom, Solflare, Backpack) as universal links. |
 | `handleSolanaIosWalletCallback()` | Completes a pending iOS wallet deep-link callback after redirect. |
 | `adaptSolanaStandardWallet(wallet)` | Adapts a Solana Wallet Standard wallet into `SolanaWallet`. |
+| `disconnectSolanaStandardWallet(walletInfo)` | Disconnects a discovered Wallet Standard wallet through its own `standard:disconnect` feature, without adapting it. Resolves `false` if the wallet has no disconnect feature, and ignores failures after a 2 s timeout. |
 | `getRegisteredSolanaWallets()` | Returns the Wallet Standard wallets currently registered in the app. |
 | `withTimeout(promise, timeoutMs, options?)` | Races a promise against a timeout, with optional abort signal. |
 | `withSolanaTimeout(promise, timeoutMs, options?)` | Solana-specific timeout wrapper with abort and error-code support. |
@@ -210,7 +221,7 @@ const wallet: SolanaWallet = {
 
 Browser extension wallets discovered through the Solana Wallet Standard are adapted into `SolanaWallet`. Android Mobile Wallet Adapter is registered through `@solana-mobile/wallet-standard-mobile` and then adapted through the same Wallet Standard adapter on supported Android Chrome clients. iOS browser wallet entries for Phantom, Solflare, and Backpack are adapted through wallet-specific universal links. Wallet capability metadata exposes whether each wallet supports message signing, transaction signing, and sign-and-send flows. You can also provide a custom object that implements `SolanaWallet` for tests or custom adapters.
 
-The Wallet Standard adapter verifies the signature a wallet returns from `signMessage` / `signIn` against the account's public key before resolving, where Ed25519 (WebCrypto) is available. A signature over the wrong bytes or from a different account rejects with `INVALID_SIGNATURE`. This is a best-effort, client-side guard — it is skipped where Ed25519 is unavailable — so server-side verification remains mandatory for auth flows.
+The Wallet Standard adapter verifies the signature a wallet returns from `signMessage` / `signIn` against the account's public key before resolving, where Ed25519 (WebCrypto) is available. A signature over the wrong bytes or from a different account rejects with `INVALID_SIGNATURE`. `signIn` also binds the result to the requested account (or active account) and rejects if the account is absent from `wallet.accounts`. This is a best-effort, client-side guard — a malformed signature is rejected even if Ed25519 verification is unavailable, but full verification is skipped where Ed25519 is unavailable — so server-side verification remains mandatory for auth flows. Connecting a wallet disconnects every other discovered wallet (swept over discovery, uncached wallets disconnected via `standard:disconnect`), so only one wallet stays authorized.
 
 Current wallet support:
 

package/dist/errors.d.ts

@@ -1,4 +1,4 @@
-type SolanaErrorCode = "NO_WALLET_SELECTED" | "WALLET_NOT_CONNECTED" | "WALLET_FEATURE_UNSUPPORTED" | "USER_REJECTED" | "INVALID_ADDRESS" | "TRANSACTION_TIMEOUT" | "TRANSACTION_NOT_FOUND" | "TRANSACTION_FAILED" | "RPC_FAILURE" | "STORAGE_FAILURE" | "INVALID_INPUT" | "DECRYPTION_FAILED" | "REDIRECT_TIMEOUT" | "MISSING_CLIENT_CAPABILITY" | "INVALID_SIGNATURE";
+type SolanaErrorCode = "NO_WALLET_SELECTED" | "WALLET_NOT_CONNECTED" | "WALLET_FEATURE_UNSUPPORTED" | "WALLET_FAILURE" | "USER_REJECTED" | "INVALID_ADDRESS" | "TRANSACTION_TIMEOUT" | "TRANSACTION_NOT_FOUND" | "TRANSACTION_FAILED" | "RPC_FAILURE" | "STORAGE_FAILURE" | "INVALID_INPUT" | "DECRYPTION_FAILED" | "REDIRECT_TIMEOUT" | "MISSING_CLIENT_CAPABILITY" | "INVALID_SIGNATURE";
 interface SolanaErrorOptions {
     cause?: unknown;
     feature?: string;

package/dist/index.d.ts

@@ -9,6 +9,6 @@ export { confirmTransactionSignature, signAndSendTransaction } from './transacti
 export { WithTimeoutOptions, withSolanaTimeout, withTimeout } from './timeout.js';
 export { SolanaWalletError, SolanaWalletErrorCode, assertWalletCanSign, assertWalletCanSignAndSendTransactions, assertWalletCanSignIn, assertWalletCanSignMessage, assertWalletCanSignTransactions, assertWalletConnected, createNoWalletSelectedError, isWalletConnected } from './wallet.js';
 export * from '@solana/kit';
-export { AdaptSolanaWalletOptions, AdaptedSolanaWallet, SOLANA_CHAINS, SOLANA_MOBILE_WALLET_ADAPTER_WALLET_NAME, adaptSolanaStandardWallet, getRegisteredSolanaWallets, getSolanaChain, isSolanaStandardWallet, subscribeSolanaWallets } from './wallet-standard.js';
+export { AdaptSolanaWalletOptions, AdaptedSolanaWallet, SOLANA_CHAINS, SOLANA_MOBILE_WALLET_ADAPTER_WALLET_NAME, adaptSolanaStandardWallet, disconnectSolanaStandardWallet, getRegisteredSolanaWallets, getSolanaChain, isSolanaStandardWallet, subscribeSolanaWallets } from './wallet-standard.js';
 import '@solana/kit-plugin-rpc';
 import '@wallet-standard/base';

package/dist/index.mjs

@@ -9,4 +9,4 @@ export { confirmTransactionSignature, signAndSendTransaction } from './transacti
 export { withSolanaTimeout, withTimeout } from './timeout.mjs';
 export { SolanaWalletError, assertWalletCanSign, assertWalletCanSignAndSendTransactions, assertWalletCanSignIn, assertWalletCanSignMessage, assertWalletCanSignTransactions, assertWalletConnected, createNoWalletSelectedError, isWalletConnected } from './wallet.mjs';
 export * from '@solana/kit';
-export { S as SOLANA_CHAINS, a as SOLANA_MOBILE_WALLET_ADAPTER_WALLET_NAME, b as adaptSolanaStandardWallet, g as getRegisteredSolanaWallets, c as getSolanaChain, i as isSolanaStandardWallet, s as subscribeSolanaWallets } from './shared/core.BlqTJRXd.mjs';
+export { S as SOLANA_CHAINS, a as SOLANA_MOBILE_WALLET_ADAPTER_WALLET_NAME, b as adaptSolanaStandardWallet, d as disconnectSolanaStandardWallet, g as getRegisteredSolanaWallets, c as getSolanaChain, i as isSolanaStandardWallet, s as subscribeSolanaWallets } from './shared/core.A4I__4IR.mjs';

package/dist/ios-wallet.mjs

@@ -1,4 +1,4 @@
-import { createSolanaError } from './errors.mjs';
+import { createSolanaError, normalizeSolanaError } from './errors.mjs';
 import { getBase58Encoder, getBase58Decoder, isAddress } from '@solana/kit';
 import * as naclModule from 'tweetnacl';
 
@@ -359,17 +359,23 @@ function handleSolanaIosWalletCallback(options = {}) {
   if (errorCode || errorMessage) {
     clearPendingRequest();
     cleanCallbackUrl(url, options.clearUrl);
-    throw new Error(errorMessage || `iOS wallet request failed: ${errorCode}`);
+    throw normalizeSolanaError(
+      new Error(errorMessage || `iOS wallet request failed: ${errorCode}`),
+      "WALLET_FAILURE"
+    );
   }
   const pending = getPendingRequest();
   if (!pending) {
     cleanCallbackUrl(url, options.clearUrl);
-    throw new Error("Received an iOS wallet callback without a pending request");
+    throw createSolanaError(
+      "INVALID_INPUT",
+      "Received an iOS wallet callback without a pending request"
+    );
   }
   if (isPendingRequestExpired(pending)) {
     clearPendingRequest();
     cleanCallbackUrl(url, options.clearUrl);
-    throw new Error("Received an expired iOS wallet callback");
+    throw createSolanaError("REDIRECT_TIMEOUT", "Received an expired iOS wallet callback");
   }
   const definition = getIosWalletDefinitionById(pending.walletId);
   const walletEncryptionPublicKey = url.searchParams.get(definition.encryptionPublicKeyParam);
@@ -378,7 +384,7 @@ function handleSolanaIosWalletCallback(options = {}) {
   if (!nonce || !data) {
     clearPendingRequest();
     cleanCallbackUrl(url, options.clearUrl);
-    throw new Error("Received an incomplete iOS wallet callback");
+    throw createSolanaError("INVALID_INPUT", "Received an incomplete iOS wallet callback");
   }
   try {
     const sharedSecret = getSharedSecret(
@@ -389,7 +395,10 @@ function handleSolanaIosWalletCallback(options = {}) {
     const result = createCallbackResult(pending, payload);
     if (pending.method === "connect") {
       if (!walletEncryptionPublicKey) {
-        throw new Error("iOS wallet connect callback did not include an encryption public key");
+        throw createSolanaError(
+          "DECRYPTION_FAILED",
+          "iOS wallet connect callback did not include an encryption public key"
+        );
       }
       const publicKey = getPublicKeyField(payload, "public_key");
       storeSession({
@@ -428,10 +437,14 @@ function createCallbackResult(pending, payload) {
   if (pending.method === "signAllTransactions") {
     const transactions = payload.transactions;
     if (!Array.isArray(transactions) || transactions.some((transaction) => typeof transaction !== "string")) {
-      throw new Error("iOS wallet returned invalid signed transactions");
+      throw createSolanaError(
+        "DECRYPTION_FAILED",
+        "iOS wallet returned invalid signed transactions"
+      );
     }
     if (typeof pending.requestedTransactionCount === "number" && transactions.length !== pending.requestedTransactionCount) {
-      throw new Error(
+      throw createSolanaError(
+        "WALLET_FAILURE",
         `iOS wallet returned ${transactions.length} signed transactions for ${pending.requestedTransactionCount} requested transactions`
       );
     }
@@ -452,14 +465,17 @@ function createCallbackResult(pending, payload) {
 function getStringField(payload, field) {
   const value = payload[field];
   if (typeof value !== "string" || !value) {
-    throw new Error(`iOS wallet callback is missing ${field}`);
+    throw createSolanaError("DECRYPTION_FAILED", `iOS wallet callback is missing ${field}`);
   }
   return value;
 }
 function getPublicKeyField(payload, field) {
   const value = getStringField(payload, field);
   if (!isAddress(value)) {
-    throw new Error(`iOS wallet callback returned an invalid ${field}`);
+    throw createSolanaError(
+      "DECRYPTION_FAILED",
+      `iOS wallet callback returned an invalid ${field}`
+    );
   }
   return value;
 }

package/dist/shared/{core.BlqTJRXd.mjs → core.A4I__4IR.mjs}

@@ -5,6 +5,12 @@ import { createSolanaError } from '../errors.mjs';
 import { getWallets } from '@wallet-standard/app';
 
 async function assertWalletSignature(publicKey, signedMessage, signature, label) {
+  if (!isSignatureBytes(signature)) {
+    throw createSolanaError(
+      "INVALID_SIGNATURE",
+      `The wallet returned a malformed ${label} signature.`
+    );
+  }
   let key;
   try {
     key = await globalThis.crypto.subtle.importKey(
@@ -17,12 +23,6 @@ async function assertWalletSignature(publicKey, signedMessage, signature, label)
   } catch {
     return;
   }
-  if (!isSignatureBytes(signature)) {
-    throw createSolanaError(
-      "INVALID_SIGNATURE",
-      `The wallet returned a malformed ${label} signature.`
-    );
-  }
   let valid;
   try {
     valid = await verifySignature(key, signature, signedMessage);
@@ -149,8 +149,24 @@ function adaptSolanaStandardWallet(walletInfo, options = {}) {
         throw new Error("Solana wallet did not return a sign-in result");
       }
       const signInResult = toSolanaSignInResult(result);
+      const requestedAddress = input?.address ?? account?.address;
+      const signInAccount = accounts.find(
+        (candidate) => candidate.address === signInResult.account.address
+      );
+      if (!signInAccount) {
+        throw createSolanaError(
+          "INVALID_SIGNATURE",
+          "The wallet returned a sign-in account it does not expose."
+        );
+      }
+      if (requestedAddress !== void 0 && requestedAddress !== signInAccount.address) {
+        throw createSolanaError(
+          "INVALID_SIGNATURE",
+          `The wallet signed in as ${signInResult.account.address} instead of the requested ${requestedAddress}.`
+        );
+      }
       await assertWalletSignature(
-        signInResult.account.publicKey,
+        signInAccount.publicKey,
         signInResult.signedMessage,
         signInResult.signature,
         "sign-in"
@@ -235,6 +251,19 @@ function adaptSolanaStandardWallet(walletInfo, options = {}) {
     } : void 0
   };
 }
+async function disconnectSolanaStandardWallet(walletInfo) {
+  const wallet = walletInfo.wallet;
+  if (typeof wallet !== "object" && typeof wallet !== "function") {
+    return false;
+  }
+  const features = wallet?.features;
+  const feature = features?.[StandardDisconnect];
+  if (typeof feature?.disconnect !== "function") {
+    return false;
+  }
+  await feature.disconnect();
+  return true;
+}
 async function signAllThroughFeature(wallet, getAccount, transactions, chain) {
   const activeAccount = getAccount();
   const results = await wallet.features[SolanaSignTransaction].signTransaction(
@@ -352,4 +381,4 @@ function getWalletUrl(wallet) {
   return "url" in wallet && typeof wallet.url === "string" ? wallet.url : void 0;
 }
 
-export { SOLANA_CHAINS as S, SOLANA_MOBILE_WALLET_ADAPTER_WALLET_NAME as a, adaptSolanaStandardWallet as b, getSolanaChain as c, getRegisteredSolanaWallets as g, isSolanaStandardWallet as i, subscribeSolanaWallets as s };
+export { SOLANA_CHAINS as S, SOLANA_MOBILE_WALLET_ADAPTER_WALLET_NAME as a, adaptSolanaStandardWallet as b, getSolanaChain as c, disconnectSolanaStandardWallet as d, getRegisteredSolanaWallets as g, isSolanaStandardWallet as i, subscribeSolanaWallets as s };

package/dist/transaction.mjs

@@ -78,6 +78,9 @@ async function confirmTransactionSignature(client, signature, options = {}) {
       `Timed out waiting for transaction ${signature} to reach ${commitment} commitment.`
     );
   } catch (cause) {
+    if (abortSignal?.aborted) {
+      throw abortSignal.reason ?? cause;
+    }
     if (isAbortErrorLike(cause)) {
       throw cause;
     }

package/dist/wallet-standard.d.ts

@@ -17,6 +17,18 @@ interface AdaptedSolanaWallet extends SolanaWallet {
     dispose(): void;
 }
 declare function adaptSolanaStandardWallet(walletInfo: SolanaWalletInfo, options?: AdaptSolanaWalletOptions): AdaptedSolanaWallet;
+/**
+ * Disconnects a discovered Wallet Standard wallet without adapting it.
+ *
+ * Reads `standard:disconnect` straight off the wallet instead of going through
+ * an adapter on purpose: a wallet the app authorized in an earlier page session
+ * has no adapter yet, so an adapter-only sweep misses it, and adapting it just
+ * to disconnect would register a `change` subscription for a wallet the user
+ * never selects. Resolves `false` when the wallet exposes no disconnect feature
+ * (for example an iOS deep-link definition); rejects with the wallet's own
+ * error, so a caller sweeping a list should catch per wallet.
+ */
+declare function disconnectSolanaStandardWallet(walletInfo: SolanaWalletInfo): Promise<boolean>;
 
 declare const SOLANA_CHAINS: readonly SolanaChain[];
 declare function getSolanaChain(cluster: SolanaCluster): SolanaChain;
@@ -26,5 +38,5 @@ declare function isSolanaStandardWallet(wallet: Wallet): boolean;
 declare function getRegisteredSolanaWallets(): SolanaWalletInfo[];
 declare function subscribeSolanaWallets(listener: () => void): () => void;
 
-export { SOLANA_CHAINS, SOLANA_MOBILE_WALLET_ADAPTER_WALLET_NAME, adaptSolanaStandardWallet, getRegisteredSolanaWallets, getSolanaChain, isSolanaStandardWallet, subscribeSolanaWallets };
+export { SOLANA_CHAINS, SOLANA_MOBILE_WALLET_ADAPTER_WALLET_NAME, adaptSolanaStandardWallet, disconnectSolanaStandardWallet, getRegisteredSolanaWallets, getSolanaChain, isSolanaStandardWallet, subscribeSolanaWallets };
 export type { AdaptSolanaWalletOptions, AdaptedSolanaWallet };

package/dist/wallet-standard.mjs

@@ -1 +1 @@
-export { S as SOLANA_CHAINS, a as SOLANA_MOBILE_WALLET_ADAPTER_WALLET_NAME, b as adaptSolanaStandardWallet, g as getRegisteredSolanaWallets, c as getSolanaChain, i as isSolanaStandardWallet, s as subscribeSolanaWallets } from './shared/core.BlqTJRXd.mjs';
+export { S as SOLANA_CHAINS, a as SOLANA_MOBILE_WALLET_ADAPTER_WALLET_NAME, b as adaptSolanaStandardWallet, d as disconnectSolanaStandardWallet, g as getRegisteredSolanaWallets, c as getSolanaChain, i as isSolanaStandardWallet, s as subscribeSolanaWallets } from './shared/core.A4I__4IR.mjs';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vue-solana/core",
-  "version": "4.0.0-rc.0",
+  "version": "4.0.0",
   "description": "Framework-agnostic primitives for Vue Solana libraries.",
   "license": "MIT",
   "keywords": [