chore: sync from internal

Author: phantom-commit-bot[bot]

.changeset/pre.json

@@ -1,6 +1,6 @@
 {
   "name": "@phantom/mcp-server",
-  "version": "1.0.0-beta.0",
+  "version": "1.0.0",
   "description": "MCP Server for Phantom Wallet",
   "repository": {
     "type": "git",
@@ -51,7 +51,6 @@
     "@phantom/perps-client": "workspace:^",
     "@phantom/phantom-api-client": "workspace:^",
     "@phantom/sdk-types": "workspace:^",
-    "@phantom/server-sdk": "workspace:^",
     "@phantom/utils": "workspace:^",
     "@solana/spl-token": "^0.4.14",
     "@solana/web3.js": "^1.95.5",

packages/mcp-server/package.json

@@ -30,9 +30,11 @@ const mockSessionManagerInstance = {
   resetSession: jest.fn().mockResolvedValue(undefined),
   getClient: jest.fn(),
   getSession: jest.fn(),
+  getOAuthHeaders: jest.fn().mockReturnValue({}),
 };
 
 const mockSetHeaders = jest.fn();
+const mockSetGetHeaders = jest.fn();
 const mockSetPaymentHandler = jest.fn();
 
 jest.mock("@modelcontextprotocol/sdk/server/index.js", () => ({
@@ -61,6 +63,7 @@ jest.mock("@phantom/phantom-api-client", () => {
     ...actual,
     PhantomApiClient: jest.fn().mockImplementation(() => ({
       setHeaders: mockSetHeaders,
+      setGetHeaders: mockSetGetHeaders,
       setPaymentHandler: mockSetPaymentHandler,
     })),
   };
@@ -75,6 +78,7 @@ beforeEach(() => {
   mockConnect.mockClear();
   mockSetRequestHandler.mockClear();
   mockSetHeaders.mockClear();
+  mockSetGetHeaders.mockClear();
   mockSetPaymentHandler.mockClear();
   mockGetTool.mockReset();
   for (const tool of mockTools) {

packages/mcp-server/src/server.test.ts

@@ -473,6 +473,7 @@ export class PhantomMCPServer {
       staticHeaders["X-Wallet-Address"] = solanaAddress;
     }
     this.apiClient.setHeaders(staticHeaders);
+    this.apiClient.setGetHeaders(() => this.sessionManager.getOAuthHeaders());
 
     this.apiClient.setPaymentHandler(async payment => {
       this.logger.info(`Paying ${payment.amount} ${payment.token} to unlock API access`);

packages/mcp-server/src/server.ts

@@ -68,6 +68,7 @@ export class SessionManager {
 
   private session: SessionData | null = null;
   private client: PhantomClient | null = null;
+  private stamper: InstanceType<typeof Auth2Stamper> | null = null;
 
   private createMcpAnalyticsHeaders(appId: string): ServerSdkHeaders {
     return {
@@ -256,6 +257,7 @@ export class SessionManager {
     await this.clearDeviceCodeAuthState();
     this.session = null;
     this.client = null;
+    this.stamper = null;
 
     // Re-authenticate
     await this.authenticate();
@@ -427,6 +429,7 @@ export class SessionManager {
       redirectUri: "",
     });
     await stamper.init();
+    this.stamper = stamper;
     if (!stamper.bearerToken || !stamper.auth2Token) {
       this.logger.warn(
         "device-code auth2 stamper state is missing tokens — deleting stale session and re-authenticating",
@@ -455,6 +458,19 @@ export class SessionManager {
     );
   }
 
+  /**
+   * Returns dynamic OAuth headers for the current device-code session.
+   * Called on every request so the bearer token is always fresh (handles refresh).
+   * Returns an empty object for SSO sessions or when no stamper is available.
+   */
+  getOAuthHeaders(): Record<string, string | undefined> {
+    if (this.session?.authFlow !== "device-code" || !this.stamper) return {};
+    return {
+      authorization: this.stamper.bearerToken ?? undefined,
+      "x-auth-user-id": this.stamper.auth2Token?.sub,
+    };
+  }
+
   private async clearDeviceCodeAuthState(): Promise<void> {
     try {
       await new NodeFileAuth2StamperStorage(this.storage.sessionDir).clear();

packages/mcp-server/src/session/manager.ts

@@ -43,6 +43,7 @@ export class PhantomApiClient {
   private staticHeaders: Record<string, string> = {};
   private paymentSignature: string | null = null;
   private paymentHandler: PaymentHandler | null = null;
+  private getDynamicHeadersFn: (() => Record<string, string | undefined>) | null = null;
 
   constructor(options: PhantomApiClientOptions) {
     this.baseUrl = options.baseUrl.replace(/\/$/, "");
@@ -67,6 +68,15 @@ export class PhantomApiClient {
     this.staticHeaders = { ...this.staticHeaders, ...headers };
   }
 
+  /**
+   * Set a callback invoked on every request to supply dynamic headers (e.g. a
+   * refreshable OAuth bearer token). Dynamic headers are merged after static
+   * headers so they can override them. Undefined values are omitted.
+   */
+  setGetHeaders(fn: () => Record<string, string | undefined>): void {
+    this.getDynamicHeadersFn = fn;
+  }
+
   /** Stored after a successful payment — sent as X-Payment on all subsequent requests */
   setPaymentSignature(sig: string): void {
     this.paymentSignature = sig;
@@ -147,8 +157,15 @@ export class PhantomApiClient {
     const headers: Record<string, string> = {
       "Content-Type": "application/json",
       ...this.staticHeaders,
-      ...extra,
     };
+    if (this.getDynamicHeadersFn) {
+      for (const [k, v] of Object.entries(this.getDynamicHeadersFn())) {
+        if (v !== undefined) headers[k] = v;
+      }
+    }
+    if (extra) {
+      Object.assign(headers, extra);
+    }
     if (this.paymentSignature) {
       headers["X-Payment"] = this.paymentSignature;
     }

packages/phantom-api-client/src/PhantomApiClient.ts

@@ -136,6 +136,71 @@ describe("PhantomApiClient", () => {
     });
   });
 
+  describe("setGetHeaders()", () => {
+    it("includes dynamic header returned by the callback on GET", async () => {
+      const dynamicClient = new PhantomApiClient({ baseUrl: "https://api.phantom.app" });
+      dynamicClient.setGetHeaders(() => ({ authorization: "Bearer token-abc" }));
+      const spy = mockFetch(200, {});
+      await dynamicClient.get("/path");
+      const calledHeaders = ((spy.mock.calls[0] as unknown[])[1] as RequestInit).headers as Record<string, string>;
+      expect(calledHeaders["authorization"]).toBe("Bearer token-abc");
+    });
+
+    it("includes dynamic header returned by the callback on POST", async () => {
+      const dynamicClient = new PhantomApiClient({ baseUrl: "https://api.phantom.app" });
+      dynamicClient.setGetHeaders(() => ({ authorization: "Bearer token-post" }));
+      const spy = mockFetch(200, {});
+      await dynamicClient.post("/path", {});
+      const calledHeaders = ((spy.mock.calls[0] as unknown[])[1] as RequestInit).headers as Record<string, string>;
+      expect(calledHeaders["authorization"]).toBe("Bearer token-post");
+    });
+
+    it("calls the callback on every request so token changes are reflected", async () => {
+      const dynamicClient = new PhantomApiClient({ baseUrl: "https://api.phantom.app" });
+      let token = "token-v1";
+      dynamicClient.setGetHeaders(() => ({ authorization: `Bearer ${token}` }));
+
+      const spy = mockFetch(200, {});
+      await dynamicClient.get("/path");
+      const firstHeaders = ((spy.mock.calls[0] as unknown[])[1] as RequestInit).headers as Record<string, string>;
+      expect(firstHeaders["authorization"]).toBe("Bearer token-v1");
+
+      token = "token-v2";
+      await dynamicClient.get("/path");
+      const secondHeaders = ((spy.mock.calls[1] as unknown[])[1] as RequestInit).headers as Record<string, string>;
+      expect(secondHeaders["authorization"]).toBe("Bearer token-v2");
+    });
+
+    it("omits dynamic header keys whose value is undefined", async () => {
+      const dynamicClient = new PhantomApiClient({ baseUrl: "https://api.phantom.app" });
+      dynamicClient.setGetHeaders(() => ({ authorization: "Bearer token", "x-optional": undefined }));
+      const spy = mockFetch(200, {});
+      await dynamicClient.get("/path");
+      const calledHeaders = ((spy.mock.calls[0] as unknown[])[1] as RequestInit).headers as Record<string, string>;
+      expect(calledHeaders["authorization"]).toBe("Bearer token");
+      expect(calledHeaders["x-optional"]).toBeUndefined();
+    });
+
+    it("dynamic headers override static headers with the same key", async () => {
+      const dynamicClient = new PhantomApiClient({ baseUrl: "https://api.phantom.app" });
+      dynamicClient.setHeaders({ authorization: "Bearer static-token" });
+      dynamicClient.setGetHeaders(() => ({ authorization: "Bearer dynamic-token" }));
+      const spy = mockFetch(200, {});
+      await dynamicClient.get("/path");
+      const calledHeaders = ((spy.mock.calls[0] as unknown[])[1] as RequestInit).headers as Record<string, string>;
+      expect(calledHeaders["authorization"]).toBe("Bearer dynamic-token");
+    });
+
+    it("per-request extra headers override dynamic headers", async () => {
+      const dynamicClient = new PhantomApiClient({ baseUrl: "https://api.phantom.app" });
+      dynamicClient.setGetHeaders(() => ({ "x-custom": "from-dynamic" }));
+      const spy = mockFetch(200, {});
+      await dynamicClient.get("/path", { headers: { "x-custom": "from-extra" } });
+      const calledHeaders = ((spy.mock.calls[0] as unknown[])[1] as RequestInit).headers as Record<string, string>;
+      expect(calledHeaders["x-custom"]).toBe("from-extra");
+    });
+  });
+
   describe("setPaymentSignature()", () => {
     it("includes X-Payment header in subsequent requests after setPaymentSignature", async () => {
       const payingClient = new PhantomApiClient({ baseUrl: "https://api.phantom.app" });

packages/phantom-api-client/src/__tests__/PhantomApiClient.test.ts

@@ -1,6 +1,6 @@
 {
   "name": "@phantom/phantom-openclaw-plugin",
-  "version": "1.0.0-beta.0",
+  "version": "1.0.0",
   "description": "Phantom Embedded Wallet — sign transactions, transfer tokens, and swap on Solana and Ethereum. Powered by Phantom.",
   "repository": {
     "type": "git",

packages/phantom-openclaw-plugin/package.json

@@ -5541,7 +5541,6 @@ __metadata:
     "@phantom/perps-client": "workspace:^"
     "@phantom/phantom-api-client": "workspace:^"
     "@phantom/sdk-types": "workspace:^"
-    "@phantom/server-sdk": "workspace:^"
     "@phantom/utils": "workspace:^"
     "@solana/spl-token": "npm:^0.4.14"
     "@solana/web3.js": "npm:^1.95.5"