@moon-x/core 0.2.0 → 0.3.0

package/README.md

@@ -36,4 +36,4 @@ This package owns everything that's identical between web and mobile:
 
 ## License
 
-MIT.
+UNLICENSED. All rights reserved.

package/dist/{chunk-SOKLPX7V.mjs → chunk-VVL65GIB.mjs}

@@ -64,6 +64,16 @@ var PostMessageMethod = {
   // begin/verify HTTP calls (where the session JWT lives).
   PASSKEY_REGISTER_BEGIN: "PASSKEY_REGISTER_BEGIN",
   PASSKEY_REGISTER_VERIFY: "PASSKEY_REGISTER_VERIFY",
+  // Passkey-asserted step-up ("presence token"). Same split as register:
+  // parent owns the WebAuthn API call; iframe owns the begin/verify
+  // HTTP halves (where the session JWT lives). Mints a short-lived
+  // (`tt:"presence"`) JWT app backends can verify over JWKS.
+  // CRITICAL: parent MUST strip response.userHandle from the assertion
+  // before posting PASSKEY_PRESENCE_VERIFY. The userHandle carries DEK
+  // material in MoonX's overloaded model and has no business reaching
+  // the server. The server also defensively never reads it.
+  PASSKEY_PRESENCE_BEGIN: "PASSKEY_PRESENCE_BEGIN",
+  PASSKEY_PRESENCE_VERIFY: "PASSKEY_PRESENCE_VERIFY",
   GET_PASSKEY_STATUS: "GET_PASSKEY_STATUS",
   // Parent-side passkey assertion plumbing. Parent calls GET_DEK_INFO
   // to learn which credential IDs to put in allowCredentials and to

package/dist/index.d.mts

@@ -1,4 +1,4 @@
-export { AccessTokenClaims, AppConfigRequest, AppConfigResponse, AttachOAuthTokenRequest, AttachOAuthTokenResponse, AuthAppearance, AuthFlow, AuthFlowComponent, AuthLoginMethod, AuthProviderConfig, BaseGetBalanceParams, BaseGetBalanceResult, BaseGetTokenAccountsParams, BaseSendTransactionParams, BaseSendTransactionResult, BaseSignMessageParams, BaseSignMessageResult, BaseSignTransactionParams, BaseSignTransactionResult, BaseTokenClaims, BaseUIOptions, BaseWalletHooks, ContractUIOptions, CreateWalletResponse, DefaultFundingMethod, DeleteSessionRequest, DeleteSessionResponse, DetachOAuthTokenRequest, DeviceFingerprint, DisplayMode, EmailOtpConfig, EmailOtpFlowState, EthereumFundingConfig, EthereumGetBalanceParams, EthereumGetBalanceResult, EthereumGetTokenAccountsByOwnerParams, EthereumGetTokenAccountsByOwnerResult, EthereumSendTransactionParams, EthereumSendTransactionRequest, EthereumSendTransactionResult, EthereumSign7702AuthorizationParams, EthereumSign7702AuthorizationResult, EthereumSignHashParams, EthereumSignHashResult, EthereumSignMessageParams, EthereumSignMessageResult, EthereumSignTransactionParams, EthereumSignTransactionResult, EthereumSignTypedDataParams, EthereumSignTypedDataResult, EthereumSwitchChainParams, ExportKeyConfig, Factor, FlexibleTheme, FundWalletConfig, FundingEvents, FundingMethod, FundingUIConfig, GetCurrentSessionRequest, GetCurrentSessionResponse, Hex, IdentityTokenClaims, IdpProvider, IsAuthenticatedRequest, IsAuthenticatedResponse, LoginTokenBundle, LogoutRequest, LogoutResponse, MessageTypeProperty, MessageTypes, MoonKeyThemeConfig, MoonPaySignRequest, MoonPaySignResponse, MpcKeyShares, Network, OAuthRequest, OAuthResponse, OnrampFundingSettings, PasskeyEnrollConfig, PasskeySettings, PreferredCardProvider, PrefillConfig, PublicEthereumWallet, PublicSessionData, PublicWallet, RefreshSessionRequest, RefreshSessionResponse, RetrieveWalletKeyRequest, RetrieveWalletKeyResponse, SdkSettings, SendEmailOtpRequest, SendEmailOtpResponse, SendTransactionConfig, SendTransactionRequest, SessionData, SharesDeviceRequest, SharesDeviceResponse, Sign7702AuthorizationError, Sign7702AuthorizationParams, Sign7702AuthorizationResponse, Sign7702AuthorizationResult, SignMessageConfig, SignTransactionConfig, SignTypedDataError, SignTypedDataParams, SignTypedDataResponse, SignTypedDataResult, SmsSettings, SolanaChain, SolanaFundingConfig, SolanaGetBalanceParams, SolanaGetBalanceResult, SolanaGetTokenAccountsByOwnerParams, SolanaGetTokenAccountsByOwnerResult, SolanaSendTransactionParams, SolanaSendTransactionResult, SolanaSignMessageParams, SolanaSignMessageResult, SolanaSignTransactionParams, SolanaSignTransactionResult, TransactionCommitment, TransactionEncoding, TransactionUIOptions, TypedMessage, UseFundWalletInterface, UsersMePublicResponse, UsersMeRequest, UsersMeResponse, VerifiedSession, VerifyEmailOtpRequest, VerifyEmailOtpResponse, VerifyEmailOtpUser, VerifyOAuthTokenRequest, VerifyOAuthTokenResponse, VerifySiweWalletRegistrationRequest, WALLET_ERROR_CODES, Wallet, WalletChain, WalletChainType, WalletConnectConfig, WalletCreationError, WalletError, WalletErrorCode, WalletKeyRequest, WalletListEntry, WalletRegistrationNonceRequest, WalletRegistrationNonceResponse, WalletType, WalletVerifyRequest } from './types/index.mjs';
+export { AccessTokenClaims, AppConfigRequest, AppConfigResponse, AttachOAuthTokenRequest, AttachOAuthTokenResponse, AuthAppearance, AuthFlow, AuthFlowComponent, AuthLoginMethod, AuthProviderConfig, BaseGetBalanceParams, BaseGetBalanceResult, BaseGetTokenAccountsParams, BaseSendTransactionParams, BaseSendTransactionResult, BaseSignMessageParams, BaseSignMessageResult, BaseSignTransactionParams, BaseSignTransactionResult, BaseTokenClaims, BaseUIOptions, BaseWalletHooks, ContractUIOptions, CreateWalletResponse, DefaultFundingMethod, DeleteSessionRequest, DeleteSessionResponse, DetachOAuthTokenRequest, DeviceFingerprint, DisplayMode, EmailOtpConfig, EmailOtpFlowState, EthereumFundingConfig, EthereumGetBalanceParams, EthereumGetBalanceResult, EthereumGetTokenAccountsByOwnerParams, EthereumGetTokenAccountsByOwnerResult, EthereumSendTransactionParams, EthereumSendTransactionRequest, EthereumSendTransactionResult, EthereumSign7702AuthorizationParams, EthereumSign7702AuthorizationResult, EthereumSignHashParams, EthereumSignHashResult, EthereumSignMessageParams, EthereumSignMessageResult, EthereumSignTransactionParams, EthereumSignTransactionResult, EthereumSignTypedDataParams, EthereumSignTypedDataResult, EthereumSwitchChainParams, ExportKeyConfig, Factor, FlexibleTheme, FundWalletConfig, FundingEvents, FundingMethod, FundingUIConfig, GetCurrentSessionRequest, GetCurrentSessionResponse, Hex, IdentityTokenClaims, IdpProvider, IsAuthenticatedRequest, IsAuthenticatedResponse, LoginTokenBundle, LogoutRequest, LogoutResponse, MessageTypeProperty, MessageTypes, MoonKeyThemeConfig, MoonPaySignRequest, MoonPaySignResponse, MpcKeyShares, Network, OAuthRequest, OAuthResponse, OnrampFundingSettings, PasskeyEnrollConfig, PasskeySettings, PreferredCardProvider, PrefillConfig, PresenceTokenClaims, PublicEthereumWallet, PublicSessionData, PublicWallet, RefreshSessionRequest, RefreshSessionResponse, RetrieveWalletKeyRequest, RetrieveWalletKeyResponse, SdkSettings, SendEmailOtpRequest, SendEmailOtpResponse, SendTransactionConfig, SendTransactionRequest, SessionData, SharesDeviceRequest, SharesDeviceResponse, Sign7702AuthorizationError, Sign7702AuthorizationParams, Sign7702AuthorizationResponse, Sign7702AuthorizationResult, SignMessageConfig, SignTransactionConfig, SignTypedDataError, SignTypedDataParams, SignTypedDataResponse, SignTypedDataResult, SmsSettings, SolanaChain, SolanaFundingConfig, SolanaGetBalanceParams, SolanaGetBalanceResult, SolanaGetTokenAccountsByOwnerParams, SolanaGetTokenAccountsByOwnerResult, SolanaSendTransactionParams, SolanaSendTransactionResult, SolanaSignMessageParams, SolanaSignMessageResult, SolanaSignTransactionParams, SolanaSignTransactionResult, TransactionCommitment, TransactionEncoding, TransactionUIOptions, TypedMessage, UseFundWalletInterface, UsersMePublicResponse, UsersMeRequest, UsersMeResponse, VerifiedSession, VerifyEmailOtpRequest, VerifyEmailOtpResponse, VerifyEmailOtpUser, VerifyOAuthTokenRequest, VerifyOAuthTokenResponse, VerifySiweWalletRegistrationRequest, WALLET_ERROR_CODES, Wallet, WalletChain, WalletChainType, WalletConnectConfig, WalletCreationError, WalletError, WalletErrorCode, WalletKeyRequest, WalletListEntry, WalletRegistrationNonceRequest, WalletRegistrationNonceResponse, WalletType, WalletVerifyRequest } from './types/index.mjs';
 export { getIframeOrigin, getIframeUrl, getMoonKeyApiUrl } from './utils/index.mjs';
-export { F as FORWARDED_ERROR_FIELDS, P as PostMessageClient, a as PostMessageMethod, b as PostMessageServer, c as PostMessageType } from './post-message-C_99BCBh.mjs';
+export { F as FORWARDED_ERROR_FIELDS, P as PostMessageClient, a as PostMessageMethod, b as PostMessageServer, c as PostMessageType } from './post-message-CmgAfkOS.mjs';
 export { B as BlockExplorer, C as Chain, a as ChainLikeWithId, E as EthereumChainConfig, N as NativeCurrency, R as RpcConfig, b as RpcUrls } from './chain-C9dvKXUY.mjs';

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-export { AccessTokenClaims, AppConfigRequest, AppConfigResponse, AttachOAuthTokenRequest, AttachOAuthTokenResponse, AuthAppearance, AuthFlow, AuthFlowComponent, AuthLoginMethod, AuthProviderConfig, BaseGetBalanceParams, BaseGetBalanceResult, BaseGetTokenAccountsParams, BaseSendTransactionParams, BaseSendTransactionResult, BaseSignMessageParams, BaseSignMessageResult, BaseSignTransactionParams, BaseSignTransactionResult, BaseTokenClaims, BaseUIOptions, BaseWalletHooks, ContractUIOptions, CreateWalletResponse, DefaultFundingMethod, DeleteSessionRequest, DeleteSessionResponse, DetachOAuthTokenRequest, DeviceFingerprint, DisplayMode, EmailOtpConfig, EmailOtpFlowState, EthereumFundingConfig, EthereumGetBalanceParams, EthereumGetBalanceResult, EthereumGetTokenAccountsByOwnerParams, EthereumGetTokenAccountsByOwnerResult, EthereumSendTransactionParams, EthereumSendTransactionRequest, EthereumSendTransactionResult, EthereumSign7702AuthorizationParams, EthereumSign7702AuthorizationResult, EthereumSignHashParams, EthereumSignHashResult, EthereumSignMessageParams, EthereumSignMessageResult, EthereumSignTransactionParams, EthereumSignTransactionResult, EthereumSignTypedDataParams, EthereumSignTypedDataResult, EthereumSwitchChainParams, ExportKeyConfig, Factor, FlexibleTheme, FundWalletConfig, FundingEvents, FundingMethod, FundingUIConfig, GetCurrentSessionRequest, GetCurrentSessionResponse, Hex, IdentityTokenClaims, IdpProvider, IsAuthenticatedRequest, IsAuthenticatedResponse, LoginTokenBundle, LogoutRequest, LogoutResponse, MessageTypeProperty, MessageTypes, MoonKeyThemeConfig, MoonPaySignRequest, MoonPaySignResponse, MpcKeyShares, Network, OAuthRequest, OAuthResponse, OnrampFundingSettings, PasskeyEnrollConfig, PasskeySettings, PreferredCardProvider, PrefillConfig, PublicEthereumWallet, PublicSessionData, PublicWallet, RefreshSessionRequest, RefreshSessionResponse, RetrieveWalletKeyRequest, RetrieveWalletKeyResponse, SdkSettings, SendEmailOtpRequest, SendEmailOtpResponse, SendTransactionConfig, SendTransactionRequest, SessionData, SharesDeviceRequest, SharesDeviceResponse, Sign7702AuthorizationError, Sign7702AuthorizationParams, Sign7702AuthorizationResponse, Sign7702AuthorizationResult, SignMessageConfig, SignTransactionConfig, SignTypedDataError, SignTypedDataParams, SignTypedDataResponse, SignTypedDataResult, SmsSettings, SolanaChain, SolanaFundingConfig, SolanaGetBalanceParams, SolanaGetBalanceResult, SolanaGetTokenAccountsByOwnerParams, SolanaGetTokenAccountsByOwnerResult, SolanaSendTransactionParams, SolanaSendTransactionResult, SolanaSignMessageParams, SolanaSignMessageResult, SolanaSignTransactionParams, SolanaSignTransactionResult, TransactionCommitment, TransactionEncoding, TransactionUIOptions, TypedMessage, UseFundWalletInterface, UsersMePublicResponse, UsersMeRequest, UsersMeResponse, VerifiedSession, VerifyEmailOtpRequest, VerifyEmailOtpResponse, VerifyEmailOtpUser, VerifyOAuthTokenRequest, VerifyOAuthTokenResponse, VerifySiweWalletRegistrationRequest, WALLET_ERROR_CODES, Wallet, WalletChain, WalletChainType, WalletConnectConfig, WalletCreationError, WalletError, WalletErrorCode, WalletKeyRequest, WalletListEntry, WalletRegistrationNonceRequest, WalletRegistrationNonceResponse, WalletType, WalletVerifyRequest } from './types/index.js';
+export { AccessTokenClaims, AppConfigRequest, AppConfigResponse, AttachOAuthTokenRequest, AttachOAuthTokenResponse, AuthAppearance, AuthFlow, AuthFlowComponent, AuthLoginMethod, AuthProviderConfig, BaseGetBalanceParams, BaseGetBalanceResult, BaseGetTokenAccountsParams, BaseSendTransactionParams, BaseSendTransactionResult, BaseSignMessageParams, BaseSignMessageResult, BaseSignTransactionParams, BaseSignTransactionResult, BaseTokenClaims, BaseUIOptions, BaseWalletHooks, ContractUIOptions, CreateWalletResponse, DefaultFundingMethod, DeleteSessionRequest, DeleteSessionResponse, DetachOAuthTokenRequest, DeviceFingerprint, DisplayMode, EmailOtpConfig, EmailOtpFlowState, EthereumFundingConfig, EthereumGetBalanceParams, EthereumGetBalanceResult, EthereumGetTokenAccountsByOwnerParams, EthereumGetTokenAccountsByOwnerResult, EthereumSendTransactionParams, EthereumSendTransactionRequest, EthereumSendTransactionResult, EthereumSign7702AuthorizationParams, EthereumSign7702AuthorizationResult, EthereumSignHashParams, EthereumSignHashResult, EthereumSignMessageParams, EthereumSignMessageResult, EthereumSignTransactionParams, EthereumSignTransactionResult, EthereumSignTypedDataParams, EthereumSignTypedDataResult, EthereumSwitchChainParams, ExportKeyConfig, Factor, FlexibleTheme, FundWalletConfig, FundingEvents, FundingMethod, FundingUIConfig, GetCurrentSessionRequest, GetCurrentSessionResponse, Hex, IdentityTokenClaims, IdpProvider, IsAuthenticatedRequest, IsAuthenticatedResponse, LoginTokenBundle, LogoutRequest, LogoutResponse, MessageTypeProperty, MessageTypes, MoonKeyThemeConfig, MoonPaySignRequest, MoonPaySignResponse, MpcKeyShares, Network, OAuthRequest, OAuthResponse, OnrampFundingSettings, PasskeyEnrollConfig, PasskeySettings, PreferredCardProvider, PrefillConfig, PresenceTokenClaims, PublicEthereumWallet, PublicSessionData, PublicWallet, RefreshSessionRequest, RefreshSessionResponse, RetrieveWalletKeyRequest, RetrieveWalletKeyResponse, SdkSettings, SendEmailOtpRequest, SendEmailOtpResponse, SendTransactionConfig, SendTransactionRequest, SessionData, SharesDeviceRequest, SharesDeviceResponse, Sign7702AuthorizationError, Sign7702AuthorizationParams, Sign7702AuthorizationResponse, Sign7702AuthorizationResult, SignMessageConfig, SignTransactionConfig, SignTypedDataError, SignTypedDataParams, SignTypedDataResponse, SignTypedDataResult, SmsSettings, SolanaChain, SolanaFundingConfig, SolanaGetBalanceParams, SolanaGetBalanceResult, SolanaGetTokenAccountsByOwnerParams, SolanaGetTokenAccountsByOwnerResult, SolanaSendTransactionParams, SolanaSendTransactionResult, SolanaSignMessageParams, SolanaSignMessageResult, SolanaSignTransactionParams, SolanaSignTransactionResult, TransactionCommitment, TransactionEncoding, TransactionUIOptions, TypedMessage, UseFundWalletInterface, UsersMePublicResponse, UsersMeRequest, UsersMeResponse, VerifiedSession, VerifyEmailOtpRequest, VerifyEmailOtpResponse, VerifyEmailOtpUser, VerifyOAuthTokenRequest, VerifyOAuthTokenResponse, VerifySiweWalletRegistrationRequest, WALLET_ERROR_CODES, Wallet, WalletChain, WalletChainType, WalletConnectConfig, WalletCreationError, WalletError, WalletErrorCode, WalletKeyRequest, WalletListEntry, WalletRegistrationNonceRequest, WalletRegistrationNonceResponse, WalletType, WalletVerifyRequest } from './types/index.js';
 export { getIframeOrigin, getIframeUrl, getMoonKeyApiUrl } from './utils/index.js';
-export { F as FORWARDED_ERROR_FIELDS, P as PostMessageClient, a as PostMessageMethod, b as PostMessageServer, c as PostMessageType } from './post-message-C_99BCBh.js';
+export { F as FORWARDED_ERROR_FIELDS, P as PostMessageClient, a as PostMessageMethod, b as PostMessageServer, c as PostMessageType } from './post-message-CmgAfkOS.js';
 export { B as BlockExplorer, C as Chain, a as ChainLikeWithId, E as EthereumChainConfig, N as NativeCurrency, R as RpcConfig, b as RpcUrls } from './chain-C9dvKXUY.js';

package/dist/index.js

@@ -190,6 +190,16 @@ var PostMessageMethod = {
   // begin/verify HTTP calls (where the session JWT lives).
   PASSKEY_REGISTER_BEGIN: "PASSKEY_REGISTER_BEGIN",
   PASSKEY_REGISTER_VERIFY: "PASSKEY_REGISTER_VERIFY",
+  // Passkey-asserted step-up ("presence token"). Same split as register:
+  // parent owns the WebAuthn API call; iframe owns the begin/verify
+  // HTTP halves (where the session JWT lives). Mints a short-lived
+  // (`tt:"presence"`) JWT app backends can verify over JWKS.
+  // CRITICAL: parent MUST strip response.userHandle from the assertion
+  // before posting PASSKEY_PRESENCE_VERIFY. The userHandle carries DEK
+  // material in MoonX's overloaded model and has no business reaching
+  // the server. The server also defensively never reads it.
+  PASSKEY_PRESENCE_BEGIN: "PASSKEY_PRESENCE_BEGIN",
+  PASSKEY_PRESENCE_VERIFY: "PASSKEY_PRESENCE_VERIFY",
   GET_PASSKEY_STATUS: "GET_PASSKEY_STATUS",
   // Parent-side passkey assertion plumbing. Parent calls GET_DEK_INFO
   // to learn which credential IDs to put in allowCredentials and to

package/dist/index.mjs

@@ -14,7 +14,7 @@ import {
   PostMessageMethod,
   PostMessageServer,
   PostMessageType
-} from "./chunk-SOKLPX7V.mjs";
+} from "./chunk-VVL65GIB.mjs";
 import {
   getMoonKeyApiUrl
 } from "./chunk-GQKIA37O.mjs";

package/dist/{interfaces-9k0eKCc4.d.ts → interfaces-Bm7fGOAI.d.ts}

@@ -1,4 +1,4 @@
-import { c as PostMessageType, a as PostMessageMethod } from './post-message-C_99BCBh.js';
+import { c as PostMessageType, a as PostMessageMethod } from './post-message-CmgAfkOS.js';
 
 /**
  * Transport — the bidirectional postMessage channel between the parent
@@ -27,14 +27,26 @@ interface Transport {
     isReady(): boolean;
 }
 /**
- * PasskeyAssertor — runs the WebAuthn ceremony in the *parent* (where
- * user activation lives — cross-origin iframes/WebViews can't reliably
- * get their own click handler).
+ * PasskeyAssertor — runs the WebAuthn assertion ceremony in the *parent*
+ * (where user activation lives — cross-origin iframes/WebViews can't
+ * reliably get their own click handler).
  *
- * Both `assert` and `create` use empty `allowCredentials` on the
- * underlying API to force the discoverable-login codepath where
- * userHandle is REQUIRED. The userHandle bytes are the wrap key the
- * iframe-app uses to unwrap the DEK before signing.
+ * Two methods, two distinct flow shapes:
+ *
+ *  - `assert` is the DEK-unwrap path: empty allowCredentials, harvests
+ *    userHandle (= DEK wrap key in MoonX's overloaded model), consumed
+ *    locally by the iframe-app. Never crosses the server boundary.
+ *
+ *  - `assertForServer` is the server-roundtrip path (presence step-up,
+ *    future passkey sign-in): server issues options, browser asserts,
+ *    server verifies the signature. userHandle is stripped on the
+ *    platform boundary (DEK hygiene) — the strip happens INSIDE the
+ *    assertor impl, not in the orchestrator, so no caller can bypass
+ *    it.
+ *
+ * Registration is handled separately via `@simplewebauthn/browser`'s
+ * `startRegistration` on web / `passkeyCreate` from
+ * `react-native-passkeys` on RN; this interface is assertion-only.
  */
 interface PasskeyAssertor {
     /**
@@ -58,23 +70,60 @@ interface PasskeyAssertor {
         userHandleB64url: string;
     }>;
     /**
-     * Run a WebAuthn registration (`navigator.credentials.create` on web,
-     * `passkeyCreate` from react-native-passkeys on RN). Used by passkey
-     * register flows.
+     * Run a WebAuthn assertion for a SERVER-VERIFIED flow (presence
+     * step-up, future passkey sign-in). Takes a full
+     * `PublicKeyCredentialRequestOptionsJSON` (the server-issued
+     * `optionsJSON`) and returns the standard
+     * `AuthenticationResponseJSON` with `response.userHandle`
+     * **stripped** — DEK hygiene is enforced inside the impl so the
+     * orchestrator (and any future caller) cannot forget it.
+     *
+     * The returned object goes straight onto the wire to /presence/verify
+     * (or the future /login/verify). Each platform-specific impl is
+     * responsible for: (a) running the underlying ceremony, (b)
+     * shaping the result into AuthenticationResponseJSON, and (c) the
+     * userHandle strip.
      */
-    create(opts: {
-        rpId: string;
-        rpName: string;
-        userId: Uint8Array;
-        userName: string;
-        userDisplayName: string;
-        challenge: string;
-        excludeCredentials?: string[];
-    }): Promise<{
-        rawIdB64url: string;
-        clientDataJSONB64url: string;
-        attestationObjectB64url: string;
+    assertForServer(opts: {
+        optionsJSON: WebAuthnRequestOptions;
+    }): Promise<WebAuthnAssertionResponse>;
+}
+/**
+ * Subset of `PublicKeyCredentialRequestOptionsJSON` we forward to the
+ * platform impl. Kept loose-typed so a server adding fields doesn't
+ * require an interface change here.
+ */
+interface WebAuthnRequestOptions {
+    challenge: string;
+    rpId?: string;
+    allowCredentials?: Array<{
+        id: string;
+        type?: string;
+        transports?: string[];
     }>;
+    userVerification?: string;
+    timeout?: number;
+    extensions?: Record<string, unknown>;
+}
+/**
+ * Standard `AuthenticationResponseJSON` shape, with `userHandle`
+ * deliberately optional because the assertForServer contract is that
+ * impls strip it before returning. The field stays in the type so a
+ * server-side decoder can still parse it (= undefined) without a
+ * union mismatch.
+ */
+interface WebAuthnAssertionResponse {
+    id: string;
+    rawId: string;
+    type: string;
+    response: {
+        clientDataJSON: string;
+        authenticatorData: string;
+        signature: string;
+        userHandle?: undefined;
+    };
+    clientExtensionResults?: Record<string, unknown>;
+    authenticatorAttachment?: string;
 }
 /**
  * KvStorage — async key/value storage for ID tokens + session metadata.
@@ -117,4 +166,4 @@ interface PlatformImpls {
     oauth: OAuthOpener;
 }
 
-export type { KvStorage as K, OAuthOpener as O, PasskeyAssertor as P, Transport as T, PlatformImpls as a };
+export type { KvStorage as K, OAuthOpener as O, PasskeyAssertor as P, Transport as T, WebAuthnAssertionResponse as W, PlatformImpls as a, WebAuthnRequestOptions as b };

package/dist/{interfaces-fNhwnCeY.d.mts → interfaces-CYtJHALV.d.mts}

@@ -1,4 +1,4 @@
-import { c as PostMessageType, a as PostMessageMethod } from './post-message-C_99BCBh.mjs';
+import { c as PostMessageType, a as PostMessageMethod } from './post-message-CmgAfkOS.mjs';
 
 /**
  * Transport — the bidirectional postMessage channel between the parent
@@ -27,14 +27,26 @@ interface Transport {
     isReady(): boolean;
 }
 /**
- * PasskeyAssertor — runs the WebAuthn ceremony in the *parent* (where
- * user activation lives — cross-origin iframes/WebViews can't reliably
- * get their own click handler).
+ * PasskeyAssertor — runs the WebAuthn assertion ceremony in the *parent*
+ * (where user activation lives — cross-origin iframes/WebViews can't
+ * reliably get their own click handler).
  *
- * Both `assert` and `create` use empty `allowCredentials` on the
- * underlying API to force the discoverable-login codepath where
- * userHandle is REQUIRED. The userHandle bytes are the wrap key the
- * iframe-app uses to unwrap the DEK before signing.
+ * Two methods, two distinct flow shapes:
+ *
+ *  - `assert` is the DEK-unwrap path: empty allowCredentials, harvests
+ *    userHandle (= DEK wrap key in MoonX's overloaded model), consumed
+ *    locally by the iframe-app. Never crosses the server boundary.
+ *
+ *  - `assertForServer` is the server-roundtrip path (presence step-up,
+ *    future passkey sign-in): server issues options, browser asserts,
+ *    server verifies the signature. userHandle is stripped on the
+ *    platform boundary (DEK hygiene) — the strip happens INSIDE the
+ *    assertor impl, not in the orchestrator, so no caller can bypass
+ *    it.
+ *
+ * Registration is handled separately via `@simplewebauthn/browser`'s
+ * `startRegistration` on web / `passkeyCreate` from
+ * `react-native-passkeys` on RN; this interface is assertion-only.
  */
 interface PasskeyAssertor {
     /**
@@ -58,23 +70,60 @@ interface PasskeyAssertor {
         userHandleB64url: string;
     }>;
     /**
-     * Run a WebAuthn registration (`navigator.credentials.create` on web,
-     * `passkeyCreate` from react-native-passkeys on RN). Used by passkey
-     * register flows.
+     * Run a WebAuthn assertion for a SERVER-VERIFIED flow (presence
+     * step-up, future passkey sign-in). Takes a full
+     * `PublicKeyCredentialRequestOptionsJSON` (the server-issued
+     * `optionsJSON`) and returns the standard
+     * `AuthenticationResponseJSON` with `response.userHandle`
+     * **stripped** — DEK hygiene is enforced inside the impl so the
+     * orchestrator (and any future caller) cannot forget it.
+     *
+     * The returned object goes straight onto the wire to /presence/verify
+     * (or the future /login/verify). Each platform-specific impl is
+     * responsible for: (a) running the underlying ceremony, (b)
+     * shaping the result into AuthenticationResponseJSON, and (c) the
+     * userHandle strip.
      */
-    create(opts: {
-        rpId: string;
-        rpName: string;
-        userId: Uint8Array;
-        userName: string;
-        userDisplayName: string;
-        challenge: string;
-        excludeCredentials?: string[];
-    }): Promise<{
-        rawIdB64url: string;
-        clientDataJSONB64url: string;
-        attestationObjectB64url: string;
+    assertForServer(opts: {
+        optionsJSON: WebAuthnRequestOptions;
+    }): Promise<WebAuthnAssertionResponse>;
+}
+/**
+ * Subset of `PublicKeyCredentialRequestOptionsJSON` we forward to the
+ * platform impl. Kept loose-typed so a server adding fields doesn't
+ * require an interface change here.
+ */
+interface WebAuthnRequestOptions {
+    challenge: string;
+    rpId?: string;
+    allowCredentials?: Array<{
+        id: string;
+        type?: string;
+        transports?: string[];
     }>;
+    userVerification?: string;
+    timeout?: number;
+    extensions?: Record<string, unknown>;
+}
+/**
+ * Standard `AuthenticationResponseJSON` shape, with `userHandle`
+ * deliberately optional because the assertForServer contract is that
+ * impls strip it before returning. The field stays in the type so a
+ * server-side decoder can still parse it (= undefined) without a
+ * union mismatch.
+ */
+interface WebAuthnAssertionResponse {
+    id: string;
+    rawId: string;
+    type: string;
+    response: {
+        clientDataJSON: string;
+        authenticatorData: string;
+        signature: string;
+        userHandle?: undefined;
+    };
+    clientExtensionResults?: Record<string, unknown>;
+    authenticatorAttachment?: string;
 }
 /**
  * KvStorage — async key/value storage for ID tokens + session metadata.
@@ -117,4 +166,4 @@ interface PlatformImpls {
     oauth: OAuthOpener;
 }
 
-export type { KvStorage as K, OAuthOpener as O, PasskeyAssertor as P, Transport as T, PlatformImpls as a };
+export type { KvStorage as K, OAuthOpener as O, PasskeyAssertor as P, Transport as T, WebAuthnAssertionResponse as W, PlatformImpls as a, WebAuthnRequestOptions as b };

package/dist/{post-message-C_99BCBh.d.ts → post-message-CmgAfkOS.d.mts}

@@ -40,6 +40,8 @@ declare const PostMessageMethod: {
     readonly DETACH_OAUTH: "DETACH_OAUTH";
     readonly PASSKEY_REGISTER_BEGIN: "PASSKEY_REGISTER_BEGIN";
     readonly PASSKEY_REGISTER_VERIFY: "PASSKEY_REGISTER_VERIFY";
+    readonly PASSKEY_PRESENCE_BEGIN: "PASSKEY_PRESENCE_BEGIN";
+    readonly PASSKEY_PRESENCE_VERIFY: "PASSKEY_PRESENCE_VERIFY";
     readonly GET_PASSKEY_STATUS: "GET_PASSKEY_STATUS";
     readonly GET_DEK_INFO: "GET_DEK_INFO";
     readonly ADD_PASSKEY_WRAP: "ADD_PASSKEY_WRAP";

package/dist/{post-message-C_99BCBh.d.mts → post-message-CmgAfkOS.d.ts}

@@ -40,6 +40,8 @@ declare const PostMessageMethod: {
     readonly DETACH_OAUTH: "DETACH_OAUTH";
     readonly PASSKEY_REGISTER_BEGIN: "PASSKEY_REGISTER_BEGIN";
     readonly PASSKEY_REGISTER_VERIFY: "PASSKEY_REGISTER_VERIFY";
+    readonly PASSKEY_PRESENCE_BEGIN: "PASSKEY_PRESENCE_BEGIN";
+    readonly PASSKEY_PRESENCE_VERIFY: "PASSKEY_PRESENCE_VERIFY";
     readonly GET_PASSKEY_STATUS: "GET_PASSKEY_STATUS";
     readonly GET_DEK_INFO: "GET_DEK_INFO";
     readonly ADD_PASSKEY_WRAP: "ADD_PASSKEY_WRAP";

package/dist/react/index.d.mts

@@ -16,6 +16,7 @@ interface MoonKeyHookSDK {
     isAuthenticated?: boolean;
     ready?: boolean;
     refreshUser?: () => Promise<unknown>;
+    revalidatedAt?: number;
     signEthereumMessageHeadless: (params: unknown) => Promise<unknown>;
     signEthereumTransactionHeadless: (params: unknown) => Promise<unknown>;
     signEthereumTypedDataHeadless: (params: unknown) => Promise<unknown>;

package/dist/react/index.d.ts

@@ -16,6 +16,7 @@ interface MoonKeyHookSDK {
     isAuthenticated?: boolean;
     ready?: boolean;
     refreshUser?: () => Promise<unknown>;
+    revalidatedAt?: number;
     signEthereumMessageHeadless: (params: unknown) => Promise<unknown>;
     signEthereumTransactionHeadless: (params: unknown) => Promise<unknown>;
     signEthereumTypedDataHeadless: (params: unknown) => Promise<unknown>;

package/dist/react/index.js

@@ -174,6 +174,7 @@ var useWallets = (walletType) => {
   const [loading, setLoading] = (0, import_react5.useState)(false);
   const [error, setError] = (0, import_react5.useState)(null);
   const isAuthenticated = !!sdk.isAuthenticated;
+  const revalidatedAt = sdk.revalidatedAt ?? 0;
   const refresh = (0, import_react5.useCallback)(async () => {
     setLoading(true);
     setError(null);
@@ -192,7 +193,7 @@ var useWallets = (walletType) => {
       return;
     }
     refresh();
-  }, [isAuthenticated, refresh]);
+  }, [isAuthenticated, revalidatedAt, refresh]);
   return { wallets, loading, error, refresh, refetch: refresh };
 };
 

package/dist/react/index.mjs

@@ -123,6 +123,7 @@ var useWallets = (walletType) => {
   const [loading, setLoading] = useState4(false);
   const [error, setError] = useState4(null);
   const isAuthenticated = !!sdk.isAuthenticated;
+  const revalidatedAt = sdk.revalidatedAt ?? 0;
   const refresh = useCallback4(async () => {
     setLoading(true);
     setError(null);
@@ -141,7 +142,7 @@ var useWallets = (walletType) => {
       return;
     }
     refresh();
-  }, [isAuthenticated, refresh]);
+  }, [isAuthenticated, revalidatedAt, refresh]);
   return { wallets, loading, error, refresh, refetch: refresh };
 };
 

package/dist/sdk/index.d.mts

@@ -1,18 +1,30 @@
-import { T as Transport, P as PasskeyAssertor, K as KvStorage } from '../interfaces-fNhwnCeY.mjs';
-export { O as OAuthOpener, a as PlatformImpls } from '../interfaces-fNhwnCeY.mjs';
+import { T as Transport, P as PasskeyAssertor, K as KvStorage } from '../interfaces-CYtJHALV.mjs';
+export { O as OAuthOpener, a as PlatformImpls, W as WebAuthnAssertionResponse, b as WebAuthnRequestOptions } from '../interfaces-CYtJHALV.mjs';
 import { C as CachedAssertion } from '../passkey-cache-B9PT3AWX.mjs';
-import { EthereumSignMessageParams, EthereumSignMessageResult, EthereumSignTransactionParams, EthereumSignTransactionResult, EthereumSignTypedDataParams, EthereumSignTypedDataResult, EthereumSignHashParams, EthereumSignHashResult, EthereumSign7702AuthorizationParams, EthereumSign7702AuthorizationResult, EthereumSendTransactionParams, EthereumSendTransactionResult, EthereumGetBalanceParams, EthereumGetBalanceResult, EthereumGetTokenAccountsByOwnerParams, EthereumGetTokenAccountsByOwnerResult, SolanaSignMessageParams, SolanaSignMessageResult, SolanaSignTransactionParams, SolanaSignTransactionResult, SolanaSendTransactionParams, SolanaSendTransactionResult, SolanaGetBalanceParams, SolanaGetBalanceResult, SolanaGetTokenAccountsByOwnerParams, SolanaGetTokenAccountsByOwnerResult, PublicWallet } from '../types/index.mjs';
-import '../post-message-C_99BCBh.mjs';
+import { EthereumSignMessageParams, EthereumSignMessageResult, EthereumSignTransactionParams, EthereumSignTransactionResult, EthereumSignTypedDataParams, EthereumSignTypedDataResult, EthereumSignHashParams, EthereumSignHashResult, EthereumSign7702AuthorizationParams, EthereumSign7702AuthorizationResult, EthereumSendTransactionParams, EthereumSendTransactionResult, EthereumGetBalanceParams, EthereumGetBalanceResult, EthereumGetTokenAccountsByOwnerParams, EthereumGetTokenAccountsByOwnerResult, SolanaSignMessageParams, SolanaSignMessageResult, SolanaSignTransactionParams, SolanaSignTransactionResult, SolanaSendTransactionParams, SolanaSendTransactionResult, SolanaGetBalanceParams, SolanaGetBalanceResult, SolanaGetTokenAccountsByOwnerParams, SolanaGetTokenAccountsByOwnerResult, SendEmailOtpResponse, PublicWallet } from '../types/index.mjs';
+import '../post-message-CmgAfkOS.mjs';
 import '../chain-C9dvKXUY.mjs';
 
 type AssertPasskeyInParentResult = CachedAssertion;
-declare const assertPasskeyInParent: ({ transport, passkey, publishableKey, requireFreshAssertion, }: {
+declare const assertPasskeyInParent: ({ transport, passkey, publishableKey, requireFreshAssertion, validateCredentialInAllowList, }: {
     transport: Transport;
     passkey: PasskeyAssertor;
     publishableKey: string;
     requireFreshAssertion?: boolean;
+    validateCredentialInAllowList?: boolean;
 }) => Promise<AssertPasskeyInParentResult>;
 
+interface GetPresenceTokenResult {
+    presenceToken: string;
+    expiresAt: number;
+}
+declare const getPresenceToken: ({ transport, passkey, publishableKey, relyingPartyOrigin, }: {
+    transport: Transport;
+    passkey: PasskeyAssertor;
+    publishableKey: string;
+    relyingPartyOrigin: string;
+}) => Promise<GetPresenceTokenResult>;
+
 declare const getHeadlessEthereumMethods: ({ transport, passkey, publishableKey, }: {
     transport: Transport;
     passkey: PasskeyAssertor;
@@ -59,17 +71,19 @@ interface VerifyOAuthParams {
     token?: string;
     state?: string;
 }
-declare const getHeadlessAuthenticationMethods: ({ transport, publishableKey, emailConfig, setIsAuthenticated, setUser, }: {
+declare const getHeadlessAuthenticationMethods: ({ transport, publishableKey, setIsAuthenticated, setUser, }: {
     transport: Transport;
     publishableKey: string;
-    emailConfig?: {
-        expiresIn?: number;
-    };
     setIsAuthenticated?: (isAuth: boolean) => void;
     setUser?: (user: unknown | null) => void;
 }) => {
-    /** Send a one-time passcode to the user's email address. */
-    sendCode: (params: SendCodeParams) => Promise<void>;
+    /**
+     * Send a one-time passcode to the user's email address. Returns the
+     * server's response — most importantly `expires_at` (unix seconds),
+     * which the UI uses to render a countdown that cannot drift from the
+     * authoritative server-side TTL.
+     */
+    sendCode: (params: SendCodeParams) => Promise<SendEmailOtpResponse>;
     /**
      * Verify the OTP and complete the login. The iframe-app handles
      * session persistence; on success the SDK flips isAuthenticated and
@@ -123,4 +137,4 @@ declare const getHeadlessGeneralMethods: ({ transport, passkey, storage, publish
     getUser: () => Promise<unknown>;
 };
 
-export { type AssertPasskeyInParentResult, KvStorage, type LoginWithCodeParams, PasskeyAssertor, type SendCodeParams, Transport, type VerifyOAuthParams, assertPasskeyInParent, getHeadlessAuthenticationMethods, getHeadlessEthereumMethods, getHeadlessGeneralMethods, getHeadlessSolanaMethods };
+export { type AssertPasskeyInParentResult, type GetPresenceTokenResult, KvStorage, type LoginWithCodeParams, PasskeyAssertor, type SendCodeParams, Transport, type VerifyOAuthParams, assertPasskeyInParent, getHeadlessAuthenticationMethods, getHeadlessEthereumMethods, getHeadlessGeneralMethods, getHeadlessSolanaMethods, getPresenceToken };

package/dist/sdk/index.d.ts

@@ -1,18 +1,30 @@
-import { T as Transport, P as PasskeyAssertor, K as KvStorage } from '../interfaces-9k0eKCc4.js';
-export { O as OAuthOpener, a as PlatformImpls } from '../interfaces-9k0eKCc4.js';
+import { T as Transport, P as PasskeyAssertor, K as KvStorage } from '../interfaces-Bm7fGOAI.js';
+export { O as OAuthOpener, a as PlatformImpls, W as WebAuthnAssertionResponse, b as WebAuthnRequestOptions } from '../interfaces-Bm7fGOAI.js';
 import { C as CachedAssertion } from '../passkey-cache-B9PT3AWX.js';
-import { EthereumSignMessageParams, EthereumSignMessageResult, EthereumSignTransactionParams, EthereumSignTransactionResult, EthereumSignTypedDataParams, EthereumSignTypedDataResult, EthereumSignHashParams, EthereumSignHashResult, EthereumSign7702AuthorizationParams, EthereumSign7702AuthorizationResult, EthereumSendTransactionParams, EthereumSendTransactionResult, EthereumGetBalanceParams, EthereumGetBalanceResult, EthereumGetTokenAccountsByOwnerParams, EthereumGetTokenAccountsByOwnerResult, SolanaSignMessageParams, SolanaSignMessageResult, SolanaSignTransactionParams, SolanaSignTransactionResult, SolanaSendTransactionParams, SolanaSendTransactionResult, SolanaGetBalanceParams, SolanaGetBalanceResult, SolanaGetTokenAccountsByOwnerParams, SolanaGetTokenAccountsByOwnerResult, PublicWallet } from '../types/index.js';
-import '../post-message-C_99BCBh.js';
+import { EthereumSignMessageParams, EthereumSignMessageResult, EthereumSignTransactionParams, EthereumSignTransactionResult, EthereumSignTypedDataParams, EthereumSignTypedDataResult, EthereumSignHashParams, EthereumSignHashResult, EthereumSign7702AuthorizationParams, EthereumSign7702AuthorizationResult, EthereumSendTransactionParams, EthereumSendTransactionResult, EthereumGetBalanceParams, EthereumGetBalanceResult, EthereumGetTokenAccountsByOwnerParams, EthereumGetTokenAccountsByOwnerResult, SolanaSignMessageParams, SolanaSignMessageResult, SolanaSignTransactionParams, SolanaSignTransactionResult, SolanaSendTransactionParams, SolanaSendTransactionResult, SolanaGetBalanceParams, SolanaGetBalanceResult, SolanaGetTokenAccountsByOwnerParams, SolanaGetTokenAccountsByOwnerResult, SendEmailOtpResponse, PublicWallet } from '../types/index.js';
+import '../post-message-CmgAfkOS.js';
 import '../chain-C9dvKXUY.js';
 
 type AssertPasskeyInParentResult = CachedAssertion;
-declare const assertPasskeyInParent: ({ transport, passkey, publishableKey, requireFreshAssertion, }: {
+declare const assertPasskeyInParent: ({ transport, passkey, publishableKey, requireFreshAssertion, validateCredentialInAllowList, }: {
     transport: Transport;
     passkey: PasskeyAssertor;
     publishableKey: string;
     requireFreshAssertion?: boolean;
+    validateCredentialInAllowList?: boolean;
 }) => Promise<AssertPasskeyInParentResult>;
 
+interface GetPresenceTokenResult {
+    presenceToken: string;
+    expiresAt: number;
+}
+declare const getPresenceToken: ({ transport, passkey, publishableKey, relyingPartyOrigin, }: {
+    transport: Transport;
+    passkey: PasskeyAssertor;
+    publishableKey: string;
+    relyingPartyOrigin: string;
+}) => Promise<GetPresenceTokenResult>;
+
 declare const getHeadlessEthereumMethods: ({ transport, passkey, publishableKey, }: {
     transport: Transport;
     passkey: PasskeyAssertor;
@@ -59,17 +71,19 @@ interface VerifyOAuthParams {
     token?: string;
     state?: string;
 }
-declare const getHeadlessAuthenticationMethods: ({ transport, publishableKey, emailConfig, setIsAuthenticated, setUser, }: {
+declare const getHeadlessAuthenticationMethods: ({ transport, publishableKey, setIsAuthenticated, setUser, }: {
     transport: Transport;
     publishableKey: string;
-    emailConfig?: {
-        expiresIn?: number;
-    };
     setIsAuthenticated?: (isAuth: boolean) => void;
     setUser?: (user: unknown | null) => void;
 }) => {
-    /** Send a one-time passcode to the user's email address. */
-    sendCode: (params: SendCodeParams) => Promise<void>;
+    /**
+     * Send a one-time passcode to the user's email address. Returns the
+     * server's response — most importantly `expires_at` (unix seconds),
+     * which the UI uses to render a countdown that cannot drift from the
+     * authoritative server-side TTL.
+     */
+    sendCode: (params: SendCodeParams) => Promise<SendEmailOtpResponse>;
     /**
      * Verify the OTP and complete the login. The iframe-app handles
      * session persistence; on success the SDK flips isAuthenticated and
@@ -123,4 +137,4 @@ declare const getHeadlessGeneralMethods: ({ transport, passkey, storage, publish
     getUser: () => Promise<unknown>;
 };
 
-export { type AssertPasskeyInParentResult, KvStorage, type LoginWithCodeParams, PasskeyAssertor, type SendCodeParams, Transport, type VerifyOAuthParams, assertPasskeyInParent, getHeadlessAuthenticationMethods, getHeadlessEthereumMethods, getHeadlessGeneralMethods, getHeadlessSolanaMethods };
+export { type AssertPasskeyInParentResult, type GetPresenceTokenResult, KvStorage, type LoginWithCodeParams, PasskeyAssertor, type SendCodeParams, Transport, type VerifyOAuthParams, assertPasskeyInParent, getHeadlessAuthenticationMethods, getHeadlessEthereumMethods, getHeadlessGeneralMethods, getHeadlessSolanaMethods, getPresenceToken };