@moon-x/core 0.2.0 → 0.3.0

package/dist/sdk/index.js

@@ -34,7 +34,8 @@ __export(sdk_exports, {
   getHeadlessAuthenticationMethods: () => getHeadlessAuthenticationMethods,
   getHeadlessEthereumMethods: () => getHeadlessEthereumMethods,
   getHeadlessGeneralMethods: () => getHeadlessGeneralMethods,
-  getHeadlessSolanaMethods: () => getHeadlessSolanaMethods
+  getHeadlessSolanaMethods: () => getHeadlessSolanaMethods,
+  getPresenceToken: () => getPresenceToken
 });
 module.exports = __toCommonJS(sdk_exports);
 
@@ -282,6 +283,16 @@ var PostMessageMethod = {
   // begin/verify HTTP calls (where the session JWT lives).
   PASSKEY_REGISTER_BEGIN: "PASSKEY_REGISTER_BEGIN",
   PASSKEY_REGISTER_VERIFY: "PASSKEY_REGISTER_VERIFY",
+  // Passkey-asserted step-up ("presence token"). Same split as register:
+  // parent owns the WebAuthn API call; iframe owns the begin/verify
+  // HTTP halves (where the session JWT lives). Mints a short-lived
+  // (`tt:"presence"`) JWT app backends can verify over JWKS.
+  // CRITICAL: parent MUST strip response.userHandle from the assertion
+  // before posting PASSKEY_PRESENCE_VERIFY. The userHandle carries DEK
+  // material in MoonX's overloaded model and has no business reaching
+  // the server. The server also defensively never reads it.
+  PASSKEY_PRESENCE_BEGIN: "PASSKEY_PRESENCE_BEGIN",
+  PASSKEY_PRESENCE_VERIFY: "PASSKEY_PRESENCE_VERIFY",
   GET_PASSKEY_STATUS: "GET_PASSKEY_STATUS",
   // Parent-side passkey assertion plumbing. Parent calls GET_DEK_INFO
   // to learn which credential IDs to put in allowCredentials and to
@@ -306,7 +317,8 @@ var assertPasskeyInParent = async ({
   transport,
   passkey,
   publishableKey,
-  requireFreshAssertion = false
+  requireFreshAssertion = false,
+  validateCredentialInAllowList = false
 }) => {
   if (!requireFreshAssertion) {
     const cached = readParentAssertCache();
@@ -332,6 +344,9 @@ var assertPasskeyInParent = async ({
     challenge,
     allowCredentials: []
   });
+  if (validateCredentialInAllowList && !allowList.includes(credential.rawIdB64url)) {
+    throw new Error("unknown_passkey_for_this_account");
+  }
   const result = {
     userHandleB64url: credential.userHandleB64url,
     credentialIdB64url: credential.rawIdB64url
@@ -340,6 +355,35 @@ var assertPasskeyInParent = async ({
   return result;
 };
 
+// src/sdk/get-presence-token.ts
+var getPresenceToken = async ({
+  transport,
+  passkey,
+  publishableKey,
+  relyingPartyOrigin
+}) => {
+  const { token, optionsJSON } = await transport.send(
+    PostMessageType.AUTH,
+    PostMessageMethod.PASSKEY_PRESENCE_BEGIN,
+    { publishableKey, relyingPartyOrigin }
+  );
+  const response = await passkey.assertForServer({ optionsJSON });
+  const verify = await transport.send(
+    PostMessageType.AUTH,
+    PostMessageMethod.PASSKEY_PRESENCE_VERIFY,
+    {
+      publishableKey,
+      relyingPartyOrigin,
+      token,
+      response
+    }
+  );
+  return {
+    presenceToken: verify.presence_token,
+    expiresAt: verify.expires_at
+  };
+};
+
 // src/sdk/headless-ethereum.ts
 var getHeadlessEthereumMethods = ({
   transport,
@@ -624,13 +668,17 @@ var getHeadlessSolanaMethods = ({
 var getHeadlessAuthenticationMethods = ({
   transport,
   publishableKey,
-  emailConfig,
   setIsAuthenticated,
   setUser
 }) => ({
-  /** Send a one-time passcode to the user's email address. */
+  /**
+   * Send a one-time passcode to the user's email address. Returns the
+   * server's response — most importantly `expires_at` (unix seconds),
+   * which the UI uses to render a countdown that cannot drift from the
+   * authoritative server-side TTL.
+   */
   sendCode: async (params) => {
-    await transport.send(
+    const response = await transport.send(
       PostMessageType.AUTH,
       PostMessageMethod.LOGIN_CREATE,
       {
@@ -641,6 +689,7 @@ var getHeadlessAuthenticationMethods = ({
     );
     authState.clearEmail();
     authState.setEmail(params.email);
+    return response;
   },
   /**
    * Verify the OTP and complete the login. The iframe-app handles
@@ -656,8 +705,7 @@ var getHeadlessAuthenticationMethods = ({
       {
         email,
         code: params.code,
-        publishableKey,
-        expiresIn: emailConfig?.expiresIn
+        publishableKey
       }
     );
     authState.clearEmail();
@@ -860,5 +908,6 @@ var getHeadlessGeneralMethods = ({
   getHeadlessAuthenticationMethods,
   getHeadlessEthereumMethods,
   getHeadlessGeneralMethods,
-  getHeadlessSolanaMethods
+  getHeadlessSolanaMethods,
+  getPresenceToken
 });

package/dist/sdk/index.mjs

@@ -1,7 +1,7 @@
 import {
   PostMessageMethod,
   PostMessageType
-} from "../chunk-SOKLPX7V.mjs";
+} from "../chunk-VVL65GIB.mjs";
 import {
   arrayLikeToBytes,
   authState,
@@ -22,7 +22,8 @@ var assertPasskeyInParent = async ({
   transport,
   passkey,
   publishableKey,
-  requireFreshAssertion = false
+  requireFreshAssertion = false,
+  validateCredentialInAllowList = false
 }) => {
   if (!requireFreshAssertion) {
     const cached = readParentAssertCache();
@@ -48,6 +49,9 @@ var assertPasskeyInParent = async ({
     challenge,
     allowCredentials: []
   });
+  if (validateCredentialInAllowList && !allowList.includes(credential.rawIdB64url)) {
+    throw new Error("unknown_passkey_for_this_account");
+  }
   const result = {
     userHandleB64url: credential.userHandleB64url,
     credentialIdB64url: credential.rawIdB64url
@@ -56,6 +60,35 @@ var assertPasskeyInParent = async ({
   return result;
 };
 
+// src/sdk/get-presence-token.ts
+var getPresenceToken = async ({
+  transport,
+  passkey,
+  publishableKey,
+  relyingPartyOrigin
+}) => {
+  const { token, optionsJSON } = await transport.send(
+    PostMessageType.AUTH,
+    PostMessageMethod.PASSKEY_PRESENCE_BEGIN,
+    { publishableKey, relyingPartyOrigin }
+  );
+  const response = await passkey.assertForServer({ optionsJSON });
+  const verify = await transport.send(
+    PostMessageType.AUTH,
+    PostMessageMethod.PASSKEY_PRESENCE_VERIFY,
+    {
+      publishableKey,
+      relyingPartyOrigin,
+      token,
+      response
+    }
+  );
+  return {
+    presenceToken: verify.presence_token,
+    expiresAt: verify.expires_at
+  };
+};
+
 // src/sdk/headless-ethereum.ts
 var getHeadlessEthereumMethods = ({
   transport,
@@ -340,13 +373,17 @@ var getHeadlessSolanaMethods = ({
 var getHeadlessAuthenticationMethods = ({
   transport,
   publishableKey,
-  emailConfig,
   setIsAuthenticated,
   setUser
 }) => ({
-  /** Send a one-time passcode to the user's email address. */
+  /**
+   * Send a one-time passcode to the user's email address. Returns the
+   * server's response — most importantly `expires_at` (unix seconds),
+   * which the UI uses to render a countdown that cannot drift from the
+   * authoritative server-side TTL.
+   */
   sendCode: async (params) => {
-    await transport.send(
+    const response = await transport.send(
       PostMessageType.AUTH,
       PostMessageMethod.LOGIN_CREATE,
       {
@@ -357,6 +394,7 @@ var getHeadlessAuthenticationMethods = ({
     );
     authState.clearEmail();
     authState.setEmail(params.email);
+    return response;
   },
   /**
    * Verify the OTP and complete the login. The iframe-app handles
@@ -372,8 +410,7 @@ var getHeadlessAuthenticationMethods = ({
       {
         email,
         code: params.code,
-        publishableKey,
-        expiresIn: emailConfig?.expiresIn
+        publishableKey
       }
     );
     authState.clearEmail();
@@ -575,5 +612,6 @@ export {
   getHeadlessAuthenticationMethods,
   getHeadlessEthereumMethods,
   getHeadlessGeneralMethods,
-  getHeadlessSolanaMethods
+  getHeadlessSolanaMethods,
+  getPresenceToken
 };

package/dist/types/index.d.mts

@@ -205,6 +205,23 @@ interface IdentityTokenClaims extends BaseTokenClaims {
     picture?: string;
     [key: string]: unknown;
 }
+/**
+ * Presence-token claims. Minted after a verified passkey assertion
+ * (the parent-side "step-up" ceremony). Customer backends verify these
+ * via the app's JWKS to gate high-risk routes without holding their
+ * own session/step-up model. Short-lived (5min by default, server-side
+ * configurable).
+ *
+ * `tt: "presence"` is the type discriminator — the verify primitive
+ * rejects anything else, so a long-lived access token cannot be
+ * substituted for a presence proof.
+ */
+interface PresenceTokenClaims extends BaseTokenClaims {
+    /** Token type discriminator. Always "presence" for this shape. */
+    tt: "presence";
+    /** Base64url credential id of the WebAuthn credential that asserted. */
+    cid: string;
+}
 /** Result of `@moon-x/node-sdk`'s `client.auth.verifySession(...)`. */
 interface VerifiedSession {
     access: AccessTokenClaims;
@@ -728,7 +745,6 @@ interface PasskeyEnrollConfig {
 }
 interface EmailOtpConfig {
     skipVerifiedSuccess?: boolean;
-    expiresIn?: number;
     verifiedDisplayTime?: number;
     verifyEmailTitle?: string;
     verifyEmailResendTitle?: string;
@@ -897,7 +913,6 @@ interface AuthProviderConfig {
 interface SendEmailOtpRequest {
     publishableKey: string;
     email: string;
-    expiresIn?: number;
 }
 interface VerifyEmailOtpRequest {
     publishableKey: string;
@@ -906,6 +921,7 @@ interface VerifyEmailOtpRequest {
 }
 interface SendEmailOtpResponse {
     ok: boolean;
+    expires_at: number;
 }
 interface VerifyEmailOtpUser {
     id: string;
@@ -1187,4 +1203,4 @@ interface WalletVerifyRequest {
     sessionExpiresIn: number;
 }
 
-export { type AccessTokenClaims, type AppConfigRequest, type AppConfigResponse, type AttachOAuthTokenRequest, type AttachOAuthTokenResponse, type AuthAppearance, type AuthFlow, type AuthFlowComponent, type AuthLoginMethod, type AuthProviderConfig, type BaseGetBalanceParams, type BaseGetBalanceResult, type BaseGetTokenAccountsParams, type BaseSendTransactionParams, type BaseSendTransactionResult, type BaseSignMessageParams, type BaseSignMessageResult, type BaseSignTransactionParams, type BaseSignTransactionResult, type BaseTokenClaims, type BaseUIOptions, type BaseWalletHooks, Chain, ChainLikeWithId, type ContractUIOptions, type CreateWalletResponse, type DefaultFundingMethod, type DeleteSessionRequest, type DeleteSessionResponse, type DetachOAuthTokenRequest, type DeviceFingerprint, type DisplayMode, type EmailOtpConfig, type EmailOtpFlowState, type EthereumFundingConfig, type EthereumGetBalanceParams, type EthereumGetBalanceResult, type EthereumGetTokenAccountsByOwnerParams, type EthereumGetTokenAccountsByOwnerResult, type EthereumSendTransactionParams, type EthereumSendTransactionRequest, type EthereumSendTransactionResult, type EthereumSign7702AuthorizationParams, type EthereumSign7702AuthorizationResult, type EthereumSignHashParams, type EthereumSignHashResult, type EthereumSignMessageParams, type EthereumSignMessageResult, type EthereumSignTransactionParams, type EthereumSignTransactionResult, type EthereumSignTypedDataParams, type EthereumSignTypedDataResult, type EthereumSwitchChainParams, type ExportKeyConfig, type Factor, type FlexibleTheme, type FundWalletConfig, type FundingEvents, type FundingMethod, type FundingUIConfig, type GetCurrentSessionRequest, type GetCurrentSessionResponse, type Hex, type IdentityTokenClaims, type IdpProvider, type IsAuthenticatedRequest, type IsAuthenticatedResponse, type LoginTokenBundle, type LogoutRequest, type LogoutResponse, type MessageTypeProperty, type MessageTypes, type MoonKeyThemeConfig, type MoonPaySignRequest, type MoonPaySignResponse, type MpcKeyShares, Network, type OAuthRequest, type OAuthResponse, type OnrampFundingSettings, type PasskeyEnrollConfig, type PasskeySettings, type PreferredCardProvider, type PrefillConfig, type PublicEthereumWallet, type PublicSessionData, type PublicWallet, type RefreshSessionRequest, type RefreshSessionResponse, type RetrieveWalletKeyRequest, type RetrieveWalletKeyResponse, type SdkSettings, type SendEmailOtpRequest, type SendEmailOtpResponse, type SendTransactionConfig, type SendTransactionRequest, type SessionData, type SharesDeviceRequest, type SharesDeviceResponse, type Sign7702AuthorizationError, type Sign7702AuthorizationParams, type Sign7702AuthorizationResponse, type Sign7702AuthorizationResult, type SignMessageConfig, type SignTransactionConfig, type SignTypedDataError, type SignTypedDataParams, type SignTypedDataResponse, type SignTypedDataResult, type SmsSettings, type SolanaChain, type SolanaFundingConfig, type SolanaGetBalanceParams, type SolanaGetBalanceResult, type SolanaGetTokenAccountsByOwnerParams, type SolanaGetTokenAccountsByOwnerResult, type SolanaSendTransactionParams, type SolanaSendTransactionResult, type SolanaSignMessageParams, type SolanaSignMessageResult, type SolanaSignTransactionParams, type SolanaSignTransactionResult, type TransactionCommitment, type TransactionEncoding, type TransactionUIOptions, type TypedMessage, type UseFundWalletInterface, type UsersMePublicResponse, type UsersMeRequest, type UsersMeResponse, type VerifiedSession, type VerifyEmailOtpRequest, type VerifyEmailOtpResponse, type VerifyEmailOtpUser, type VerifyOAuthTokenRequest, type VerifyOAuthTokenResponse, type VerifySiweWalletRegistrationRequest, WALLET_ERROR_CODES, type Wallet, type WalletChain, type WalletChainType, type WalletConnectConfig, WalletCreationError, type WalletError, type WalletErrorCode, type WalletKeyRequest, type WalletListEntry, type WalletRegistrationNonceRequest, type WalletRegistrationNonceResponse, type WalletType, type WalletVerifyRequest };
+export { type AccessTokenClaims, type AppConfigRequest, type AppConfigResponse, type AttachOAuthTokenRequest, type AttachOAuthTokenResponse, type AuthAppearance, type AuthFlow, type AuthFlowComponent, type AuthLoginMethod, type AuthProviderConfig, type BaseGetBalanceParams, type BaseGetBalanceResult, type BaseGetTokenAccountsParams, type BaseSendTransactionParams, type BaseSendTransactionResult, type BaseSignMessageParams, type BaseSignMessageResult, type BaseSignTransactionParams, type BaseSignTransactionResult, type BaseTokenClaims, type BaseUIOptions, type BaseWalletHooks, Chain, ChainLikeWithId, type ContractUIOptions, type CreateWalletResponse, type DefaultFundingMethod, type DeleteSessionRequest, type DeleteSessionResponse, type DetachOAuthTokenRequest, type DeviceFingerprint, type DisplayMode, type EmailOtpConfig, type EmailOtpFlowState, type EthereumFundingConfig, type EthereumGetBalanceParams, type EthereumGetBalanceResult, type EthereumGetTokenAccountsByOwnerParams, type EthereumGetTokenAccountsByOwnerResult, type EthereumSendTransactionParams, type EthereumSendTransactionRequest, type EthereumSendTransactionResult, type EthereumSign7702AuthorizationParams, type EthereumSign7702AuthorizationResult, type EthereumSignHashParams, type EthereumSignHashResult, type EthereumSignMessageParams, type EthereumSignMessageResult, type EthereumSignTransactionParams, type EthereumSignTransactionResult, type EthereumSignTypedDataParams, type EthereumSignTypedDataResult, type EthereumSwitchChainParams, type ExportKeyConfig, type Factor, type FlexibleTheme, type FundWalletConfig, type FundingEvents, type FundingMethod, type FundingUIConfig, type GetCurrentSessionRequest, type GetCurrentSessionResponse, type Hex, type IdentityTokenClaims, type IdpProvider, type IsAuthenticatedRequest, type IsAuthenticatedResponse, type LoginTokenBundle, type LogoutRequest, type LogoutResponse, type MessageTypeProperty, type MessageTypes, type MoonKeyThemeConfig, type MoonPaySignRequest, type MoonPaySignResponse, type MpcKeyShares, Network, type OAuthRequest, type OAuthResponse, type OnrampFundingSettings, type PasskeyEnrollConfig, type PasskeySettings, type PreferredCardProvider, type PrefillConfig, type PresenceTokenClaims, type PublicEthereumWallet, type PublicSessionData, type PublicWallet, type RefreshSessionRequest, type RefreshSessionResponse, type RetrieveWalletKeyRequest, type RetrieveWalletKeyResponse, type SdkSettings, type SendEmailOtpRequest, type SendEmailOtpResponse, type SendTransactionConfig, type SendTransactionRequest, type SessionData, type SharesDeviceRequest, type SharesDeviceResponse, type Sign7702AuthorizationError, type Sign7702AuthorizationParams, type Sign7702AuthorizationResponse, type Sign7702AuthorizationResult, type SignMessageConfig, type SignTransactionConfig, type SignTypedDataError, type SignTypedDataParams, type SignTypedDataResponse, type SignTypedDataResult, type SmsSettings, type SolanaChain, type SolanaFundingConfig, type SolanaGetBalanceParams, type SolanaGetBalanceResult, type SolanaGetTokenAccountsByOwnerParams, type SolanaGetTokenAccountsByOwnerResult, type SolanaSendTransactionParams, type SolanaSendTransactionResult, type SolanaSignMessageParams, type SolanaSignMessageResult, type SolanaSignTransactionParams, type SolanaSignTransactionResult, type TransactionCommitment, type TransactionEncoding, type TransactionUIOptions, type TypedMessage, type UseFundWalletInterface, type UsersMePublicResponse, type UsersMeRequest, type UsersMeResponse, type VerifiedSession, type VerifyEmailOtpRequest, type VerifyEmailOtpResponse, type VerifyEmailOtpUser, type VerifyOAuthTokenRequest, type VerifyOAuthTokenResponse, type VerifySiweWalletRegistrationRequest, WALLET_ERROR_CODES, type Wallet, type WalletChain, type WalletChainType, type WalletConnectConfig, WalletCreationError, type WalletError, type WalletErrorCode, type WalletKeyRequest, type WalletListEntry, type WalletRegistrationNonceRequest, type WalletRegistrationNonceResponse, type WalletType, type WalletVerifyRequest };

package/dist/types/index.d.ts

@@ -205,6 +205,23 @@ interface IdentityTokenClaims extends BaseTokenClaims {
     picture?: string;
     [key: string]: unknown;
 }
+/**
+ * Presence-token claims. Minted after a verified passkey assertion
+ * (the parent-side "step-up" ceremony). Customer backends verify these
+ * via the app's JWKS to gate high-risk routes without holding their
+ * own session/step-up model. Short-lived (5min by default, server-side
+ * configurable).
+ *
+ * `tt: "presence"` is the type discriminator — the verify primitive
+ * rejects anything else, so a long-lived access token cannot be
+ * substituted for a presence proof.
+ */
+interface PresenceTokenClaims extends BaseTokenClaims {
+    /** Token type discriminator. Always "presence" for this shape. */
+    tt: "presence";
+    /** Base64url credential id of the WebAuthn credential that asserted. */
+    cid: string;
+}
 /** Result of `@moon-x/node-sdk`'s `client.auth.verifySession(...)`. */
 interface VerifiedSession {
     access: AccessTokenClaims;
@@ -728,7 +745,6 @@ interface PasskeyEnrollConfig {
 }
 interface EmailOtpConfig {
     skipVerifiedSuccess?: boolean;
-    expiresIn?: number;
     verifiedDisplayTime?: number;
     verifyEmailTitle?: string;
     verifyEmailResendTitle?: string;
@@ -897,7 +913,6 @@ interface AuthProviderConfig {
 interface SendEmailOtpRequest {
     publishableKey: string;
     email: string;
-    expiresIn?: number;
 }
 interface VerifyEmailOtpRequest {
     publishableKey: string;
@@ -906,6 +921,7 @@ interface VerifyEmailOtpRequest {
 }
 interface SendEmailOtpResponse {
     ok: boolean;
+    expires_at: number;
 }
 interface VerifyEmailOtpUser {
     id: string;
@@ -1187,4 +1203,4 @@ interface WalletVerifyRequest {
     sessionExpiresIn: number;
 }
 
-export { type AccessTokenClaims, type AppConfigRequest, type AppConfigResponse, type AttachOAuthTokenRequest, type AttachOAuthTokenResponse, type AuthAppearance, type AuthFlow, type AuthFlowComponent, type AuthLoginMethod, type AuthProviderConfig, type BaseGetBalanceParams, type BaseGetBalanceResult, type BaseGetTokenAccountsParams, type BaseSendTransactionParams, type BaseSendTransactionResult, type BaseSignMessageParams, type BaseSignMessageResult, type BaseSignTransactionParams, type BaseSignTransactionResult, type BaseTokenClaims, type BaseUIOptions, type BaseWalletHooks, Chain, ChainLikeWithId, type ContractUIOptions, type CreateWalletResponse, type DefaultFundingMethod, type DeleteSessionRequest, type DeleteSessionResponse, type DetachOAuthTokenRequest, type DeviceFingerprint, type DisplayMode, type EmailOtpConfig, type EmailOtpFlowState, type EthereumFundingConfig, type EthereumGetBalanceParams, type EthereumGetBalanceResult, type EthereumGetTokenAccountsByOwnerParams, type EthereumGetTokenAccountsByOwnerResult, type EthereumSendTransactionParams, type EthereumSendTransactionRequest, type EthereumSendTransactionResult, type EthereumSign7702AuthorizationParams, type EthereumSign7702AuthorizationResult, type EthereumSignHashParams, type EthereumSignHashResult, type EthereumSignMessageParams, type EthereumSignMessageResult, type EthereumSignTransactionParams, type EthereumSignTransactionResult, type EthereumSignTypedDataParams, type EthereumSignTypedDataResult, type EthereumSwitchChainParams, type ExportKeyConfig, type Factor, type FlexibleTheme, type FundWalletConfig, type FundingEvents, type FundingMethod, type FundingUIConfig, type GetCurrentSessionRequest, type GetCurrentSessionResponse, type Hex, type IdentityTokenClaims, type IdpProvider, type IsAuthenticatedRequest, type IsAuthenticatedResponse, type LoginTokenBundle, type LogoutRequest, type LogoutResponse, type MessageTypeProperty, type MessageTypes, type MoonKeyThemeConfig, type MoonPaySignRequest, type MoonPaySignResponse, type MpcKeyShares, Network, type OAuthRequest, type OAuthResponse, type OnrampFundingSettings, type PasskeyEnrollConfig, type PasskeySettings, type PreferredCardProvider, type PrefillConfig, type PublicEthereumWallet, type PublicSessionData, type PublicWallet, type RefreshSessionRequest, type RefreshSessionResponse, type RetrieveWalletKeyRequest, type RetrieveWalletKeyResponse, type SdkSettings, type SendEmailOtpRequest, type SendEmailOtpResponse, type SendTransactionConfig, type SendTransactionRequest, type SessionData, type SharesDeviceRequest, type SharesDeviceResponse, type Sign7702AuthorizationError, type Sign7702AuthorizationParams, type Sign7702AuthorizationResponse, type Sign7702AuthorizationResult, type SignMessageConfig, type SignTransactionConfig, type SignTypedDataError, type SignTypedDataParams, type SignTypedDataResponse, type SignTypedDataResult, type SmsSettings, type SolanaChain, type SolanaFundingConfig, type SolanaGetBalanceParams, type SolanaGetBalanceResult, type SolanaGetTokenAccountsByOwnerParams, type SolanaGetTokenAccountsByOwnerResult, type SolanaSendTransactionParams, type SolanaSendTransactionResult, type SolanaSignMessageParams, type SolanaSignMessageResult, type SolanaSignTransactionParams, type SolanaSignTransactionResult, type TransactionCommitment, type TransactionEncoding, type TransactionUIOptions, type TypedMessage, type UseFundWalletInterface, type UsersMePublicResponse, type UsersMeRequest, type UsersMeResponse, type VerifiedSession, type VerifyEmailOtpRequest, type VerifyEmailOtpResponse, type VerifyEmailOtpUser, type VerifyOAuthTokenRequest, type VerifyOAuthTokenResponse, type VerifySiweWalletRegistrationRequest, WALLET_ERROR_CODES, type Wallet, type WalletChain, type WalletChainType, type WalletConnectConfig, WalletCreationError, type WalletError, type WalletErrorCode, type WalletKeyRequest, type WalletListEntry, type WalletRegistrationNonceRequest, type WalletRegistrationNonceResponse, type WalletType, type WalletVerifyRequest };
+export { type AccessTokenClaims, type AppConfigRequest, type AppConfigResponse, type AttachOAuthTokenRequest, type AttachOAuthTokenResponse, type AuthAppearance, type AuthFlow, type AuthFlowComponent, type AuthLoginMethod, type AuthProviderConfig, type BaseGetBalanceParams, type BaseGetBalanceResult, type BaseGetTokenAccountsParams, type BaseSendTransactionParams, type BaseSendTransactionResult, type BaseSignMessageParams, type BaseSignMessageResult, type BaseSignTransactionParams, type BaseSignTransactionResult, type BaseTokenClaims, type BaseUIOptions, type BaseWalletHooks, Chain, ChainLikeWithId, type ContractUIOptions, type CreateWalletResponse, type DefaultFundingMethod, type DeleteSessionRequest, type DeleteSessionResponse, type DetachOAuthTokenRequest, type DeviceFingerprint, type DisplayMode, type EmailOtpConfig, type EmailOtpFlowState, type EthereumFundingConfig, type EthereumGetBalanceParams, type EthereumGetBalanceResult, type EthereumGetTokenAccountsByOwnerParams, type EthereumGetTokenAccountsByOwnerResult, type EthereumSendTransactionParams, type EthereumSendTransactionRequest, type EthereumSendTransactionResult, type EthereumSign7702AuthorizationParams, type EthereumSign7702AuthorizationResult, type EthereumSignHashParams, type EthereumSignHashResult, type EthereumSignMessageParams, type EthereumSignMessageResult, type EthereumSignTransactionParams, type EthereumSignTransactionResult, type EthereumSignTypedDataParams, type EthereumSignTypedDataResult, type EthereumSwitchChainParams, type ExportKeyConfig, type Factor, type FlexibleTheme, type FundWalletConfig, type FundingEvents, type FundingMethod, type FundingUIConfig, type GetCurrentSessionRequest, type GetCurrentSessionResponse, type Hex, type IdentityTokenClaims, type IdpProvider, type IsAuthenticatedRequest, type IsAuthenticatedResponse, type LoginTokenBundle, type LogoutRequest, type LogoutResponse, type MessageTypeProperty, type MessageTypes, type MoonKeyThemeConfig, type MoonPaySignRequest, type MoonPaySignResponse, type MpcKeyShares, Network, type OAuthRequest, type OAuthResponse, type OnrampFundingSettings, type PasskeyEnrollConfig, type PasskeySettings, type PreferredCardProvider, type PrefillConfig, type PresenceTokenClaims, type PublicEthereumWallet, type PublicSessionData, type PublicWallet, type RefreshSessionRequest, type RefreshSessionResponse, type RetrieveWalletKeyRequest, type RetrieveWalletKeyResponse, type SdkSettings, type SendEmailOtpRequest, type SendEmailOtpResponse, type SendTransactionConfig, type SendTransactionRequest, type SessionData, type SharesDeviceRequest, type SharesDeviceResponse, type Sign7702AuthorizationError, type Sign7702AuthorizationParams, type Sign7702AuthorizationResponse, type Sign7702AuthorizationResult, type SignMessageConfig, type SignTransactionConfig, type SignTypedDataError, type SignTypedDataParams, type SignTypedDataResponse, type SignTypedDataResult, type SmsSettings, type SolanaChain, type SolanaFundingConfig, type SolanaGetBalanceParams, type SolanaGetBalanceResult, type SolanaGetTokenAccountsByOwnerParams, type SolanaGetTokenAccountsByOwnerResult, type SolanaSendTransactionParams, type SolanaSendTransactionResult, type SolanaSignMessageParams, type SolanaSignMessageResult, type SolanaSignTransactionParams, type SolanaSignTransactionResult, type TransactionCommitment, type TransactionEncoding, type TransactionUIOptions, type TypedMessage, type UseFundWalletInterface, type UsersMePublicResponse, type UsersMeRequest, type UsersMeResponse, type VerifiedSession, type VerifyEmailOtpRequest, type VerifyEmailOtpResponse, type VerifyEmailOtpUser, type VerifyOAuthTokenRequest, type VerifyOAuthTokenResponse, type VerifySiweWalletRegistrationRequest, WALLET_ERROR_CODES, type Wallet, type WalletChain, type WalletChainType, type WalletConnectConfig, WalletCreationError, type WalletError, type WalletErrorCode, type WalletKeyRequest, type WalletListEntry, type WalletRegistrationNonceRequest, type WalletRegistrationNonceResponse, type WalletType, type WalletVerifyRequest };

package/dist/utils/index.d.mts

@@ -1,4 +1,4 @@
-export { F as FORWARDED_ERROR_FIELDS, P as PostMessageClient, a as PostMessageMethod, b as PostMessageServer, c as PostMessageType } from '../post-message-C_99BCBh.mjs';
+export { F as FORWARDED_ERROR_FIELDS, P as PostMessageClient, a as PostMessageMethod, b as PostMessageServer, c as PostMessageType } from '../post-message-CmgAfkOS.mjs';
 
 /**
  * Get the appropriate MoonKey API URL based on environment configuration

package/dist/utils/index.d.ts

@@ -1,4 +1,4 @@
-export { F as FORWARDED_ERROR_FIELDS, P as PostMessageClient, a as PostMessageMethod, b as PostMessageServer, c as PostMessageType } from '../post-message-C_99BCBh.js';
+export { F as FORWARDED_ERROR_FIELDS, P as PostMessageClient, a as PostMessageMethod, b as PostMessageServer, c as PostMessageType } from '../post-message-CmgAfkOS.js';
 
 /**
  * Get the appropriate MoonKey API URL based on environment configuration

package/dist/utils/index.js

@@ -156,6 +156,16 @@ var PostMessageMethod = {
   // begin/verify HTTP calls (where the session JWT lives).
   PASSKEY_REGISTER_BEGIN: "PASSKEY_REGISTER_BEGIN",
   PASSKEY_REGISTER_VERIFY: "PASSKEY_REGISTER_VERIFY",
+  // Passkey-asserted step-up ("presence token"). Same split as register:
+  // parent owns the WebAuthn API call; iframe owns the begin/verify
+  // HTTP halves (where the session JWT lives). Mints a short-lived
+  // (`tt:"presence"`) JWT app backends can verify over JWKS.
+  // CRITICAL: parent MUST strip response.userHandle from the assertion
+  // before posting PASSKEY_PRESENCE_VERIFY. The userHandle carries DEK
+  // material in MoonX's overloaded model and has no business reaching
+  // the server. The server also defensively never reads it.
+  PASSKEY_PRESENCE_BEGIN: "PASSKEY_PRESENCE_BEGIN",
+  PASSKEY_PRESENCE_VERIFY: "PASSKEY_PRESENCE_VERIFY",
   GET_PASSKEY_STATUS: "GET_PASSKEY_STATUS",
   // Parent-side passkey assertion plumbing. Parent calls GET_DEK_INFO
   // to learn which credential IDs to put in allowCredentials and to

package/dist/utils/index.mjs

@@ -9,7 +9,7 @@ import {
   PostMessageMethod,
   PostMessageServer,
   PostMessageType
-} from "../chunk-SOKLPX7V.mjs";
+} from "../chunk-VVL65GIB.mjs";
 import {
   getMoonKeyApiUrl
 } from "../chunk-GQKIA37O.mjs";

package/dist/web/index.d.mts

@@ -1,5 +1,5 @@
-import { P as PostMessageClient } from '../post-message-C_99BCBh.mjs';
-import { T as Transport, P as PasskeyAssertor, K as KvStorage } from '../interfaces-fNhwnCeY.mjs';
+import { P as PostMessageClient } from '../post-message-CmgAfkOS.mjs';
+import { T as Transport, P as PasskeyAssertor, K as KvStorage } from '../interfaces-CYtJHALV.mjs';
 
 declare const getCachedPostMessageClient: (contentWindow: Window) => PostMessageClient;
 /**

package/dist/web/index.d.ts

@@ -1,5 +1,5 @@
-import { P as PostMessageClient } from '../post-message-C_99BCBh.js';
-import { T as Transport, P as PasskeyAssertor, K as KvStorage } from '../interfaces-9k0eKCc4.js';
+import { P as PostMessageClient } from '../post-message-CmgAfkOS.js';
+import { T as Transport, P as PasskeyAssertor, K as KvStorage } from '../interfaces-Bm7fGOAI.js';
 
 declare const getCachedPostMessageClient: (contentWindow: Window) => PostMessageClient;
 /**

package/dist/web/index.js

@@ -1,9 +1,7 @@
 "use strict";
-var __create = Object.create;
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
-var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
 var __export = (target, all) => {
   for (var name in all)
@@ -17,14 +15,6 @@ var __copyProps = (to, from, except, desc) => {
   }
   return to;
 };
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
-  // If the importer is in node compatibility mode or this is not an ESM
-  // file that has been converted to a CommonJS file using a Babel-
-  // compatible transform (i.e. "__esModule" has not been set), then set
-  // "default" to the CommonJS "module.exports" for node compatibility.
-  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
-  mod
-));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
 // src/web/index.ts
@@ -310,127 +300,44 @@ var createIframeTransport = ({
   isReady
 });
 
-// src/lib/auth/authentication-state.ts
-var AuthenticationState = class {
-  constructor() {
-    this.email = null;
-  }
-  setEmail(email) {
-    this.email = email;
-  }
-  getEmail() {
-    return this.email;
-  }
-  clearEmail() {
-    this.email = null;
-  }
-  clear() {
-    this.clearEmail();
-  }
-};
-var authState = new AuthenticationState();
-
-// src/lib/passkey/passkey-codec.ts
-var fromB64url = (b64url) => {
-  const base64 = b64url.replace(/-/g, "+").replace(/_/g, "/");
-  const padded = base64 + "=".repeat((4 - base64.length % 4) % 4);
-  const binary = atob(padded);
-  const bytes = new Uint8Array(binary.length);
-  for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i);
-  return bytes;
-};
-var toB64url = (bytes) => {
-  let str = "";
-  for (let i = 0; i < bytes.length; i++) str += String.fromCharCode(bytes[i]);
-  return btoa(str).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
-};
-
-// src/lib/ethereum/chains.ts
-var import_viem = require("viem");
-
-// src/lib/ethereum/siwe.ts
-var import_siwe = require("siwe");
-var import_viem2 = require("viem");
-
-// src/lib/ethereum/tx-prep.ts
-var import_viem3 = require("viem");
-
-// src/lib/solana/siws.ts
-var nacl = __toESM(require("tweetnacl"));
-
-// src/lib/solana/transaction-log-parser.ts
-var import_web3 = require("@solana/web3.js");
-var import_bn = __toESM(require("bn.js"));
-
 // src/web/webauthn-passkey.ts
+var import_browser = require("@simplewebauthn/browser");
 var createWebAuthnPasskey = () => ({
   assert: async ({ rpId, challenge }) => {
-    const challengeBytes = fromB64url(challenge);
-    const credential = await navigator.credentials.get({
-      publicKey: {
-        challenge: challengeBytes,
+    const result = await (0, import_browser.startAuthentication)({
+      optionsJSON: {
+        challenge,
         rpId,
         userVerification: "preferred",
-        // Empty allowCredentials → discoverable login → userHandle is
-        // REQUIRED on the response. See `parent-passkey-assert.ts`
-        // for the full rationale.
         allowCredentials: []
       }
     });
-    if (!credential) throw new Error("passkey_assertion_cancelled");
-    const assertion = credential.response;
-    if (!assertion.userHandle) {
+    if (!result.response.userHandle) {
       throw new Error("user_handle_missing");
     }
     return {
-      rawIdB64url: toB64url(new Uint8Array(credential.rawId)),
-      userHandleB64url: toB64url(new Uint8Array(assertion.userHandle))
+      rawIdB64url: result.rawId,
+      userHandleB64url: result.response.userHandle
     };
   },
-  create: async ({
-    rpId,
-    rpName,
-    userId,
-    userName,
-    userDisplayName,
-    challenge,
-    excludeCredentials
-  }) => {
-    const challengeBytes = fromB64url(challenge);
-    const credential = await navigator.credentials.create({
-      publicKey: {
-        rp: { id: rpId, name: rpName },
-        user: {
-          id: userId,
-          name: userName,
-          displayName: userDisplayName
-        },
-        challenge: challengeBytes,
-        pubKeyCredParams: [
-          { type: "public-key", alg: -7 },
-          // ES256
-          { type: "public-key", alg: -257 }
-          // RS256
-        ],
-        authenticatorSelection: {
-          residentKey: "required",
-          userVerification: "preferred"
-        },
-        excludeCredentials: (excludeCredentials ?? []).map((id) => ({
-          id: fromB64url(id),
-          type: "public-key"
-        }))
-      }
+  assertForServer: async ({ optionsJSON }) => {
+    const result = await (0, import_browser.startAuthentication)({
+      optionsJSON
     });
-    if (!credential) throw new Error("passkey_registration_cancelled");
-    const attestation = credential.response;
-    return {
-      rawIdB64url: toB64url(new Uint8Array(credential.rawId)),
-      clientDataJSONB64url: toB64url(new Uint8Array(attestation.clientDataJSON)),
-      attestationObjectB64url: toB64url(
-        new Uint8Array(attestation.attestationObject)
-      )
+    const sanitized = {
+      id: result.id,
+      rawId: result.rawId,
+      type: result.type,
+      response: {
+        clientDataJSON: result.response.clientDataJSON,
+        authenticatorData: result.response.authenticatorData,
+        signature: result.response.signature,
+        userHandle: void 0
+      },
+      clientExtensionResults: result.clientExtensionResults,
+      authenticatorAttachment: result.authenticatorAttachment
     };
+    return sanitized;
   }
 });