@moon-x/core 0.2.0 → 0.4.0

package/dist/sdk/index.js

@@ -31,10 +31,13 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 var sdk_exports = {};
 __export(sdk_exports, {
   assertPasskeyInParent: () => assertPasskeyInParent,
+  flattenPresenceTokens: () => flattenPresenceTokens,
   getHeadlessAuthenticationMethods: () => getHeadlessAuthenticationMethods,
   getHeadlessEthereumMethods: () => getHeadlessEthereumMethods,
   getHeadlessGeneralMethods: () => getHeadlessGeneralMethods,
-  getHeadlessSolanaMethods: () => getHeadlessSolanaMethods
+  getHeadlessSolanaMethods: () => getHeadlessSolanaMethods,
+  getInternalPresenceTokens: () => getInternalPresenceTokens,
+  getPresenceToken: () => getPresenceToken
 });
 module.exports = __toCommonJS(sdk_exports);
 
@@ -65,34 +68,6 @@ var toB64url = (bytes) => {
   return btoa(str).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
 };
 
-// src/lib/passkey/passkey-cache.ts
-var cacheTtlMs = 0;
-var cache = null;
-var clearParentAssertCache = () => {
-  cache = null;
-};
-var readParentAssertCache = () => {
-  if (cacheTtlMs <= 0) return null;
-  if (!cache) return null;
-  if (Date.now() - cache.ts >= cacheTtlMs) return null;
-  return {
-    userHandleB64url: cache.userHandleB64url,
-    credentialIdB64url: cache.credentialIdB64url
-  };
-};
-var writeParentAssertCache = (entry) => {
-  if (cacheTtlMs <= 0) return;
-  cache = { ...entry, ts: Date.now() };
-};
-var withClearOnFailure = async (fn) => {
-  try {
-    return await fn();
-  } catch (error) {
-    clearParentAssertCache();
-    throw error;
-  }
-};
-
 // src/lib/ethereum/chains.ts
 var import_viem = require("viem");
 
@@ -282,6 +257,16 @@ var PostMessageMethod = {
   // begin/verify HTTP calls (where the session JWT lives).
   PASSKEY_REGISTER_BEGIN: "PASSKEY_REGISTER_BEGIN",
   PASSKEY_REGISTER_VERIFY: "PASSKEY_REGISTER_VERIFY",
+  // Passkey-asserted step-up ("presence token"). Same split as register:
+  // parent owns the WebAuthn API call; iframe owns the begin/verify
+  // HTTP halves (where the session JWT lives). Mints a short-lived
+  // (`tt:"presence"`) JWT app backends can verify over JWKS.
+  // CRITICAL: parent MUST strip response.userHandle from the assertion
+  // before posting PASSKEY_PRESENCE_VERIFY. The userHandle carries DEK
+  // material in MoonX's overloaded model and has no business reaching
+  // the server. The server also defensively never reads it.
+  PASSKEY_PRESENCE_BEGIN: "PASSKEY_PRESENCE_BEGIN",
+  PASSKEY_PRESENCE_VERIFY: "PASSKEY_PRESENCE_VERIFY",
   GET_PASSKEY_STATUS: "GET_PASSKEY_STATUS",
   // Parent-side passkey assertion plumbing. Parent calls GET_DEK_INFO
   // to learn which credential IDs to put in allowCredentials and to
@@ -306,12 +291,8 @@ var assertPasskeyInParent = async ({
   transport,
   passkey,
   publishableKey,
-  requireFreshAssertion = false
+  validateCredentialInAllowList = false
 }) => {
-  if (!requireFreshAssertion) {
-    const cached = readParentAssertCache();
-    if (cached) return cached;
-  }
   const dekInfo = await transport.send(
     PostMessageType.AUTH,
     PostMessageMethod.GET_DEK_INFO,
@@ -332,27 +313,104 @@ var assertPasskeyInParent = async ({
     challenge,
     allowCredentials: []
   });
-  const result = {
+  if (validateCredentialInAllowList && !allowList.includes(credential.rawIdB64url)) {
+    throw new Error("unknown_passkey_for_this_account");
+  }
+  return {
     userHandleB64url: credential.userHandleB64url,
     credentialIdB64url: credential.rawIdB64url
   };
-  writeParentAssertCache(result);
-  return result;
+};
+
+// src/sdk/get-presence-token.ts
+var getPresenceToken = async ({
+  transport,
+  passkey,
+  publishableKey,
+  relyingPartyOrigin
+}) => {
+  const { token, optionsJSON } = await transport.send(
+    PostMessageType.AUTH,
+    PostMessageMethod.PASSKEY_PRESENCE_BEGIN,
+    { publishableKey, relyingPartyOrigin }
+  );
+  const response = await passkey.assertForServer({ optionsJSON });
+  const verify = await transport.send(
+    PostMessageType.AUTH,
+    PostMessageMethod.PASSKEY_PRESENCE_VERIFY,
+    {
+      publishableKey,
+      relyingPartyOrigin,
+      token,
+      response
+    }
+  );
+  return {
+    presenceToken: verify.presence_token,
+    expiresAt: verify.expires_at
+  };
+};
+
+// src/sdk/get-internal-presence-tokens.ts
+var getInternalPresenceTokens = async ({
+  transport,
+  passkey,
+  publishableKey,
+  relyingPartyOrigin,
+  scopes
+}) => {
+  const { token, optionsJSON } = await transport.send(
+    PostMessageType.AUTH,
+    PostMessageMethod.PASSKEY_PRESENCE_BEGIN,
+    { publishableKey, relyingPartyOrigin }
+  );
+  const { response, userHandleB64url, credentialIdB64url } = await passkey.assertForInternalPresence({ optionsJSON });
+  const verify = await transport.send(
+    PostMessageType.AUTH,
+    PostMessageMethod.PASSKEY_PRESENCE_VERIFY,
+    {
+      publishableKey,
+      relyingPartyOrigin,
+      token,
+      response,
+      purpose: "internal",
+      scopes
+    }
+  );
+  const out = {};
+  for (const [scope, t] of Object.entries(verify.tokens ?? {})) {
+    out[scope] = { token: t.token, expiresAt: t.expires_at };
+  }
+  return {
+    tokens: out,
+    userHandleB64url,
+    credentialIdB64url
+  };
+};
+var flattenPresenceTokens = (result) => {
+  const out = {};
+  for (const [scope, t] of Object.entries(result.tokens)) {
+    out[scope] = t.token;
+  }
+  return out;
 };
 
 // src/sdk/headless-ethereum.ts
+var SCOPES_SIGN = ["keyshare_read", "sign"];
 var getHeadlessEthereumMethods = ({
   transport,
   passkey,
-  publishableKey
+  publishableKey,
+  relyingPartyOrigin
 }) => ({
-  signEthereumMessageHeadless: async (params) => withClearOnFailure(async () => {
+  signEthereumMessageHeadless: async (params) => {
     if (!transport.isReady()) throw new Error("SDK not ready");
-    const { userHandleB64url, credentialIdB64url } = await assertPasskeyInParent({
+    const { userHandleB64url, credentialIdB64url, tokens } = await getInternalPresenceTokens({
       transport,
       passkey,
       publishableKey,
-      requireFreshAssertion: params.requireFreshAssertion
+      relyingPartyOrigin,
+      scopes: SCOPES_SIGN
     });
     return transport.send(
       PostMessageType.WALLET,
@@ -363,17 +421,23 @@ var getHeadlessEthereumMethods = ({
         wallet: params.wallet,
         uiOptions: params.options?.uiOptions,
         userHandleB64url,
-        credentialIdB64url
+        credentialIdB64url,
+        presenceTokens: flattenPresenceTokens({
+          tokens,
+          userHandleB64url,
+          credentialIdB64url
+        })
       }
     );
-  }),
-  signEthereumTransactionHeadless: async (params) => withClearOnFailure(async () => {
+  },
+  signEthereumTransactionHeadless: async (params) => {
     if (!transport.isReady()) throw new Error("SDK not ready");
-    const { userHandleB64url, credentialIdB64url } = await assertPasskeyInParent({
+    const { userHandleB64url, credentialIdB64url, tokens } = await getInternalPresenceTokens({
       transport,
       passkey,
       publishableKey,
-      requireFreshAssertion: params.requireFreshAssertion
+      relyingPartyOrigin,
+      scopes: SCOPES_SIGN
     });
     return transport.send(
       PostMessageType.WALLET,
@@ -385,17 +449,23 @@ var getHeadlessEthereumMethods = ({
         wallet: params.wallet,
         options: params.options,
         userHandleB64url,
-        credentialIdB64url
+        credentialIdB64url,
+        presenceTokens: flattenPresenceTokens({
+          tokens,
+          userHandleB64url,
+          credentialIdB64url
+        })
       }
     );
-  }),
-  signEthereumTypedDataHeadless: async (params) => withClearOnFailure(async () => {
+  },
+  signEthereumTypedDataHeadless: async (params) => {
     if (!transport.isReady()) throw new Error("SDK not ready");
-    const { userHandleB64url, credentialIdB64url } = await assertPasskeyInParent({
+    const { userHandleB64url, credentialIdB64url, tokens } = await getInternalPresenceTokens({
       transport,
       passkey,
       publishableKey,
-      requireFreshAssertion: params.requireFreshAssertion
+      relyingPartyOrigin,
+      scopes: SCOPES_SIGN
     });
     return transport.send(
       PostMessageType.WALLET,
@@ -409,17 +479,23 @@ var getHeadlessEthereumMethods = ({
         wallet: params.wallet,
         options: params.options,
         userHandleB64url,
-        credentialIdB64url
+        credentialIdB64url,
+        presenceTokens: flattenPresenceTokens({
+          tokens,
+          userHandleB64url,
+          credentialIdB64url
+        })
       }
     );
-  }),
-  signEthereumHashHeadless: async (params) => withClearOnFailure(async () => {
+  },
+  signEthereumHashHeadless: async (params) => {
     if (!transport.isReady()) throw new Error("SDK not ready");
-    const { userHandleB64url, credentialIdB64url } = await assertPasskeyInParent({
+    const { userHandleB64url, credentialIdB64url, tokens } = await getInternalPresenceTokens({
       transport,
       passkey,
       publishableKey,
-      requireFreshAssertion: params.requireFreshAssertion
+      relyingPartyOrigin,
+      scopes: SCOPES_SIGN
     });
     return transport.send(
       PostMessageType.WALLET,
@@ -430,17 +506,23 @@ var getHeadlessEthereumMethods = ({
         wallet: params.wallet,
         options: params.options,
         userHandleB64url,
-        credentialIdB64url
+        credentialIdB64url,
+        presenceTokens: flattenPresenceTokens({
+          tokens,
+          userHandleB64url,
+          credentialIdB64url
+        })
       }
     );
-  }),
-  signEthereum7702AuthorizationHeadless: async (params) => withClearOnFailure(async () => {
+  },
+  signEthereum7702AuthorizationHeadless: async (params) => {
     if (!transport.isReady()) throw new Error("SDK not ready");
-    const { userHandleB64url, credentialIdB64url } = await assertPasskeyInParent({
+    const { userHandleB64url, credentialIdB64url, tokens } = await getInternalPresenceTokens({
       transport,
       passkey,
       publishableKey,
-      requireFreshAssertion: params.requireFreshAssertion
+      relyingPartyOrigin,
+      scopes: SCOPES_SIGN
     });
     return transport.send(
       PostMessageType.WALLET,
@@ -454,17 +536,23 @@ var getHeadlessEthereumMethods = ({
         wallet: params.wallet,
         options: params.options,
         userHandleB64url,
-        credentialIdB64url
+        credentialIdB64url,
+        presenceTokens: flattenPresenceTokens({
+          tokens,
+          userHandleB64url,
+          credentialIdB64url
+        })
       }
     );
-  }),
-  sendEthereumTransactionHeadless: async (params) => withClearOnFailure(async () => {
+  },
+  sendEthereumTransactionHeadless: async (params) => {
     if (!transport.isReady()) throw new Error("SDK not ready");
-    const { userHandleB64url, credentialIdB64url } = await assertPasskeyInParent({
+    const { userHandleB64url, credentialIdB64url, tokens } = await getInternalPresenceTokens({
       transport,
       passkey,
       publishableKey,
-      requireFreshAssertion: params.requireFreshAssertion
+      relyingPartyOrigin,
+      scopes: SCOPES_SIGN
     });
     const serializedTransaction = await serializeEthereumTransaction(
       params.transaction
@@ -478,7 +566,12 @@ var getHeadlessEthereumMethods = ({
         wallet: params.wallet,
         options: params.options,
         userHandleB64url,
-        credentialIdB64url
+        credentialIdB64url,
+        presenceTokens: flattenPresenceTokens({
+          tokens,
+          userHandleB64url,
+          credentialIdB64url
+        })
       }
     );
     if (!signed.serializedSigned) {
@@ -491,7 +584,7 @@ var getHeadlessEthereumMethods = ({
       signed.serializedSigned
     );
     return { hash };
-  }),
+  },
   getEthereumBalance: async (params) => {
     if (!transport.isReady()) throw new Error("SDK not ready");
     return transport.send(
@@ -527,18 +620,21 @@ var getHeadlessEthereumMethods = ({
 });
 
 // src/sdk/headless-solana.ts
+var SCOPES_SIGN2 = ["keyshare_read", "sign"];
 var getHeadlessSolanaMethods = ({
   transport,
   passkey,
-  publishableKey
+  publishableKey,
+  relyingPartyOrigin
 }) => ({
-  signSolanaMessageHeadless: async (params) => withClearOnFailure(async () => {
+  signSolanaMessageHeadless: async (params) => {
     if (!transport.isReady()) throw new Error("SDK not ready");
-    const { userHandleB64url, credentialIdB64url } = await assertPasskeyInParent({
+    const { userHandleB64url, credentialIdB64url, tokens } = await getInternalPresenceTokens({
       transport,
       passkey,
       publishableKey,
-      requireFreshAssertion: params.requireFreshAssertion
+      relyingPartyOrigin,
+      scopes: SCOPES_SIGN2
     });
     const { signature } = await transport.send(
       PostMessageType.WALLET,
@@ -549,18 +645,24 @@ var getHeadlessSolanaMethods = ({
         wallet: params.wallet,
         uiOptions: params.options?.uiOptions,
         userHandleB64url,
-        credentialIdB64url
+        credentialIdB64url,
+        presenceTokens: flattenPresenceTokens({
+          tokens,
+          userHandleB64url,
+          credentialIdB64url
+        })
       }
     );
     return { signature: arrayLikeToBytes(signature) };
-  }),
-  signSolanaTransactionHeadless: async (params) => withClearOnFailure(async () => {
+  },
+  signSolanaTransactionHeadless: async (params) => {
     if (!transport.isReady()) throw new Error("SDK not ready");
-    const { userHandleB64url, credentialIdB64url } = await assertPasskeyInParent({
+    const { userHandleB64url, credentialIdB64url, tokens } = await getInternalPresenceTokens({
       transport,
       passkey,
       publishableKey,
-      requireFreshAssertion: params.requireFreshAssertion
+      relyingPartyOrigin,
+      scopes: SCOPES_SIGN2
     });
     const { signedTransaction } = await transport.send(
       PostMessageType.WALLET,
@@ -571,18 +673,24 @@ var getHeadlessSolanaMethods = ({
         wallet: params.wallet,
         options: params.options,
         userHandleB64url,
-        credentialIdB64url
+        credentialIdB64url,
+        presenceTokens: flattenPresenceTokens({
+          tokens,
+          userHandleB64url,
+          credentialIdB64url
+        })
       }
     );
     return { signedTransaction: await bs58ToBytes(signedTransaction) };
-  }),
-  sendSolanaTransactionHeadless: async (params) => withClearOnFailure(async () => {
+  },
+  sendSolanaTransactionHeadless: async (params) => {
     if (!transport.isReady()) throw new Error("SDK not ready");
-    const { userHandleB64url, credentialIdB64url } = await assertPasskeyInParent({
+    const { userHandleB64url, credentialIdB64url, tokens } = await getInternalPresenceTokens({
       transport,
       passkey,
       publishableKey,
-      requireFreshAssertion: params.requireFreshAssertion
+      relyingPartyOrigin,
+      scopes: SCOPES_SIGN2
     });
     const { signedTransaction } = await transport.send(
       PostMessageType.WALLET,
@@ -593,7 +701,12 @@ var getHeadlessSolanaMethods = ({
         wallet: params.wallet,
         options: params.options,
         userHandleB64url,
-        credentialIdB64url
+        credentialIdB64url,
+        presenceTokens: flattenPresenceTokens({
+          tokens,
+          userHandleB64url,
+          credentialIdB64url
+        })
       }
     );
     const broadcastSignature = await broadcastSolanaSigned(
@@ -601,7 +714,7 @@ var getHeadlessSolanaMethods = ({
       signedTransaction
     );
     return { signature: await bs58ToBytes(broadcastSignature) };
-  }),
+  },
   getSolanaBalance: async (params) => {
     if (!transport.isReady()) throw new Error("SDK not ready");
     return transport.send(
@@ -624,13 +737,17 @@ var getHeadlessSolanaMethods = ({
 var getHeadlessAuthenticationMethods = ({
   transport,
   publishableKey,
-  emailConfig,
   setIsAuthenticated,
   setUser
 }) => ({
-  /** Send a one-time passcode to the user's email address. */
+  /**
+   * Send a one-time passcode to the user's email address. Returns the
+   * server's response — most importantly `expires_at` (unix seconds),
+   * which the UI uses to render a countdown that cannot drift from the
+   * authoritative server-side TTL.
+   */
   sendCode: async (params) => {
-    await transport.send(
+    const response = await transport.send(
       PostMessageType.AUTH,
       PostMessageMethod.LOGIN_CREATE,
       {
@@ -641,6 +758,7 @@ var getHeadlessAuthenticationMethods = ({
     );
     authState.clearEmail();
     authState.setEmail(params.email);
+    return response;
   },
   /**
    * Verify the OTP and complete the login. The iframe-app handles
@@ -656,8 +774,7 @@ var getHeadlessAuthenticationMethods = ({
       {
         email,
         code: params.code,
-        publishableKey,
-        expiresIn: emailConfig?.expiresIn
+        publishableKey
       }
     );
     authState.clearEmail();
@@ -709,11 +826,15 @@ var getHeadlessAuthenticationMethods = ({
 });
 
 // src/sdk/headless-general.ts
+var SCOPES_CREATE_WALLET = ["dek_bootstrap", "keyshare_write"];
+var SCOPES_IMPORT_KEY = ["dek_bootstrap", "keyshare_write"];
+var SCOPES_REMOVE_PASSKEY = ["passkey_remove"];
 var getHeadlessGeneralMethods = ({
   transport,
   passkey,
   storage,
   publishableKey,
+  relyingPartyOrigin,
   setIsAuthenticated,
   setUser
 }) => ({
@@ -723,18 +844,34 @@ var getHeadlessGeneralMethods = ({
     { publishableKey }
   ),
   removePasskey: async (credentialIdB64url) => {
+    const { tokens, userHandleB64url, credentialIdB64url: assertedCredId } = await getInternalPresenceTokens({
+      transport,
+      passkey,
+      publishableKey,
+      relyingPartyOrigin,
+      scopes: SCOPES_REMOVE_PASSKEY
+    });
     await transport.send(
       PostMessageType.AUTH,
       PostMessageMethod.REMOVE_PASSKEY,
-      { publishableKey, credentialIdB64url }
+      {
+        publishableKey,
+        credentialIdB64url,
+        presenceTokens: flattenPresenceTokens({
+          tokens,
+          userHandleB64url,
+          credentialIdB64url: assertedCredId
+        })
+      }
     );
   },
-  createWallet: (walletType, options) => withClearOnFailure(async () => {
-    const { userHandleB64url, credentialIdB64url } = await assertPasskeyInParent({
+  createWallet: async (walletType, options) => {
+    const { userHandleB64url, credentialIdB64url, tokens } = await getInternalPresenceTokens({
       transport,
       passkey,
       publishableKey,
-      requireFreshAssertion: options?.requireFreshAssertion
+      relyingPartyOrigin,
+      scopes: SCOPES_CREATE_WALLET
     });
     const wallet = await transport.send(
       PostMessageType.WALLET,
@@ -744,17 +881,23 @@ var getHeadlessGeneralMethods = ({
         publishableKey,
         options,
         userHandleB64url,
-        credentialIdB64url
+        credentialIdB64url,
+        presenceTokens: flattenPresenceTokens({
+          tokens,
+          userHandleB64url,
+          credentialIdB64url
+        })
       }
     );
     return { wallet };
-  }),
-  importKey: (walletType, key, options) => withClearOnFailure(async () => {
-    const { userHandleB64url, credentialIdB64url } = await assertPasskeyInParent({
+  },
+  importKey: async (walletType, key) => {
+    const { userHandleB64url, credentialIdB64url, tokens } = await getInternalPresenceTokens({
       transport,
       passkey,
       publishableKey,
-      requireFreshAssertion: options?.requireFreshAssertion
+      relyingPartyOrigin,
+      scopes: SCOPES_IMPORT_KEY
     });
     const wallet = await transport.send(
       PostMessageType.WALLET,
@@ -764,11 +907,16 @@ var getHeadlessGeneralMethods = ({
         publishableKey,
         key,
         userHandleB64url,
-        credentialIdB64url
+        credentialIdB64url,
+        presenceTokens: flattenPresenceTokens({
+          tokens,
+          userHandleB64url,
+          credentialIdB64url
+        })
       }
     );
     return { wallet };
-  }),
+  },
   getWallets: async (walletType) => {
     const { wallets } = await transport.send(
       PostMessageType.WALLET,
@@ -808,7 +956,6 @@ var getHeadlessGeneralMethods = ({
       await transport.send(PostMessageType.AUTH, PostMessageMethod.LOGOUT, {
         publishableKey
       });
-      clearParentAssertCache();
       await storage.remove("id_token");
       if (setIsAuthenticated) setIsAuthenticated(false);
       if (setUser) setUser(null);
@@ -857,8 +1004,11 @@ var getHeadlessGeneralMethods = ({
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   assertPasskeyInParent,
+  flattenPresenceTokens,
   getHeadlessAuthenticationMethods,
   getHeadlessEthereumMethods,
   getHeadlessGeneralMethods,
-  getHeadlessSolanaMethods
+  getHeadlessSolanaMethods,
+  getInternalPresenceTokens,
+  getPresenceToken
 });