@moon-x/core 0.2.0 → 0.4.0

package/package.json

@@ -1,6 +1,7 @@
 {
   "name": "@moon-x/core",
-  "version": "0.2.0",
+  "version": "0.4.0",
+  "license": "UNLICENSED",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
   "exports": {
@@ -56,12 +57,15 @@
   "publishConfig": {
     "access": "public"
   },
+  "dependencies": {
+    "@simplewebauthn/browser": "^13.2.2"
+  },
   "devDependencies": {
     "@testing-library/react": "16.3.2",
     "@types/react": "19.2.14",
     "@types/react-dom": "19.2.3",
     "@vitest/ui": "1.6.1",
-    "happy-dom": "13.10.1",
+    "happy-dom": "20.8.9",
     "react": "18.3.1",
     "react-dom": "18.3.1",
     "tsup": "8.5.1",

package/dist/interfaces-9k0eKCc4.d.ts

@@ -1,120 +0,0 @@
-import { c as PostMessageType, a as PostMessageMethod } from './post-message-C_99BCBh.js';
-
-/**
- * Transport — the bidirectional postMessage channel between the parent
- * (web SDK or RN SDK) and the iframe-app. Web wraps
- * `createPostMessageClient(iframeRef.current.contentWindow, ...)`; RN
- * wraps a `WebViewBridge` over react-native-webview.
- *
- * `send` resolves with the iframe handler's raw return value and rejects
- * with the handler's thrown error (canonical envelope, no
- * {success, data} unwrap at the call site).
- */
-interface Transport {
-    send<P, R>(type: PostMessageType, method: PostMessageMethod, payload: P): Promise<R>;
-    /**
-     * Register a handler for inbound messages from the iframe-app. Only
-     * needed by the parent-side `*WithUI` flow path, where the modal
-     * postMessages a result back that the SDK's pending Promise needs to
-     * resolve. Returns an unregister fn.
-     */
-    register?<P, R>(type: PostMessageType, method: PostMessageMethod, handler: (payload: P) => Promise<R> | R): () => void;
-    /**
-     * Whether the underlying iframe / WebView is loaded and ready to
-     * receive messages. SDK methods short-circuit with "SDK not ready"
-     * before calling `send` if this returns false.
-     */
-    isReady(): boolean;
-}
-/**
- * PasskeyAssertor — runs the WebAuthn ceremony in the *parent* (where
- * user activation lives — cross-origin iframes/WebViews can't reliably
- * get their own click handler).
- *
- * Both `assert` and `create` use empty `allowCredentials` on the
- * underlying API to force the discoverable-login codepath where
- * userHandle is REQUIRED. The userHandle bytes are the wrap key the
- * iframe-app uses to unwrap the DEK before signing.
- */
-interface PasskeyAssertor {
-    /**
-     * Run a WebAuthn assertion (`navigator.credentials.get` on web,
-     * `passkeyGet` from react-native-passkeys on RN). Returns the
-     * platform-decoded base64url forms of the credential id and userHandle.
-     */
-    assert(opts: {
-        rpId: string;
-        challenge: string;
-        /**
-         * The wire `allow_credential_ids_b64url` list from GET_DEK_INFO,
-         * passed through for platforms that want to use it. Note both
-         * platforms today pass an empty array to the underlying API; this
-         * field is informational only (e.g. for telemetry or for a future
-         * platform that prefers non-discoverable login).
-         */
-        allowCredentials: string[];
-    }): Promise<{
-        rawIdB64url: string;
-        userHandleB64url: string;
-    }>;
-    /**
-     * Run a WebAuthn registration (`navigator.credentials.create` on web,
-     * `passkeyCreate` from react-native-passkeys on RN). Used by passkey
-     * register flows.
-     */
-    create(opts: {
-        rpId: string;
-        rpName: string;
-        userId: Uint8Array;
-        userName: string;
-        userDisplayName: string;
-        challenge: string;
-        excludeCredentials?: string[];
-    }): Promise<{
-        rawIdB64url: string;
-        clientDataJSONB64url: string;
-        attestationObjectB64url: string;
-    }>;
-}
-/**
- * KvStorage — async key/value storage for ID tokens + session metadata.
- * Web wraps `localStorage` (sync, lifted to a resolved Promise); RN
- * wraps `@react-native-async-storage/async-storage` (natively async).
- *
- * Always async at the interface to unify both platforms.
- */
-interface KvStorage {
-    get(key: string): Promise<string | null>;
-    set(key: string, value: string): Promise<void>;
-    remove(key: string): Promise<void>;
-}
-/**
- * OAuthOpener — start an OAuth authorize request and wait for the
- * provider redirect to return with `code` + `state`. Web uses a
- * full-page redirect or popup (completion picked up by
- * `useOAuthCompletion` listening for postMessages); RN uses
- * `expo-web-browser.openAuthSessionAsync` (single Promise resolves on
- * deep-link callback).
- */
-interface OAuthOpener {
-    open(opts: {
-        authorizeUrl: string;
-        redirectUrl: string;
-    }): Promise<{
-        code: string;
-        state: string;
-    }>;
-}
-/**
- * The bundle of platform impls that the SDK factories accept. Provider
- * components on each platform construct one of these once and pass it
- * through to the factories.
- */
-interface PlatformImpls {
-    transport: Transport;
-    passkey: PasskeyAssertor;
-    storage: KvStorage;
-    oauth: OAuthOpener;
-}
-
-export type { KvStorage as K, OAuthOpener as O, PasskeyAssertor as P, Transport as T, PlatformImpls as a };

package/dist/interfaces-fNhwnCeY.d.mts

@@ -1,120 +0,0 @@
-import { c as PostMessageType, a as PostMessageMethod } from './post-message-C_99BCBh.mjs';
-
-/**
- * Transport — the bidirectional postMessage channel between the parent
- * (web SDK or RN SDK) and the iframe-app. Web wraps
- * `createPostMessageClient(iframeRef.current.contentWindow, ...)`; RN
- * wraps a `WebViewBridge` over react-native-webview.
- *
- * `send` resolves with the iframe handler's raw return value and rejects
- * with the handler's thrown error (canonical envelope, no
- * {success, data} unwrap at the call site).
- */
-interface Transport {
-    send<P, R>(type: PostMessageType, method: PostMessageMethod, payload: P): Promise<R>;
-    /**
-     * Register a handler for inbound messages from the iframe-app. Only
-     * needed by the parent-side `*WithUI` flow path, where the modal
-     * postMessages a result back that the SDK's pending Promise needs to
-     * resolve. Returns an unregister fn.
-     */
-    register?<P, R>(type: PostMessageType, method: PostMessageMethod, handler: (payload: P) => Promise<R> | R): () => void;
-    /**
-     * Whether the underlying iframe / WebView is loaded and ready to
-     * receive messages. SDK methods short-circuit with "SDK not ready"
-     * before calling `send` if this returns false.
-     */
-    isReady(): boolean;
-}
-/**
- * PasskeyAssertor — runs the WebAuthn ceremony in the *parent* (where
- * user activation lives — cross-origin iframes/WebViews can't reliably
- * get their own click handler).
- *
- * Both `assert` and `create` use empty `allowCredentials` on the
- * underlying API to force the discoverable-login codepath where
- * userHandle is REQUIRED. The userHandle bytes are the wrap key the
- * iframe-app uses to unwrap the DEK before signing.
- */
-interface PasskeyAssertor {
-    /**
-     * Run a WebAuthn assertion (`navigator.credentials.get` on web,
-     * `passkeyGet` from react-native-passkeys on RN). Returns the
-     * platform-decoded base64url forms of the credential id and userHandle.
-     */
-    assert(opts: {
-        rpId: string;
-        challenge: string;
-        /**
-         * The wire `allow_credential_ids_b64url` list from GET_DEK_INFO,
-         * passed through for platforms that want to use it. Note both
-         * platforms today pass an empty array to the underlying API; this
-         * field is informational only (e.g. for telemetry or for a future
-         * platform that prefers non-discoverable login).
-         */
-        allowCredentials: string[];
-    }): Promise<{
-        rawIdB64url: string;
-        userHandleB64url: string;
-    }>;
-    /**
-     * Run a WebAuthn registration (`navigator.credentials.create` on web,
-     * `passkeyCreate` from react-native-passkeys on RN). Used by passkey
-     * register flows.
-     */
-    create(opts: {
-        rpId: string;
-        rpName: string;
-        userId: Uint8Array;
-        userName: string;
-        userDisplayName: string;
-        challenge: string;
-        excludeCredentials?: string[];
-    }): Promise<{
-        rawIdB64url: string;
-        clientDataJSONB64url: string;
-        attestationObjectB64url: string;
-    }>;
-}
-/**
- * KvStorage — async key/value storage for ID tokens + session metadata.
- * Web wraps `localStorage` (sync, lifted to a resolved Promise); RN
- * wraps `@react-native-async-storage/async-storage` (natively async).
- *
- * Always async at the interface to unify both platforms.
- */
-interface KvStorage {
-    get(key: string): Promise<string | null>;
-    set(key: string, value: string): Promise<void>;
-    remove(key: string): Promise<void>;
-}
-/**
- * OAuthOpener — start an OAuth authorize request and wait for the
- * provider redirect to return with `code` + `state`. Web uses a
- * full-page redirect or popup (completion picked up by
- * `useOAuthCompletion` listening for postMessages); RN uses
- * `expo-web-browser.openAuthSessionAsync` (single Promise resolves on
- * deep-link callback).
- */
-interface OAuthOpener {
-    open(opts: {
-        authorizeUrl: string;
-        redirectUrl: string;
-    }): Promise<{
-        code: string;
-        state: string;
-    }>;
-}
-/**
- * The bundle of platform impls that the SDK factories accept. Provider
- * components on each platform construct one of these once and pass it
- * through to the factories.
- */
-interface PlatformImpls {
-    transport: Transport;
-    passkey: PasskeyAssertor;
-    storage: KvStorage;
-    oauth: OAuthOpener;
-}
-
-export type { KvStorage as K, OAuthOpener as O, PasskeyAssertor as P, Transport as T, PlatformImpls as a };

package/dist/passkey-cache-B9PT3AWX.d.mts

@@ -1,47 +0,0 @@
-interface CachedAssertion {
-    userHandleB64url: string;
-    credentialIdB64url: string;
-}
-declare const setAssertCacheTtlMs: (ms: number) => void;
-declare const getAssertCacheTtlMs: () => number;
-declare const clearParentAssertCache: () => void;
-declare const readParentAssertCache: () => CachedAssertion | null;
-declare const writeParentAssertCache: (entry: CachedAssertion) => void;
-/**
- * Run `fn` inside a try/catch that clears the parent-side assertion
- * cache on failure. Used by every wallet-interaction SDK method
- * (sign / send / etc.) so that if the operation fails for any reason
- * — backend rejection, network error, MPC ceremony failure — the
- * next user attempt re-prompts biometric instead of silently reusing
- * a possibly-bad cached assertion.
- *
- * The cache is set inside the platform-specific `assertPasskeyInParent`
- * only on a successful ceremony, so cancellations / activation
- * failures don't pollute it. This wrapper specifically handles the
- * "assertion succeeded but downstream work failed" case where the
- * cache is set but the user is stuck — without the clear, the user
- * would have to refresh to escape.
- */
-declare const withClearOnFailure: <T>(fn: () => Promise<T>) => Promise<T>;
-/**
- * Generate fresh user.id bytes for a new WebAuthn credential. The
- * caller overrides `options.user.id` with these bytes before
- * navigator.credentials.create so the authenticator persists them as
- * the credential's user.id; on every subsequent assertion they come
- * back as response.userHandle and serve as the AES-GCM key for that
- * credential's DEK wrap.
- *
- * Returns the bytes both as base64url (what the WebAuthn options
- * accept and what we ship over postMessage) and as raw bytes (for
- * any caller that prefers direct binary).
- *
- * Requires a working `crypto.getRandomValues`. On RN this is provided
- * by the `react-native-get-random-values` polyfill that the SDK's
- * docs ask consumers to import at app entry.
- */
-declare const generatePasskeyUserId: () => {
-    userIdB64url: string;
-    userIdBytes: Uint8Array;
-};
-
-export { type CachedAssertion as C, getAssertCacheTtlMs as a, writeParentAssertCache as b, clearParentAssertCache as c, generatePasskeyUserId as g, readParentAssertCache as r, setAssertCacheTtlMs as s, withClearOnFailure as w };

package/dist/passkey-cache-B9PT3AWX.d.ts

@@ -1,47 +0,0 @@
-interface CachedAssertion {
-    userHandleB64url: string;
-    credentialIdB64url: string;
-}
-declare const setAssertCacheTtlMs: (ms: number) => void;
-declare const getAssertCacheTtlMs: () => number;
-declare const clearParentAssertCache: () => void;
-declare const readParentAssertCache: () => CachedAssertion | null;
-declare const writeParentAssertCache: (entry: CachedAssertion) => void;
-/**
- * Run `fn` inside a try/catch that clears the parent-side assertion
- * cache on failure. Used by every wallet-interaction SDK method
- * (sign / send / etc.) so that if the operation fails for any reason
- * — backend rejection, network error, MPC ceremony failure — the
- * next user attempt re-prompts biometric instead of silently reusing
- * a possibly-bad cached assertion.
- *
- * The cache is set inside the platform-specific `assertPasskeyInParent`
- * only on a successful ceremony, so cancellations / activation
- * failures don't pollute it. This wrapper specifically handles the
- * "assertion succeeded but downstream work failed" case where the
- * cache is set but the user is stuck — without the clear, the user
- * would have to refresh to escape.
- */
-declare const withClearOnFailure: <T>(fn: () => Promise<T>) => Promise<T>;
-/**
- * Generate fresh user.id bytes for a new WebAuthn credential. The
- * caller overrides `options.user.id` with these bytes before
- * navigator.credentials.create so the authenticator persists them as
- * the credential's user.id; on every subsequent assertion they come
- * back as response.userHandle and serve as the AES-GCM key for that
- * credential's DEK wrap.
- *
- * Returns the bytes both as base64url (what the WebAuthn options
- * accept and what we ship over postMessage) and as raw bytes (for
- * any caller that prefers direct binary).
- *
- * Requires a working `crypto.getRandomValues`. On RN this is provided
- * by the `react-native-get-random-values` polyfill that the SDK's
- * docs ask consumers to import at app entry.
- */
-declare const generatePasskeyUserId: () => {
-    userIdB64url: string;
-    userIdBytes: Uint8Array;
-};
-
-export { type CachedAssertion as C, getAssertCacheTtlMs as a, writeParentAssertCache as b, clearParentAssertCache as c, generatePasskeyUserId as g, readParentAssertCache as r, setAssertCacheTtlMs as s, withClearOnFailure as w };