@moon-x/core 0.2.0

package/dist/sdk/index.js

@@ -0,0 +1,864 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/sdk/index.ts
+var sdk_exports = {};
+__export(sdk_exports, {
+  assertPasskeyInParent: () => assertPasskeyInParent,
+  getHeadlessAuthenticationMethods: () => getHeadlessAuthenticationMethods,
+  getHeadlessEthereumMethods: () => getHeadlessEthereumMethods,
+  getHeadlessGeneralMethods: () => getHeadlessGeneralMethods,
+  getHeadlessSolanaMethods: () => getHeadlessSolanaMethods
+});
+module.exports = __toCommonJS(sdk_exports);
+
+// src/lib/auth/authentication-state.ts
+var AuthenticationState = class {
+  constructor() {
+    this.email = null;
+  }
+  setEmail(email) {
+    this.email = email;
+  }
+  getEmail() {
+    return this.email;
+  }
+  clearEmail() {
+    this.email = null;
+  }
+  clear() {
+    this.clearEmail();
+  }
+};
+var authState = new AuthenticationState();
+
+// src/lib/passkey/passkey-codec.ts
+var toB64url = (bytes) => {
+  let str = "";
+  for (let i = 0; i < bytes.length; i++) str += String.fromCharCode(bytes[i]);
+  return btoa(str).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+};
+
+// src/lib/passkey/passkey-cache.ts
+var cacheTtlMs = 0;
+var cache = null;
+var clearParentAssertCache = () => {
+  cache = null;
+};
+var readParentAssertCache = () => {
+  if (cacheTtlMs <= 0) return null;
+  if (!cache) return null;
+  if (Date.now() - cache.ts >= cacheTtlMs) return null;
+  return {
+    userHandleB64url: cache.userHandleB64url,
+    credentialIdB64url: cache.credentialIdB64url
+  };
+};
+var writeParentAssertCache = (entry) => {
+  if (cacheTtlMs <= 0) return;
+  cache = { ...entry, ts: Date.now() };
+};
+var withClearOnFailure = async (fn) => {
+  try {
+    return await fn();
+  } catch (error) {
+    clearParentAssertCache();
+    throw error;
+  }
+};
+
+// src/lib/ethereum/chains.ts
+var import_viem = require("viem");
+
+// src/lib/ethereum/siwe.ts
+var import_siwe = require("siwe");
+var import_viem2 = require("viem");
+
+// src/lib/ethereum/tx-prep.ts
+var import_viem3 = require("viem");
+
+// src/lib/solana/siws.ts
+var nacl = __toESM(require("tweetnacl"));
+
+// src/lib/solana/transaction-log-parser.ts
+var import_web3 = require("@solana/web3.js");
+var import_bn = __toESM(require("bn.js"));
+
+// src/lib/rpc-broadcast.ts
+var serializeEthereumTransaction = async (transaction) => {
+  if (typeof transaction === "string") {
+    return transaction;
+  }
+  if (!transaction || typeof transaction !== "object") {
+    throw new Error("ethereum_transaction_invalid");
+  }
+  const { serializeTransaction: serializeTransaction2, parseEther: parseEther3, parseGwei: parseGwei2 } = await import("viem");
+  const toWei = (val, humanUnit) => {
+    if (val == null || val === "") return BigInt(0);
+    if (typeof val === "bigint") return val;
+    if (typeof val === "number") return BigInt(val);
+    if (typeof val === "string") {
+      if (val.startsWith("0x")) return BigInt(val);
+      if (val.includes(".")) {
+        return humanUnit === "ether" ? parseEther3(val) : parseGwei2(val);
+      }
+      return BigInt(val);
+    }
+    return BigInt(val);
+  };
+  const formatted = {
+    to: transaction.to,
+    value: toWei(transaction.value, "ether"),
+    data: transaction.data || "0x",
+    chainId: transaction.chainId || 1,
+    type: "eip1559",
+    maxPriorityFeePerGas: transaction.maxPriorityFeePerGas ? toWei(transaction.maxPriorityFeePerGas, "gwei") : BigInt(2e9),
+    maxFeePerGas: transaction.maxFeePerGas ? toWei(transaction.maxFeePerGas, "gwei") : BigInt(22e9),
+    ...transaction.nonce && { nonce: Number(transaction.nonce) },
+    ...transaction.gas && { gas: BigInt(transaction.gas) }
+  };
+  return serializeTransaction2(formatted);
+};
+var broadcastEthereumRaw = async (rpcUrl, signedSerialized) => {
+  const controller = new AbortController();
+  const timeoutId = setTimeout(() => controller.abort(), 3e4);
+  try {
+    const response = await fetch(rpcUrl, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({
+        jsonrpc: "2.0",
+        id: 1,
+        method: "eth_sendRawTransaction",
+        params: [signedSerialized]
+      }),
+      signal: controller.signal
+    });
+    const result = await response.json();
+    if (result.error) {
+      throw new Error(result.error.message || "eth_sendRawTransaction failed");
+    }
+    return result.result;
+  } catch (error) {
+    if (error instanceof Error && error.name === "AbortError") {
+      throw new Error("RPC request timed out after 30 seconds");
+    }
+    throw error;
+  } finally {
+    clearTimeout(timeoutId);
+  }
+};
+var broadcastSolanaSigned = async (rpcUrl, signedBase58) => {
+  const { default: bs58 } = await import("bs58");
+  const transactionBytes = bs58.decode(signedBase58);
+  const base64Transaction = Buffer.from(transactionBytes).toString("base64");
+  const response = await fetch(rpcUrl, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({
+      jsonrpc: "2.0",
+      id: 1,
+      method: "sendTransaction",
+      params: [
+        base64Transaction,
+        {
+          encoding: "base64",
+          skipPreflight: false,
+          preflightCommitment: "confirmed",
+          maxRetries: 3
+        }
+      ]
+    })
+  });
+  const result = await response.json();
+  if (result.error) {
+    throw new Error(`Solana RPC error: ${result.error.message}`);
+  }
+  return result.result;
+};
+
+// src/lib/wire-codec.ts
+var arrayLikeToBytes = (value) => {
+  if (value instanceof Uint8Array) return value;
+  if (Array.isArray(value)) return new Uint8Array(value);
+  if (value && typeof value === "object") {
+    const keys = Object.keys(value);
+    if (keys.length === 0) return new Uint8Array();
+    if (keys.every((k) => /^\d+$/.test(k))) {
+      const len = keys.length;
+      const out = new Uint8Array(len);
+      for (let i = 0; i < len; i++) {
+        out[i] = value[String(i)] ?? 0;
+      }
+      return out;
+    }
+  }
+  throw new Error(`arrayLikeToBytes: unsupported shape (${typeof value})`);
+};
+var bs58ToBytes = async (value) => {
+  if (value instanceof Uint8Array) return value;
+  if (Array.isArray(value)) return new Uint8Array(value);
+  if (typeof value === "string") {
+    const { default: bs58 } = await import("bs58");
+    return bs58.decode(value);
+  }
+  return arrayLikeToBytes(value);
+};
+
+// src/utils/post-message.ts
+var PostMessageType = {
+  AUTH: "auth",
+  INIT: "init",
+  WALLET: "wallet",
+  EXTERNAL_WALLET: "external_wallet"
+};
+var PostMessageMethod = {
+  CLOSE: "CLOSE",
+  CREATE_WALLET: "CREATE_WALLET",
+  IMPORT_KEY: "IMPORT_KEY",
+  FUND_WALLET: "FUND_WALLET",
+  GET_APP_CONFIG: "GET_APP_CONFIG",
+  GET_BALANCE: "GET_BALANCE",
+  GET_CONFIRM_TRANSACTION: "GET_CONFIRM_TRANSACTION",
+  GET_CONFIRM_ETHEREUM_TRANSACTION: "GET_CONFIRM_ETHEREUM_TRANSACTION",
+  GET_CURRENT_SESSION: "GET_CURRENT_SESSION",
+  GET_TOKEN_ACCOUNTS_BY_OWNER: "GET_TOKEN_ACCOUNTS_BY_OWNER",
+  GET_USER: "GET_USER",
+  GET_WALLET: "GET_WALLET",
+  GET_WALLETS: "GET_WALLETS",
+  IS_AUTHENTICATED: "IS_AUTHENTICATED",
+  LOGIN_CREATE: "LOGIN_CREATE",
+  LOGOUT: "LOGOUT",
+  PREFETCH_CAPTCHA: "PREFETCH_CAPTCHA",
+  READY: "READY",
+  SEND_TRANSACTION: "SEND_TRANSACTION",
+  SIGN_MESSAGE: "SIGN_MESSAGE",
+  SIGN_TRANSACTION: "SIGN_TRANSACTION",
+  SIGN_TYPED_DATA: "SIGN_TYPED_DATA",
+  // Sign a pre-computed 32-byte digest as ECDSA. Caller-supplied hash
+  // — no EIP-191 prefix, no tx parsing, no domain separator. Useful
+  // for ZK circuits / custom auth flows / anywhere the digest is
+  // computed externally. Mirrors Privy's `secp256k1_sign` provider
+  // method but exposed as its own postMessage to keep the iframe
+  // dispatcher boring.
+  SIGN_HASH: "SIGN_HASH",
+  SIGN_7702_AUTHORIZATION: "SIGN_7702_AUTHORIZATION",
+  VERIFY_EMAIL_OTP: "VERIFY_EMAIL_OTP",
+  VERIFY_OAUTH: "VERIFY_OAUTH",
+  START_OAUTH: "START_OAUTH",
+  WALLET_REGISTRATION_NONCE: "WALLET_REGISTRATION_NONCE",
+  VERIFY_SIWE_WALLET_REGISTRATION: "VERIFY_SIWE_WALLET_REGISTRATION",
+  ATTACH_OAUTH: "ATTACH_OAUTH",
+  DETACH_OAUTH: "DETACH_OAUTH",
+  // Passkey as a post-identity enrollment / unlock ceremony. The two
+  // methods below split the ceremony so the parent owns the WebAuthn
+  // API call (where user activation lives) and the iframe owns the
+  // begin/verify HTTP calls (where the session JWT lives).
+  PASSKEY_REGISTER_BEGIN: "PASSKEY_REGISTER_BEGIN",
+  PASSKEY_REGISTER_VERIFY: "PASSKEY_REGISTER_VERIFY",
+  GET_PASSKEY_STATUS: "GET_PASSKEY_STATUS",
+  // Parent-side passkey assertion plumbing. Parent calls GET_DEK_INFO
+  // to learn which credential IDs to put in allowCredentials and to
+  // know whether bootstrap-vs-unwrap path applies, then runs
+  // navigator.credentials.get itself (where iframe-cross-origin
+  // activation rules don't bite). Wallet-op postMessages then carry
+  // the resulting user_handle_b64url + credential_id_b64url back into
+  // the iframe so encrypted-keyshare helpers can unwrap the DEK.
+  GET_DEK_INFO: "GET_DEK_INFO",
+  // Multi-passkey management on an existing user. ADD_PASSKEY_WRAP is
+  // the iframe half of the parent-driven add-passkey flow: parent runs
+  // both WebAuthn ceremonies (assert old credential, register new
+  // credential), then posts the two resulting (userHandle, credId)
+  // pairs here so the iframe can unlock the DEK with the old
+  // credential and seal a new wrap with the new credential.
+  ADD_PASSKEY_WRAP: "ADD_PASSKEY_WRAP",
+  REMOVE_PASSKEY: "REMOVE_PASSKEY"
+};
+
+// src/sdk/parent-passkey-assert.ts
+var assertPasskeyInParent = async ({
+  transport,
+  passkey,
+  publishableKey,
+  requireFreshAssertion = false
+}) => {
+  if (!requireFreshAssertion) {
+    const cached = readParentAssertCache();
+    if (cached) return cached;
+  }
+  const dekInfo = await transport.send(
+    PostMessageType.AUTH,
+    PostMessageMethod.GET_DEK_INFO,
+    { publishableKey }
+  );
+  const allowList = dekInfo.allow_credential_ids_b64url ?? [];
+  if (allowList.length === 0) {
+    throw new Error("passkey_required");
+  }
+  const rpId = dekInfo.rp_id;
+  if (!rpId) {
+    throw new Error("webauthn_rp_id_not_configured");
+  }
+  const challengeBytes = crypto.getRandomValues(new Uint8Array(32));
+  const challenge = toB64url(challengeBytes);
+  const credential = await passkey.assert({
+    rpId,
+    challenge,
+    allowCredentials: []
+  });
+  const result = {
+    userHandleB64url: credential.userHandleB64url,
+    credentialIdB64url: credential.rawIdB64url
+  };
+  writeParentAssertCache(result);
+  return result;
+};
+
+// src/sdk/headless-ethereum.ts
+var getHeadlessEthereumMethods = ({
+  transport,
+  passkey,
+  publishableKey
+}) => ({
+  signEthereumMessageHeadless: async (params) => withClearOnFailure(async () => {
+    if (!transport.isReady()) throw new Error("SDK not ready");
+    const { userHandleB64url, credentialIdB64url } = await assertPasskeyInParent({
+      transport,
+      passkey,
+      publishableKey,
+      requireFreshAssertion: params.requireFreshAssertion
+    });
+    return transport.send(
+      PostMessageType.WALLET,
+      PostMessageMethod.SIGN_MESSAGE,
+      {
+        message: params.message,
+        publishableKey,
+        wallet: params.wallet,
+        uiOptions: params.options?.uiOptions,
+        userHandleB64url,
+        credentialIdB64url
+      }
+    );
+  }),
+  signEthereumTransactionHeadless: async (params) => withClearOnFailure(async () => {
+    if (!transport.isReady()) throw new Error("SDK not ready");
+    const { userHandleB64url, credentialIdB64url } = await assertPasskeyInParent({
+      transport,
+      passkey,
+      publishableKey,
+      requireFreshAssertion: params.requireFreshAssertion
+    });
+    return transport.send(
+      PostMessageType.WALLET,
+      PostMessageMethod.SIGN_TRANSACTION,
+      {
+        // params.transaction is typed as a pre-serialized RLP string.
+        serializedTransaction: params.transaction,
+        publishableKey,
+        wallet: params.wallet,
+        options: params.options,
+        userHandleB64url,
+        credentialIdB64url
+      }
+    );
+  }),
+  signEthereumTypedDataHeadless: async (params) => withClearOnFailure(async () => {
+    if (!transport.isReady()) throw new Error("SDK not ready");
+    const { userHandleB64url, credentialIdB64url } = await assertPasskeyInParent({
+      transport,
+      passkey,
+      publishableKey,
+      requireFreshAssertion: params.requireFreshAssertion
+    });
+    return transport.send(
+      PostMessageType.WALLET,
+      PostMessageMethod.SIGN_TYPED_DATA,
+      {
+        domain: params.domain,
+        types: params.types,
+        primaryType: params.primaryType,
+        message: params.message,
+        publishableKey,
+        wallet: params.wallet,
+        options: params.options,
+        userHandleB64url,
+        credentialIdB64url
+      }
+    );
+  }),
+  signEthereumHashHeadless: async (params) => withClearOnFailure(async () => {
+    if (!transport.isReady()) throw new Error("SDK not ready");
+    const { userHandleB64url, credentialIdB64url } = await assertPasskeyInParent({
+      transport,
+      passkey,
+      publishableKey,
+      requireFreshAssertion: params.requireFreshAssertion
+    });
+    return transport.send(
+      PostMessageType.WALLET,
+      PostMessageMethod.SIGN_HASH,
+      {
+        hash: params.hash,
+        publishableKey,
+        wallet: params.wallet,
+        options: params.options,
+        userHandleB64url,
+        credentialIdB64url
+      }
+    );
+  }),
+  signEthereum7702AuthorizationHeadless: async (params) => withClearOnFailure(async () => {
+    if (!transport.isReady()) throw new Error("SDK not ready");
+    const { userHandleB64url, credentialIdB64url } = await assertPasskeyInParent({
+      transport,
+      passkey,
+      publishableKey,
+      requireFreshAssertion: params.requireFreshAssertion
+    });
+    return transport.send(
+      PostMessageType.WALLET,
+      PostMessageMethod.SIGN_7702_AUTHORIZATION,
+      {
+        contractAddress: params.contractAddress,
+        chainId: params.chainId,
+        nonce: params.nonce,
+        executor: params.executor,
+        publishableKey,
+        wallet: params.wallet,
+        options: params.options,
+        userHandleB64url,
+        credentialIdB64url
+      }
+    );
+  }),
+  sendEthereumTransactionHeadless: async (params) => withClearOnFailure(async () => {
+    if (!transport.isReady()) throw new Error("SDK not ready");
+    const { userHandleB64url, credentialIdB64url } = await assertPasskeyInParent({
+      transport,
+      passkey,
+      publishableKey,
+      requireFreshAssertion: params.requireFreshAssertion
+    });
+    const serializedTransaction = await serializeEthereumTransaction(
+      params.transaction
+    );
+    const signed = await transport.send(
+      PostMessageType.WALLET,
+      PostMessageMethod.SIGN_TRANSACTION,
+      {
+        serializedTransaction,
+        publishableKey,
+        wallet: params.wallet,
+        options: params.options,
+        userHandleB64url,
+        credentialIdB64url
+      }
+    );
+    if (!signed.serializedSigned) {
+      throw new Error(
+        "iframe returned no serializedSigned for SIGN_TRANSACTION"
+      );
+    }
+    const hash = await broadcastEthereumRaw(
+      params.rpcUrl,
+      signed.serializedSigned
+    );
+    return { hash };
+  }),
+  getEthereumBalance: async (params) => {
+    if (!transport.isReady()) throw new Error("SDK not ready");
+    return transport.send(
+      PostMessageType.WALLET,
+      PostMessageMethod.GET_BALANCE,
+      { publishableKey, ...params }
+    );
+  },
+  getEthereumTokenAccountsByOwner: async (params) => {
+    if (!transport.isReady()) throw new Error("SDK not ready");
+    return transport.send(
+      PostMessageType.WALLET,
+      PostMessageMethod.GET_TOKEN_ACCOUNTS_BY_OWNER,
+      { publishableKey, ...params }
+    );
+  },
+  getEthereumConfirmTransaction: async (params) => {
+    if (!transport.isReady()) throw new Error("SDK not ready");
+    const serializedTransaction = typeof params.transaction === "string" ? params.transaction : await serializeEthereumTransaction(
+      params.transaction
+    );
+    return transport.send(
+      PostMessageType.WALLET,
+      PostMessageMethod.GET_CONFIRM_ETHEREUM_TRANSACTION,
+      {
+        transaction: serializedTransaction,
+        walletAddress: params.walletAddress,
+        rpcUrl: params.rpcUrl,
+        network: params.network
+      }
+    );
+  }
+});
+
+// src/sdk/headless-solana.ts
+var getHeadlessSolanaMethods = ({
+  transport,
+  passkey,
+  publishableKey
+}) => ({
+  signSolanaMessageHeadless: async (params) => withClearOnFailure(async () => {
+    if (!transport.isReady()) throw new Error("SDK not ready");
+    const { userHandleB64url, credentialIdB64url } = await assertPasskeyInParent({
+      transport,
+      passkey,
+      publishableKey,
+      requireFreshAssertion: params.requireFreshAssertion
+    });
+    const { signature } = await transport.send(
+      PostMessageType.WALLET,
+      PostMessageMethod.SIGN_MESSAGE,
+      {
+        message: params.message,
+        publishableKey,
+        wallet: params.wallet,
+        uiOptions: params.options?.uiOptions,
+        userHandleB64url,
+        credentialIdB64url
+      }
+    );
+    return { signature: arrayLikeToBytes(signature) };
+  }),
+  signSolanaTransactionHeadless: async (params) => withClearOnFailure(async () => {
+    if (!transport.isReady()) throw new Error("SDK not ready");
+    const { userHandleB64url, credentialIdB64url } = await assertPasskeyInParent({
+      transport,
+      passkey,
+      publishableKey,
+      requireFreshAssertion: params.requireFreshAssertion
+    });
+    const { signedTransaction } = await transport.send(
+      PostMessageType.WALLET,
+      PostMessageMethod.SIGN_TRANSACTION,
+      {
+        serializedTransaction: params.transaction,
+        publishableKey,
+        wallet: params.wallet,
+        options: params.options,
+        userHandleB64url,
+        credentialIdB64url
+      }
+    );
+    return { signedTransaction: await bs58ToBytes(signedTransaction) };
+  }),
+  sendSolanaTransactionHeadless: async (params) => withClearOnFailure(async () => {
+    if (!transport.isReady()) throw new Error("SDK not ready");
+    const { userHandleB64url, credentialIdB64url } = await assertPasskeyInParent({
+      transport,
+      passkey,
+      publishableKey,
+      requireFreshAssertion: params.requireFreshAssertion
+    });
+    const { signedTransaction } = await transport.send(
+      PostMessageType.WALLET,
+      PostMessageMethod.SIGN_TRANSACTION,
+      {
+        serializedTransaction: params.transaction,
+        publishableKey,
+        wallet: params.wallet,
+        options: params.options,
+        userHandleB64url,
+        credentialIdB64url
+      }
+    );
+    const broadcastSignature = await broadcastSolanaSigned(
+      params.rpcUrl,
+      signedTransaction
+    );
+    return { signature: await bs58ToBytes(broadcastSignature) };
+  }),
+  getSolanaBalance: async (params) => {
+    if (!transport.isReady()) throw new Error("SDK not ready");
+    return transport.send(
+      PostMessageType.WALLET,
+      PostMessageMethod.GET_BALANCE,
+      { publishableKey, ...params }
+    );
+  },
+  getSolanaTokenAccountsByOwner: async (params) => {
+    if (!transport.isReady()) throw new Error("SDK not ready");
+    return transport.send(
+      PostMessageType.WALLET,
+      PostMessageMethod.GET_TOKEN_ACCOUNTS_BY_OWNER,
+      { publishableKey, ...params }
+    );
+  }
+});
+
+// src/sdk/headless-authentication.ts
+var getHeadlessAuthenticationMethods = ({
+  transport,
+  publishableKey,
+  emailConfig,
+  setIsAuthenticated,
+  setUser
+}) => ({
+  /** Send a one-time passcode to the user's email address. */
+  sendCode: async (params) => {
+    await transport.send(
+      PostMessageType.AUTH,
+      PostMessageMethod.LOGIN_CREATE,
+      {
+        email: params.email,
+        publishableKey,
+        disableSignup: params.disableSignup
+      }
+    );
+    authState.clearEmail();
+    authState.setEmail(params.email);
+  },
+  /**
+   * Verify the OTP and complete the login. The iframe-app handles
+   * session persistence; on success the SDK flips isAuthenticated and
+   * fetches the real user object to populate provider state.
+   */
+  loginWithCode: async (params) => {
+    const email = authState.getEmail();
+    if (!email) throw new Error("no_pending_email_otp");
+    const result = await transport.send(
+      PostMessageType.AUTH,
+      PostMessageMethod.VERIFY_EMAIL_OTP,
+      {
+        email,
+        code: params.code,
+        publishableKey,
+        expiresIn: emailConfig?.expiresIn
+      }
+    );
+    authState.clearEmail();
+    if (setIsAuthenticated) setIsAuthenticated(true);
+    if (setUser) {
+      try {
+        const user = await transport.send(
+          PostMessageType.AUTH,
+          PostMessageMethod.GET_USER,
+          { publishableKey }
+        );
+        setUser(user ?? null);
+      } catch {
+      }
+    }
+    return result;
+  },
+  /**
+   * Commit an OAuth code/token for a session. The deep-link / popup
+   * round-trip lives in the platform-specific OAuth hook; this method
+   * is the tail-end commit step the hook calls.
+   */
+  verifyOAuth: async (params) => {
+    const result = await transport.send(
+      PostMessageType.AUTH,
+      PostMessageMethod.VERIFY_OAUTH,
+      {
+        publishableKey,
+        provider: params.provider,
+        code: params.code,
+        token: params.token,
+        state: params.state
+      }
+    );
+    if (setIsAuthenticated) setIsAuthenticated(true);
+    if (setUser) {
+      try {
+        const user = await transport.send(
+          PostMessageType.AUTH,
+          PostMessageMethod.GET_USER,
+          { publishableKey }
+        );
+        setUser(user ?? null);
+      } catch {
+      }
+    }
+    return result;
+  }
+});
+
+// src/sdk/headless-general.ts
+var getHeadlessGeneralMethods = ({
+  transport,
+  passkey,
+  storage,
+  publishableKey,
+  setIsAuthenticated,
+  setUser
+}) => ({
+  getPasskeyStatus: async () => transport.send(
+    PostMessageType.AUTH,
+    PostMessageMethod.GET_PASSKEY_STATUS,
+    { publishableKey }
+  ),
+  removePasskey: async (credentialIdB64url) => {
+    await transport.send(
+      PostMessageType.AUTH,
+      PostMessageMethod.REMOVE_PASSKEY,
+      { publishableKey, credentialIdB64url }
+    );
+  },
+  createWallet: (walletType, options) => withClearOnFailure(async () => {
+    const { userHandleB64url, credentialIdB64url } = await assertPasskeyInParent({
+      transport,
+      passkey,
+      publishableKey,
+      requireFreshAssertion: options?.requireFreshAssertion
+    });
+    const wallet = await transport.send(
+      PostMessageType.WALLET,
+      PostMessageMethod.CREATE_WALLET,
+      {
+        walletType,
+        publishableKey,
+        options,
+        userHandleB64url,
+        credentialIdB64url
+      }
+    );
+    return { wallet };
+  }),
+  importKey: (walletType, key, options) => withClearOnFailure(async () => {
+    const { userHandleB64url, credentialIdB64url } = await assertPasskeyInParent({
+      transport,
+      passkey,
+      publishableKey,
+      requireFreshAssertion: options?.requireFreshAssertion
+    });
+    const wallet = await transport.send(
+      PostMessageType.WALLET,
+      PostMessageMethod.IMPORT_KEY,
+      {
+        walletType,
+        publishableKey,
+        key,
+        userHandleB64url,
+        credentialIdB64url
+      }
+    );
+    return { wallet };
+  }),
+  getWallets: async (walletType) => {
+    const { wallets } = await transport.send(
+      PostMessageType.WALLET,
+      PostMessageMethod.GET_WALLETS,
+      { walletType, publishableKey }
+    );
+    return { wallets, walletType };
+  },
+  // getSessionTokens returns only the tokens that may safely cross the
+  // iframe -> parent-page boundary: access + identity. The refresh token
+  // is the session's primary credential and stays inside the iframe's
+  // origin (held in IndexedDB, used internally for /auth/refresh). An
+  // XSS in the host page would otherwise be able to exfiltrate it and
+  // silently extend session lifetime.
+  getSessionTokens: async () => {
+    try {
+      const session = await transport.send(
+        PostMessageType.AUTH,
+        PostMessageMethod.GET_CURRENT_SESSION,
+        { publishableKey }
+      );
+      return session ? {
+        accessToken: session.accessToken,
+        identityToken: session.identityToken,
+        expiresAt: session.expiresAt
+      } : null;
+    } catch (error) {
+      console.error(
+        "Failed to get session tokens:",
+        error instanceof Error ? error.message : String(error)
+      );
+      return null;
+    }
+  },
+  logout: async () => {
+    try {
+      await transport.send(PostMessageType.AUTH, PostMessageMethod.LOGOUT, {
+        publishableKey
+      });
+      clearParentAssertCache();
+      await storage.remove("id_token");
+      if (setIsAuthenticated) setIsAuthenticated(false);
+      if (setUser) setUser(null);
+      return { success: true, message: "Successfully logged out" };
+    } catch (error) {
+      console.error(
+        "Logout failed:",
+        error instanceof Error ? error.message : String(error)
+      );
+      return { success: false, message: "Logout failed" };
+    }
+  },
+  getCurrentSession: async () => {
+    try {
+      return await transport.send(
+        PostMessageType.AUTH,
+        PostMessageMethod.GET_CURRENT_SESSION,
+        { publishableKey }
+      );
+    } catch (error) {
+      console.error(
+        "Get session failed:",
+        error instanceof Error ? error.message : String(error)
+      );
+      return null;
+    }
+  },
+  getUser: async () => {
+    try {
+      const user = await transport.send(
+        PostMessageType.AUTH,
+        PostMessageMethod.GET_USER,
+        { publishableKey }
+      );
+      if (setUser) setUser(user);
+      return user;
+    } catch (error) {
+      console.error(
+        "Get user failed:",
+        error instanceof Error ? error.message : String(error)
+      );
+      return null;
+    }
+  }
+});
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  assertPasskeyInParent,
+  getHeadlessAuthenticationMethods,
+  getHeadlessEthereumMethods,
+  getHeadlessGeneralMethods,
+  getHeadlessSolanaMethods
+});