@moon-x/core 0.2.0

package/dist/sdk/index.mjs

@@ -0,0 +1,579 @@
+import {
+  PostMessageMethod,
+  PostMessageType
+} from "../chunk-SOKLPX7V.mjs";
+import {
+  arrayLikeToBytes,
+  authState,
+  broadcastEthereumRaw,
+  broadcastSolanaSigned,
+  bs58ToBytes,
+  clearParentAssertCache,
+  readParentAssertCache,
+  serializeEthereumTransaction,
+  toB64url,
+  withClearOnFailure,
+  writeParentAssertCache
+} from "../chunk-CDT4MC7S.mjs";
+import "../chunk-GQKIA37O.mjs";
+
+// src/sdk/parent-passkey-assert.ts
+var assertPasskeyInParent = async ({
+  transport,
+  passkey,
+  publishableKey,
+  requireFreshAssertion = false
+}) => {
+  if (!requireFreshAssertion) {
+    const cached = readParentAssertCache();
+    if (cached) return cached;
+  }
+  const dekInfo = await transport.send(
+    PostMessageType.AUTH,
+    PostMessageMethod.GET_DEK_INFO,
+    { publishableKey }
+  );
+  const allowList = dekInfo.allow_credential_ids_b64url ?? [];
+  if (allowList.length === 0) {
+    throw new Error("passkey_required");
+  }
+  const rpId = dekInfo.rp_id;
+  if (!rpId) {
+    throw new Error("webauthn_rp_id_not_configured");
+  }
+  const challengeBytes = crypto.getRandomValues(new Uint8Array(32));
+  const challenge = toB64url(challengeBytes);
+  const credential = await passkey.assert({
+    rpId,
+    challenge,
+    allowCredentials: []
+  });
+  const result = {
+    userHandleB64url: credential.userHandleB64url,
+    credentialIdB64url: credential.rawIdB64url
+  };
+  writeParentAssertCache(result);
+  return result;
+};
+
+// src/sdk/headless-ethereum.ts
+var getHeadlessEthereumMethods = ({
+  transport,
+  passkey,
+  publishableKey
+}) => ({
+  signEthereumMessageHeadless: async (params) => withClearOnFailure(async () => {
+    if (!transport.isReady()) throw new Error("SDK not ready");
+    const { userHandleB64url, credentialIdB64url } = await assertPasskeyInParent({
+      transport,
+      passkey,
+      publishableKey,
+      requireFreshAssertion: params.requireFreshAssertion
+    });
+    return transport.send(
+      PostMessageType.WALLET,
+      PostMessageMethod.SIGN_MESSAGE,
+      {
+        message: params.message,
+        publishableKey,
+        wallet: params.wallet,
+        uiOptions: params.options?.uiOptions,
+        userHandleB64url,
+        credentialIdB64url
+      }
+    );
+  }),
+  signEthereumTransactionHeadless: async (params) => withClearOnFailure(async () => {
+    if (!transport.isReady()) throw new Error("SDK not ready");
+    const { userHandleB64url, credentialIdB64url } = await assertPasskeyInParent({
+      transport,
+      passkey,
+      publishableKey,
+      requireFreshAssertion: params.requireFreshAssertion
+    });
+    return transport.send(
+      PostMessageType.WALLET,
+      PostMessageMethod.SIGN_TRANSACTION,
+      {
+        // params.transaction is typed as a pre-serialized RLP string.
+        serializedTransaction: params.transaction,
+        publishableKey,
+        wallet: params.wallet,
+        options: params.options,
+        userHandleB64url,
+        credentialIdB64url
+      }
+    );
+  }),
+  signEthereumTypedDataHeadless: async (params) => withClearOnFailure(async () => {
+    if (!transport.isReady()) throw new Error("SDK not ready");
+    const { userHandleB64url, credentialIdB64url } = await assertPasskeyInParent({
+      transport,
+      passkey,
+      publishableKey,
+      requireFreshAssertion: params.requireFreshAssertion
+    });
+    return transport.send(
+      PostMessageType.WALLET,
+      PostMessageMethod.SIGN_TYPED_DATA,
+      {
+        domain: params.domain,
+        types: params.types,
+        primaryType: params.primaryType,
+        message: params.message,
+        publishableKey,
+        wallet: params.wallet,
+        options: params.options,
+        userHandleB64url,
+        credentialIdB64url
+      }
+    );
+  }),
+  signEthereumHashHeadless: async (params) => withClearOnFailure(async () => {
+    if (!transport.isReady()) throw new Error("SDK not ready");
+    const { userHandleB64url, credentialIdB64url } = await assertPasskeyInParent({
+      transport,
+      passkey,
+      publishableKey,
+      requireFreshAssertion: params.requireFreshAssertion
+    });
+    return transport.send(
+      PostMessageType.WALLET,
+      PostMessageMethod.SIGN_HASH,
+      {
+        hash: params.hash,
+        publishableKey,
+        wallet: params.wallet,
+        options: params.options,
+        userHandleB64url,
+        credentialIdB64url
+      }
+    );
+  }),
+  signEthereum7702AuthorizationHeadless: async (params) => withClearOnFailure(async () => {
+    if (!transport.isReady()) throw new Error("SDK not ready");
+    const { userHandleB64url, credentialIdB64url } = await assertPasskeyInParent({
+      transport,
+      passkey,
+      publishableKey,
+      requireFreshAssertion: params.requireFreshAssertion
+    });
+    return transport.send(
+      PostMessageType.WALLET,
+      PostMessageMethod.SIGN_7702_AUTHORIZATION,
+      {
+        contractAddress: params.contractAddress,
+        chainId: params.chainId,
+        nonce: params.nonce,
+        executor: params.executor,
+        publishableKey,
+        wallet: params.wallet,
+        options: params.options,
+        userHandleB64url,
+        credentialIdB64url
+      }
+    );
+  }),
+  sendEthereumTransactionHeadless: async (params) => withClearOnFailure(async () => {
+    if (!transport.isReady()) throw new Error("SDK not ready");
+    const { userHandleB64url, credentialIdB64url } = await assertPasskeyInParent({
+      transport,
+      passkey,
+      publishableKey,
+      requireFreshAssertion: params.requireFreshAssertion
+    });
+    const serializedTransaction = await serializeEthereumTransaction(
+      params.transaction
+    );
+    const signed = await transport.send(
+      PostMessageType.WALLET,
+      PostMessageMethod.SIGN_TRANSACTION,
+      {
+        serializedTransaction,
+        publishableKey,
+        wallet: params.wallet,
+        options: params.options,
+        userHandleB64url,
+        credentialIdB64url
+      }
+    );
+    if (!signed.serializedSigned) {
+      throw new Error(
+        "iframe returned no serializedSigned for SIGN_TRANSACTION"
+      );
+    }
+    const hash = await broadcastEthereumRaw(
+      params.rpcUrl,
+      signed.serializedSigned
+    );
+    return { hash };
+  }),
+  getEthereumBalance: async (params) => {
+    if (!transport.isReady()) throw new Error("SDK not ready");
+    return transport.send(
+      PostMessageType.WALLET,
+      PostMessageMethod.GET_BALANCE,
+      { publishableKey, ...params }
+    );
+  },
+  getEthereumTokenAccountsByOwner: async (params) => {
+    if (!transport.isReady()) throw new Error("SDK not ready");
+    return transport.send(
+      PostMessageType.WALLET,
+      PostMessageMethod.GET_TOKEN_ACCOUNTS_BY_OWNER,
+      { publishableKey, ...params }
+    );
+  },
+  getEthereumConfirmTransaction: async (params) => {
+    if (!transport.isReady()) throw new Error("SDK not ready");
+    const serializedTransaction = typeof params.transaction === "string" ? params.transaction : await serializeEthereumTransaction(
+      params.transaction
+    );
+    return transport.send(
+      PostMessageType.WALLET,
+      PostMessageMethod.GET_CONFIRM_ETHEREUM_TRANSACTION,
+      {
+        transaction: serializedTransaction,
+        walletAddress: params.walletAddress,
+        rpcUrl: params.rpcUrl,
+        network: params.network
+      }
+    );
+  }
+});
+
+// src/sdk/headless-solana.ts
+var getHeadlessSolanaMethods = ({
+  transport,
+  passkey,
+  publishableKey
+}) => ({
+  signSolanaMessageHeadless: async (params) => withClearOnFailure(async () => {
+    if (!transport.isReady()) throw new Error("SDK not ready");
+    const { userHandleB64url, credentialIdB64url } = await assertPasskeyInParent({
+      transport,
+      passkey,
+      publishableKey,
+      requireFreshAssertion: params.requireFreshAssertion
+    });
+    const { signature } = await transport.send(
+      PostMessageType.WALLET,
+      PostMessageMethod.SIGN_MESSAGE,
+      {
+        message: params.message,
+        publishableKey,
+        wallet: params.wallet,
+        uiOptions: params.options?.uiOptions,
+        userHandleB64url,
+        credentialIdB64url
+      }
+    );
+    return { signature: arrayLikeToBytes(signature) };
+  }),
+  signSolanaTransactionHeadless: async (params) => withClearOnFailure(async () => {
+    if (!transport.isReady()) throw new Error("SDK not ready");
+    const { userHandleB64url, credentialIdB64url } = await assertPasskeyInParent({
+      transport,
+      passkey,
+      publishableKey,
+      requireFreshAssertion: params.requireFreshAssertion
+    });
+    const { signedTransaction } = await transport.send(
+      PostMessageType.WALLET,
+      PostMessageMethod.SIGN_TRANSACTION,
+      {
+        serializedTransaction: params.transaction,
+        publishableKey,
+        wallet: params.wallet,
+        options: params.options,
+        userHandleB64url,
+        credentialIdB64url
+      }
+    );
+    return { signedTransaction: await bs58ToBytes(signedTransaction) };
+  }),
+  sendSolanaTransactionHeadless: async (params) => withClearOnFailure(async () => {
+    if (!transport.isReady()) throw new Error("SDK not ready");
+    const { userHandleB64url, credentialIdB64url } = await assertPasskeyInParent({
+      transport,
+      passkey,
+      publishableKey,
+      requireFreshAssertion: params.requireFreshAssertion
+    });
+    const { signedTransaction } = await transport.send(
+      PostMessageType.WALLET,
+      PostMessageMethod.SIGN_TRANSACTION,
+      {
+        serializedTransaction: params.transaction,
+        publishableKey,
+        wallet: params.wallet,
+        options: params.options,
+        userHandleB64url,
+        credentialIdB64url
+      }
+    );
+    const broadcastSignature = await broadcastSolanaSigned(
+      params.rpcUrl,
+      signedTransaction
+    );
+    return { signature: await bs58ToBytes(broadcastSignature) };
+  }),
+  getSolanaBalance: async (params) => {
+    if (!transport.isReady()) throw new Error("SDK not ready");
+    return transport.send(
+      PostMessageType.WALLET,
+      PostMessageMethod.GET_BALANCE,
+      { publishableKey, ...params }
+    );
+  },
+  getSolanaTokenAccountsByOwner: async (params) => {
+    if (!transport.isReady()) throw new Error("SDK not ready");
+    return transport.send(
+      PostMessageType.WALLET,
+      PostMessageMethod.GET_TOKEN_ACCOUNTS_BY_OWNER,
+      { publishableKey, ...params }
+    );
+  }
+});
+
+// src/sdk/headless-authentication.ts
+var getHeadlessAuthenticationMethods = ({
+  transport,
+  publishableKey,
+  emailConfig,
+  setIsAuthenticated,
+  setUser
+}) => ({
+  /** Send a one-time passcode to the user's email address. */
+  sendCode: async (params) => {
+    await transport.send(
+      PostMessageType.AUTH,
+      PostMessageMethod.LOGIN_CREATE,
+      {
+        email: params.email,
+        publishableKey,
+        disableSignup: params.disableSignup
+      }
+    );
+    authState.clearEmail();
+    authState.setEmail(params.email);
+  },
+  /**
+   * Verify the OTP and complete the login. The iframe-app handles
+   * session persistence; on success the SDK flips isAuthenticated and
+   * fetches the real user object to populate provider state.
+   */
+  loginWithCode: async (params) => {
+    const email = authState.getEmail();
+    if (!email) throw new Error("no_pending_email_otp");
+    const result = await transport.send(
+      PostMessageType.AUTH,
+      PostMessageMethod.VERIFY_EMAIL_OTP,
+      {
+        email,
+        code: params.code,
+        publishableKey,
+        expiresIn: emailConfig?.expiresIn
+      }
+    );
+    authState.clearEmail();
+    if (setIsAuthenticated) setIsAuthenticated(true);
+    if (setUser) {
+      try {
+        const user = await transport.send(
+          PostMessageType.AUTH,
+          PostMessageMethod.GET_USER,
+          { publishableKey }
+        );
+        setUser(user ?? null);
+      } catch {
+      }
+    }
+    return result;
+  },
+  /**
+   * Commit an OAuth code/token for a session. The deep-link / popup
+   * round-trip lives in the platform-specific OAuth hook; this method
+   * is the tail-end commit step the hook calls.
+   */
+  verifyOAuth: async (params) => {
+    const result = await transport.send(
+      PostMessageType.AUTH,
+      PostMessageMethod.VERIFY_OAUTH,
+      {
+        publishableKey,
+        provider: params.provider,
+        code: params.code,
+        token: params.token,
+        state: params.state
+      }
+    );
+    if (setIsAuthenticated) setIsAuthenticated(true);
+    if (setUser) {
+      try {
+        const user = await transport.send(
+          PostMessageType.AUTH,
+          PostMessageMethod.GET_USER,
+          { publishableKey }
+        );
+        setUser(user ?? null);
+      } catch {
+      }
+    }
+    return result;
+  }
+});
+
+// src/sdk/headless-general.ts
+var getHeadlessGeneralMethods = ({
+  transport,
+  passkey,
+  storage,
+  publishableKey,
+  setIsAuthenticated,
+  setUser
+}) => ({
+  getPasskeyStatus: async () => transport.send(
+    PostMessageType.AUTH,
+    PostMessageMethod.GET_PASSKEY_STATUS,
+    { publishableKey }
+  ),
+  removePasskey: async (credentialIdB64url) => {
+    await transport.send(
+      PostMessageType.AUTH,
+      PostMessageMethod.REMOVE_PASSKEY,
+      { publishableKey, credentialIdB64url }
+    );
+  },
+  createWallet: (walletType, options) => withClearOnFailure(async () => {
+    const { userHandleB64url, credentialIdB64url } = await assertPasskeyInParent({
+      transport,
+      passkey,
+      publishableKey,
+      requireFreshAssertion: options?.requireFreshAssertion
+    });
+    const wallet = await transport.send(
+      PostMessageType.WALLET,
+      PostMessageMethod.CREATE_WALLET,
+      {
+        walletType,
+        publishableKey,
+        options,
+        userHandleB64url,
+        credentialIdB64url
+      }
+    );
+    return { wallet };
+  }),
+  importKey: (walletType, key, options) => withClearOnFailure(async () => {
+    const { userHandleB64url, credentialIdB64url } = await assertPasskeyInParent({
+      transport,
+      passkey,
+      publishableKey,
+      requireFreshAssertion: options?.requireFreshAssertion
+    });
+    const wallet = await transport.send(
+      PostMessageType.WALLET,
+      PostMessageMethod.IMPORT_KEY,
+      {
+        walletType,
+        publishableKey,
+        key,
+        userHandleB64url,
+        credentialIdB64url
+      }
+    );
+    return { wallet };
+  }),
+  getWallets: async (walletType) => {
+    const { wallets } = await transport.send(
+      PostMessageType.WALLET,
+      PostMessageMethod.GET_WALLETS,
+      { walletType, publishableKey }
+    );
+    return { wallets, walletType };
+  },
+  // getSessionTokens returns only the tokens that may safely cross the
+  // iframe -> parent-page boundary: access + identity. The refresh token
+  // is the session's primary credential and stays inside the iframe's
+  // origin (held in IndexedDB, used internally for /auth/refresh). An
+  // XSS in the host page would otherwise be able to exfiltrate it and
+  // silently extend session lifetime.
+  getSessionTokens: async () => {
+    try {
+      const session = await transport.send(
+        PostMessageType.AUTH,
+        PostMessageMethod.GET_CURRENT_SESSION,
+        { publishableKey }
+      );
+      return session ? {
+        accessToken: session.accessToken,
+        identityToken: session.identityToken,
+        expiresAt: session.expiresAt
+      } : null;
+    } catch (error) {
+      console.error(
+        "Failed to get session tokens:",
+        error instanceof Error ? error.message : String(error)
+      );
+      return null;
+    }
+  },
+  logout: async () => {
+    try {
+      await transport.send(PostMessageType.AUTH, PostMessageMethod.LOGOUT, {
+        publishableKey
+      });
+      clearParentAssertCache();
+      await storage.remove("id_token");
+      if (setIsAuthenticated) setIsAuthenticated(false);
+      if (setUser) setUser(null);
+      return { success: true, message: "Successfully logged out" };
+    } catch (error) {
+      console.error(
+        "Logout failed:",
+        error instanceof Error ? error.message : String(error)
+      );
+      return { success: false, message: "Logout failed" };
+    }
+  },
+  getCurrentSession: async () => {
+    try {
+      return await transport.send(
+        PostMessageType.AUTH,
+        PostMessageMethod.GET_CURRENT_SESSION,
+        { publishableKey }
+      );
+    } catch (error) {
+      console.error(
+        "Get session failed:",
+        error instanceof Error ? error.message : String(error)
+      );
+      return null;
+    }
+  },
+  getUser: async () => {
+    try {
+      const user = await transport.send(
+        PostMessageType.AUTH,
+        PostMessageMethod.GET_USER,
+        { publishableKey }
+      );
+      if (setUser) setUser(user);
+      return user;
+    } catch (error) {
+      console.error(
+        "Get user failed:",
+        error instanceof Error ? error.message : String(error)
+      );
+      return null;
+    }
+  }
+});
+export {
+  assertPasskeyInParent,
+  getHeadlessAuthenticationMethods,
+  getHeadlessEthereumMethods,
+  getHeadlessGeneralMethods,
+  getHeadlessSolanaMethods
+};