@moon-x/core 0.2.0

package/dist/types/index.js

@@ -0,0 +1,64 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/types/index.ts
+var types_exports = {};
+__export(types_exports, {
+  Network: () => Network,
+  WALLET_ERROR_CODES: () => WALLET_ERROR_CODES,
+  WalletCreationError: () => WalletCreationError
+});
+module.exports = __toCommonJS(types_exports);
+
+// src/types/wallet.ts
+var WALLET_ERROR_CODES = {
+  WALLET_NOT_CONNECTED: "WALLET_NOT_CONNECTED",
+  USER_REJECTED: "USER_REJECTED",
+  INVALID_MESSAGE: "INVALID_MESSAGE",
+  INVALID_TRANSACTION: "INVALID_TRANSACTION",
+  NETWORK_ERROR: "NETWORK_ERROR",
+  UNKNOWN_ERROR: "UNKNOWN_ERROR"
+};
+
+// src/types/index.ts
+var WalletCreationError = /* @__PURE__ */ ((WalletCreationError2) => {
+  WalletCreationError2["SESSION_INVALID"] = "Session is invalid - cannot create wallet";
+  WalletCreationError2["FAILED_TO_CREATE_WALLET"] = "Failed to create wallet";
+  return WalletCreationError2;
+})(WalletCreationError || {});
+var Network = /* @__PURE__ */ ((Network2) => {
+  Network2["Bitcoin"] = "bitcoin";
+  Network2["Solana"] = "solana";
+  Network2["Ripple"] = "ripple";
+  Network2["Ethereum"] = "ethereum";
+  Network2["Polygon"] = "polygon";
+  Network2["Arbitrum"] = "arbitrum";
+  Network2["Optimism"] = "optimism";
+  Network2["Base"] = "base";
+  Network2["ZkSync"] = "zksync";
+  Network2["BinanceSmartChain"] = "bsc";
+  Network2["Tron"] = "tron";
+  return Network2;
+})(Network || {});
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  Network,
+  WALLET_ERROR_CODES,
+  WalletCreationError
+});

package/dist/types/index.mjs

@@ -0,0 +1,10 @@
+import {
+  Network,
+  WALLET_ERROR_CODES,
+  WalletCreationError
+} from "../chunk-IMLBIIJ4.mjs";
+export {
+  Network,
+  WALLET_ERROR_CODES,
+  WalletCreationError
+};

package/dist/utils/index.d.mts

@@ -0,0 +1,11 @@
+export { F as FORWARDED_ERROR_FIELDS, P as PostMessageClient, a as PostMessageMethod, b as PostMessageServer, c as PostMessageType } from '../post-message-C_99BCBh.mjs';
+
+/**
+ * Get the appropriate MoonKey API URL based on environment configuration
+ */
+declare const getMoonKeyApiUrl: () => string;
+
+declare const getIframeUrl: (path?: string) => string;
+declare const getIframeOrigin: (url: string) => string;
+
+export { getIframeOrigin, getIframeUrl, getMoonKeyApiUrl };

package/dist/utils/index.d.ts

@@ -0,0 +1,11 @@
+export { F as FORWARDED_ERROR_FIELDS, P as PostMessageClient, a as PostMessageMethod, b as PostMessageServer, c as PostMessageType } from '../post-message-C_99BCBh.js';
+
+/**
+ * Get the appropriate MoonKey API URL based on environment configuration
+ */
+declare const getMoonKeyApiUrl: () => string;
+
+declare const getIframeUrl: (path?: string) => string;
+declare const getIframeOrigin: (url: string) => string;
+
+export { getIframeOrigin, getIframeUrl, getMoonKeyApiUrl };

package/dist/utils/index.js

@@ -0,0 +1,365 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/utils/index.ts
+var utils_exports = {};
+__export(utils_exports, {
+  FORWARDED_ERROR_FIELDS: () => FORWARDED_ERROR_FIELDS,
+  PostMessageClient: () => PostMessageClient,
+  PostMessageMethod: () => PostMessageMethod,
+  PostMessageServer: () => PostMessageServer,
+  PostMessageType: () => PostMessageType,
+  getIframeOrigin: () => getIframeOrigin,
+  getIframeUrl: () => getIframeUrl,
+  getMoonKeyApiUrl: () => getMoonKeyApiUrl
+});
+module.exports = __toCommonJS(utils_exports);
+
+// src/utils/get-api-url.ts
+var getMoonKeyApiUrl = () => {
+  if (process.env?.NEXT_PUBLIC_MOONKEY_API_URL) {
+    return process.env.NEXT_PUBLIC_MOONKEY_API_URL;
+  }
+  if (process.env?.NEXT_PUBLIC_MOONKEY_IFRAME_URL) {
+    const iframeUrl = process.env.NEXT_PUBLIC_MOONKEY_IFRAME_URL;
+    if (iframeUrl.includes("staging") || iframeUrl.includes("auth-staging")) {
+      return "https://api.moonx-dev.com";
+    }
+  }
+  if (process.env?.NEXT_PUBLIC_VERCEL_ENV === "preview") {
+    return "https://api.moonx-dev.com";
+  }
+  return "https://api.moonx-dev.com";
+};
+
+// src/utils/get-iframe-url.ts
+var DEFAULT_IFRAME_PROJECT_NAME = "moonx-wallet-iframe";
+var joinUrl = (baseUrl, path) => {
+  if (!path) return baseUrl;
+  const normalizedBase = baseUrl.replace(/\/$/, "");
+  const normalizedPath = path.startsWith("/") ? path : `/${path}`;
+  return `${normalizedBase}${normalizedPath}`;
+};
+var withBypass = (url) => {
+  const bypass = process.env.NEXT_PUBLIC_VERCEL_PROTECTION_BYPASS;
+  if (!bypass) return url;
+  const separator = url.includes("?") ? "&" : "?";
+  return `${url}${separator}x-vercel-protection-bypass=${bypass}&x-vercel-set-bypass-cookie=samesitenone`;
+};
+var getIframeUrl = (path = "") => {
+  if (process.env.NEXT_PUBLIC_VERCEL_ENV === "preview" && process.env.NEXT_PUBLIC_VERCEL_BRANCH_URL) {
+    const vercelUrl = process.env.NEXT_PUBLIC_VERCEL_BRANCH_URL.replace(
+      /^https?:\/\//,
+      ""
+    ).replace(/\/$/, "");
+    const iframeProjectName = process.env.NEXT_PUBLIC_MOONKEY_IFRAME_PROJECT_NAME || DEFAULT_IFRAME_PROJECT_NAME;
+    const iframeUrl = /-git-/.test(vercelUrl) ? vercelUrl.replace(/^[^.]+?-git-/, `${iframeProjectName}-git-`) : (
+      // Fallback: legacy `{prefix}-{hash}.vercel.app` style
+      vercelUrl.replace(/^[^-]+-/, `${iframeProjectName}-`)
+    );
+    return withBypass(joinUrl(`https://${iframeUrl}`, path));
+  }
+  if (process.env.NEXT_PUBLIC_MOONKEY_IFRAME_URL) {
+    return joinUrl(process.env.NEXT_PUBLIC_MOONKEY_IFRAME_URL, path);
+  }
+  return joinUrl("https://iframe.moonx-dev.com", path);
+};
+var getIframeOrigin = (url) => {
+  try {
+    const urlObj = new URL(url);
+    return urlObj.origin;
+  } catch (error) {
+    console.error("Invalid URL:", url);
+    return "";
+  }
+};
+
+// src/utils/post-message.ts
+var FORWARDED_ERROR_FIELDS = [
+  "error_type",
+  "error_code",
+  "status_code"
+];
+var generateUUID = () => {
+  if (typeof crypto !== "undefined" && crypto.randomUUID) {
+    return crypto.randomUUID();
+  }
+  return "xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx".replace(/[xy]/g, (c) => {
+    const r = Math.random() * 16 | 0;
+    const v = c === "x" ? r : r & 3 | 8;
+    return v.toString(16);
+  });
+};
+var PostMessageType = {
+  AUTH: "auth",
+  INIT: "init",
+  WALLET: "wallet",
+  EXTERNAL_WALLET: "external_wallet"
+};
+var PostMessageMethod = {
+  CLOSE: "CLOSE",
+  CREATE_WALLET: "CREATE_WALLET",
+  IMPORT_KEY: "IMPORT_KEY",
+  FUND_WALLET: "FUND_WALLET",
+  GET_APP_CONFIG: "GET_APP_CONFIG",
+  GET_BALANCE: "GET_BALANCE",
+  GET_CONFIRM_TRANSACTION: "GET_CONFIRM_TRANSACTION",
+  GET_CONFIRM_ETHEREUM_TRANSACTION: "GET_CONFIRM_ETHEREUM_TRANSACTION",
+  GET_CURRENT_SESSION: "GET_CURRENT_SESSION",
+  GET_TOKEN_ACCOUNTS_BY_OWNER: "GET_TOKEN_ACCOUNTS_BY_OWNER",
+  GET_USER: "GET_USER",
+  GET_WALLET: "GET_WALLET",
+  GET_WALLETS: "GET_WALLETS",
+  IS_AUTHENTICATED: "IS_AUTHENTICATED",
+  LOGIN_CREATE: "LOGIN_CREATE",
+  LOGOUT: "LOGOUT",
+  PREFETCH_CAPTCHA: "PREFETCH_CAPTCHA",
+  READY: "READY",
+  SEND_TRANSACTION: "SEND_TRANSACTION",
+  SIGN_MESSAGE: "SIGN_MESSAGE",
+  SIGN_TRANSACTION: "SIGN_TRANSACTION",
+  SIGN_TYPED_DATA: "SIGN_TYPED_DATA",
+  // Sign a pre-computed 32-byte digest as ECDSA. Caller-supplied hash
+  // — no EIP-191 prefix, no tx parsing, no domain separator. Useful
+  // for ZK circuits / custom auth flows / anywhere the digest is
+  // computed externally. Mirrors Privy's `secp256k1_sign` provider
+  // method but exposed as its own postMessage to keep the iframe
+  // dispatcher boring.
+  SIGN_HASH: "SIGN_HASH",
+  SIGN_7702_AUTHORIZATION: "SIGN_7702_AUTHORIZATION",
+  VERIFY_EMAIL_OTP: "VERIFY_EMAIL_OTP",
+  VERIFY_OAUTH: "VERIFY_OAUTH",
+  START_OAUTH: "START_OAUTH",
+  WALLET_REGISTRATION_NONCE: "WALLET_REGISTRATION_NONCE",
+  VERIFY_SIWE_WALLET_REGISTRATION: "VERIFY_SIWE_WALLET_REGISTRATION",
+  ATTACH_OAUTH: "ATTACH_OAUTH",
+  DETACH_OAUTH: "DETACH_OAUTH",
+  // Passkey as a post-identity enrollment / unlock ceremony. The two
+  // methods below split the ceremony so the parent owns the WebAuthn
+  // API call (where user activation lives) and the iframe owns the
+  // begin/verify HTTP calls (where the session JWT lives).
+  PASSKEY_REGISTER_BEGIN: "PASSKEY_REGISTER_BEGIN",
+  PASSKEY_REGISTER_VERIFY: "PASSKEY_REGISTER_VERIFY",
+  GET_PASSKEY_STATUS: "GET_PASSKEY_STATUS",
+  // Parent-side passkey assertion plumbing. Parent calls GET_DEK_INFO
+  // to learn which credential IDs to put in allowCredentials and to
+  // know whether bootstrap-vs-unwrap path applies, then runs
+  // navigator.credentials.get itself (where iframe-cross-origin
+  // activation rules don't bite). Wallet-op postMessages then carry
+  // the resulting user_handle_b64url + credential_id_b64url back into
+  // the iframe so encrypted-keyshare helpers can unwrap the DEK.
+  GET_DEK_INFO: "GET_DEK_INFO",
+  // Multi-passkey management on an existing user. ADD_PASSKEY_WRAP is
+  // the iframe half of the parent-driven add-passkey flow: parent runs
+  // both WebAuthn ceremonies (assert old credential, register new
+  // credential), then posts the two resulting (userHandle, credId)
+  // pairs here so the iframe can unlock the DEK with the old
+  // credential and seal a new wrap with the new credential.
+  ADD_PASSKEY_WRAP: "ADD_PASSKEY_WRAP",
+  REMOVE_PASSKEY: "REMOVE_PASSKEY"
+};
+var PostMessageClient = class {
+  constructor(target, origin = "*") {
+    this.target = target;
+    this.origin = origin;
+  }
+  async send(type, method, payload) {
+    const id = generateUUID();
+    return new Promise((resolve, reject) => {
+      const timeout = setTimeout(() => {
+        window.removeEventListener("message", handler);
+        reject(new Error("Timeout: No response from iframe"));
+      }, 3e4);
+      const handler = (event) => {
+        if (this.origin !== "*" && event.origin !== this.origin) {
+          return;
+        }
+        const response = event.data;
+        if (response.id === id) {
+          clearTimeout(timeout);
+          window.removeEventListener("message", handler);
+          if (response.success) {
+            resolve(response.data);
+          } else {
+            const err = new Error(response.error);
+            for (const key of FORWARDED_ERROR_FIELDS) {
+              const value = response[key];
+              if (value !== void 0) {
+                err[key] = value;
+              }
+            }
+            reject(err);
+          }
+        }
+      };
+      window.addEventListener("message", handler);
+      this.target.postMessage(
+        {
+          id,
+          type,
+          method,
+          payload
+        },
+        this.origin
+      );
+    });
+  }
+  async sendOneWay(type, method, payload) {
+    const id = generateUUID();
+    const envelope = {
+      id,
+      type,
+      method,
+      payload
+    };
+    if (typeof window !== "undefined" && typeof window.ReactNativeWebView !== "undefined") {
+      try {
+        window.ReactNativeWebView.postMessage(JSON.stringify(envelope));
+      } catch {
+      }
+      return;
+    }
+    this.target.postMessage(envelope, this.origin);
+  }
+};
+var isReactNativeWebView = () => typeof window !== "undefined" && typeof window.ReactNativeWebView !== "undefined";
+var sendReactNativeReply = (response) => {
+  try {
+    window.ReactNativeWebView.postMessage(JSON.stringify(response));
+  } catch {
+  }
+};
+var PostMessageServer = class {
+  constructor(originValidator) {
+    this.trustedSources = /* @__PURE__ */ new Set();
+    this.handlers = /* @__PURE__ */ new Map();
+    this.originValidator = originValidator;
+    window.addEventListener("message", this.handleMessage.bind(this));
+  }
+  addTrustedSource(source) {
+    this.trustedSources.add(source);
+  }
+  removeTrustedSource(source) {
+    this.trustedSources.delete(source);
+  }
+  register(type, method, handler) {
+    const key = `${type}:${method}`;
+    this.handlers.set(key, handler);
+  }
+  cleanup() {
+    window.removeEventListener("message", this.handleMessage.bind(this));
+    this.handlers.clear();
+  }
+  static isLocalhostOrigin(origin) {
+    try {
+      const url = new URL(origin);
+      return url.hostname === "localhost" || url.hostname === "127.0.0.1" || url.hostname === "[::1]";
+    } catch {
+      return false;
+    }
+  }
+  isValidPostMessageRequest(data) {
+    return data && typeof data === "object" && typeof data.id === "string" && typeof data.type === "string" && typeof data.method === "string";
+  }
+  async handleMessage(event) {
+    if (!this.isValidPostMessageRequest(event.data)) {
+      return;
+    }
+    if (!event.origin || event.origin === "null") {
+      console.error("[PostMessageServer] Invalid or null origin received");
+      return;
+    }
+    const request = event.data;
+    const rnMode = isReactNativeWebView();
+    const reply = (response) => {
+      if (rnMode) {
+        sendReactNativeReply(response);
+        return;
+      }
+      if (event.source && event.origin) {
+        event.source.postMessage(response, { targetOrigin: event.origin });
+      }
+    };
+    if (this.originValidator && !rnMode) {
+      const publishableKey = request.payload?.publishableKey;
+      try {
+        const isAllowed = await this.originValidator(
+          event.origin,
+          publishableKey
+        );
+        if (!isAllowed) {
+          reply({
+            id: request.id,
+            type: request.type,
+            success: false,
+            error: `Origin ${event.origin} is not whitelisted. Please add it to your MoonKey dashboard.`
+          });
+          return;
+        }
+      } catch (error) {
+        reply({
+          id: request.id,
+          type: request.type,
+          success: false,
+          error: "Origin validation failed"
+        });
+        return;
+      }
+    }
+    const key = `${request.type}:${request.method}`;
+    const handler = this.handlers.get(key);
+    if (handler) {
+      try {
+        const data = await handler(request.payload);
+        reply({
+          id: request.id,
+          type: request.type,
+          success: true,
+          data
+        });
+      } catch (error) {
+        const extras = {};
+        if (error && typeof error === "object") {
+          for (const key2 of FORWARDED_ERROR_FIELDS) {
+            const value = error[key2];
+            if (value !== void 0) extras[key2] = value;
+          }
+        }
+        reply({
+          ...extras,
+          id: request.id,
+          type: request.type,
+          success: false,
+          error: error instanceof Error ? error.message : "Unknown error"
+        });
+      }
+    }
+  }
+};
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  FORWARDED_ERROR_FIELDS,
+  PostMessageClient,
+  PostMessageMethod,
+  PostMessageServer,
+  PostMessageType,
+  getIframeOrigin,
+  getIframeUrl,
+  getMoonKeyApiUrl
+});

package/dist/utils/index.mjs

@@ -0,0 +1,25 @@
+import "../chunk-CMYR6AOY.mjs";
+import {
+  getIframeOrigin,
+  getIframeUrl
+} from "../chunk-264CEGDS.mjs";
+import {
+  FORWARDED_ERROR_FIELDS,
+  PostMessageClient,
+  PostMessageMethod,
+  PostMessageServer,
+  PostMessageType
+} from "../chunk-SOKLPX7V.mjs";
+import {
+  getMoonKeyApiUrl
+} from "../chunk-GQKIA37O.mjs";
+export {
+  FORWARDED_ERROR_FIELDS,
+  PostMessageClient,
+  PostMessageMethod,
+  PostMessageServer,
+  PostMessageType,
+  getIframeOrigin,
+  getIframeUrl,
+  getMoonKeyApiUrl
+};

package/dist/web/index.d.mts

@@ -0,0 +1,20 @@
+import { P as PostMessageClient } from '../post-message-C_99BCBh.mjs';
+import { T as Transport, P as PasskeyAssertor, K as KvStorage } from '../interfaces-fNhwnCeY.mjs';
+
+declare const getCachedPostMessageClient: (contentWindow: Window) => PostMessageClient;
+/**
+ * Create a web Transport bound to an iframe's contentWindow. Pass a
+ * getter for the iframe ref so the Transport survives mounts/remounts
+ * (the iframe's contentWindow can change). `isReady` short-circuits
+ * the SDK methods before they try to send to a not-yet-mounted iframe.
+ */
+declare const createIframeTransport: ({ getContentWindow, isReady, }: {
+    getContentWindow: () => Window | null | undefined;
+    isReady: () => boolean;
+}) => Transport;
+
+declare const createWebAuthnPasskey: () => PasskeyAssertor;
+
+declare const createLocalStorageKv: (prefix?: string) => KvStorage;
+
+export { createIframeTransport, createLocalStorageKv, createWebAuthnPasskey, getCachedPostMessageClient };

package/dist/web/index.d.ts

@@ -0,0 +1,20 @@
+import { P as PostMessageClient } from '../post-message-C_99BCBh.js';
+import { T as Transport, P as PasskeyAssertor, K as KvStorage } from '../interfaces-9k0eKCc4.js';
+
+declare const getCachedPostMessageClient: (contentWindow: Window) => PostMessageClient;
+/**
+ * Create a web Transport bound to an iframe's contentWindow. Pass a
+ * getter for the iframe ref so the Transport survives mounts/remounts
+ * (the iframe's contentWindow can change). `isReady` short-circuits
+ * the SDK methods before they try to send to a not-yet-mounted iframe.
+ */
+declare const createIframeTransport: ({ getContentWindow, isReady, }: {
+    getContentWindow: () => Window | null | undefined;
+    isReady: () => boolean;
+}) => Transport;
+
+declare const createWebAuthnPasskey: () => PasskeyAssertor;
+
+declare const createLocalStorageKv: (prefix?: string) => KvStorage;
+
+export { createIframeTransport, createLocalStorageKv, createWebAuthnPasskey, getCachedPostMessageClient };