@moon-x/core 0.3.0 → 0.5.0

package/dist/sdk/index.mjs

@@ -1,20 +1,16 @@
 import {
   PostMessageMethod,
   PostMessageType
-} from "../chunk-VVL65GIB.mjs";
+} from "../chunk-JU5MWLXH.mjs";
 import {
   arrayLikeToBytes,
   authState,
   broadcastEthereumRaw,
   broadcastSolanaSigned,
   bs58ToBytes,
-  clearParentAssertCache,
-  readParentAssertCache,
   serializeEthereumTransaction,
-  toB64url,
-  withClearOnFailure,
-  writeParentAssertCache
-} from "../chunk-CDT4MC7S.mjs";
+  toB64url
+} from "../chunk-I56GRKAG.mjs";
 import "../chunk-GQKIA37O.mjs";
 
 // src/sdk/parent-passkey-assert.ts
@@ -22,13 +18,8 @@ var assertPasskeyInParent = async ({
   transport,
   passkey,
   publishableKey,
-  requireFreshAssertion = false,
   validateCredentialInAllowList = false
 }) => {
-  if (!requireFreshAssertion) {
-    const cached = readParentAssertCache();
-    if (cached) return cached;
-  }
   const dekInfo = await transport.send(
     PostMessageType.AUTH,
     PostMessageMethod.GET_DEK_INFO,
@@ -52,12 +43,10 @@ var assertPasskeyInParent = async ({
   if (validateCredentialInAllowList && !allowList.includes(credential.rawIdB64url)) {
     throw new Error("unknown_passkey_for_this_account");
   }
-  const result = {
+  return {
     userHandleB64url: credential.userHandleB64url,
     credentialIdB64url: credential.rawIdB64url
   };
-  writeParentAssertCache(result);
-  return result;
 };
 
 // src/sdk/get-presence-token.ts
@@ -89,19 +78,79 @@ var getPresenceToken = async ({
   };
 };
 
+// src/sdk/get-internal-presence-tokens.ts
+var getInternalPresenceTokens = async ({
+  transport,
+  passkey,
+  publishableKey,
+  relyingPartyOrigin,
+  scopes,
+  scopeCounts
+}) => {
+  const { token, optionsJSON } = await transport.send(
+    PostMessageType.AUTH,
+    PostMessageMethod.PASSKEY_PRESENCE_BEGIN,
+    { publishableKey, relyingPartyOrigin }
+  );
+  const { response, userHandleB64url, credentialIdB64url } = await passkey.assertForInternalPresence({ optionsJSON });
+  const verifyPayload = {
+    publishableKey,
+    relyingPartyOrigin,
+    token,
+    response,
+    purpose: "internal"
+  };
+  if (scopes && scopes.length > 0) verifyPayload.scopes = scopes;
+  if (scopeCounts && Object.keys(scopeCounts).length > 0) {
+    verifyPayload.scope_counts = scopeCounts;
+  }
+  const verify = await transport.send(
+    PostMessageType.AUTH,
+    PostMessageMethod.PASSKEY_PRESENCE_VERIFY,
+    verifyPayload
+  );
+  const out = {};
+  for (const [scope, t] of Object.entries(verify.tokens ?? {})) {
+    out[scope] = { token: t.token, expiresAt: t.expires_at };
+  }
+  const outBatches = {};
+  for (const [scope, batch] of Object.entries(verify.token_batches ?? {})) {
+    outBatches[scope] = batch.map((t) => ({
+      token: t.token,
+      expiresAt: t.expires_at
+    }));
+  }
+  return {
+    tokens: out,
+    tokenBatches: outBatches,
+    userHandleB64url,
+    credentialIdB64url
+  };
+};
+var flattenPresenceTokens = (result) => {
+  const out = {};
+  for (const [scope, t] of Object.entries(result.tokens)) {
+    out[scope] = t.token;
+  }
+  return out;
+};
+
 // src/sdk/headless-ethereum.ts
+var SCOPES_SIGN = ["keyshare_read", "sign"];
 var getHeadlessEthereumMethods = ({
   transport,
   passkey,
-  publishableKey
+  publishableKey,
+  relyingPartyOrigin
 }) => ({
-  signEthereumMessageHeadless: async (params) => withClearOnFailure(async () => {
+  signEthereumMessageHeadless: async (params) => {
     if (!transport.isReady()) throw new Error("SDK not ready");
-    const { userHandleB64url, credentialIdB64url } = await assertPasskeyInParent({
+    const { userHandleB64url, credentialIdB64url, tokens } = await getInternalPresenceTokens({
       transport,
       passkey,
       publishableKey,
-      requireFreshAssertion: params.requireFreshAssertion
+      relyingPartyOrigin,
+      scopes: SCOPES_SIGN
     });
     return transport.send(
       PostMessageType.WALLET,
@@ -112,17 +161,23 @@ var getHeadlessEthereumMethods = ({
         wallet: params.wallet,
         uiOptions: params.options?.uiOptions,
         userHandleB64url,
-        credentialIdB64url
+        credentialIdB64url,
+        presenceTokens: flattenPresenceTokens({
+          tokens,
+          userHandleB64url,
+          credentialIdB64url
+        })
       }
     );
-  }),
-  signEthereumTransactionHeadless: async (params) => withClearOnFailure(async () => {
+  },
+  signEthereumTransactionHeadless: async (params) => {
     if (!transport.isReady()) throw new Error("SDK not ready");
-    const { userHandleB64url, credentialIdB64url } = await assertPasskeyInParent({
+    const { userHandleB64url, credentialIdB64url, tokens } = await getInternalPresenceTokens({
       transport,
       passkey,
       publishableKey,
-      requireFreshAssertion: params.requireFreshAssertion
+      relyingPartyOrigin,
+      scopes: SCOPES_SIGN
     });
     return transport.send(
       PostMessageType.WALLET,
@@ -134,17 +189,23 @@ var getHeadlessEthereumMethods = ({
         wallet: params.wallet,
         options: params.options,
         userHandleB64url,
-        credentialIdB64url
+        credentialIdB64url,
+        presenceTokens: flattenPresenceTokens({
+          tokens,
+          userHandleB64url,
+          credentialIdB64url
+        })
       }
     );
-  }),
-  signEthereumTypedDataHeadless: async (params) => withClearOnFailure(async () => {
+  },
+  signEthereumTypedDataHeadless: async (params) => {
     if (!transport.isReady()) throw new Error("SDK not ready");
-    const { userHandleB64url, credentialIdB64url } = await assertPasskeyInParent({
+    const { userHandleB64url, credentialIdB64url, tokens } = await getInternalPresenceTokens({
       transport,
       passkey,
       publishableKey,
-      requireFreshAssertion: params.requireFreshAssertion
+      relyingPartyOrigin,
+      scopes: SCOPES_SIGN
     });
     return transport.send(
       PostMessageType.WALLET,
@@ -158,17 +219,23 @@ var getHeadlessEthereumMethods = ({
         wallet: params.wallet,
         options: params.options,
         userHandleB64url,
-        credentialIdB64url
+        credentialIdB64url,
+        presenceTokens: flattenPresenceTokens({
+          tokens,
+          userHandleB64url,
+          credentialIdB64url
+        })
       }
     );
-  }),
-  signEthereumHashHeadless: async (params) => withClearOnFailure(async () => {
+  },
+  signEthereumHashHeadless: async (params) => {
     if (!transport.isReady()) throw new Error("SDK not ready");
-    const { userHandleB64url, credentialIdB64url } = await assertPasskeyInParent({
+    const { userHandleB64url, credentialIdB64url, tokens } = await getInternalPresenceTokens({
       transport,
       passkey,
       publishableKey,
-      requireFreshAssertion: params.requireFreshAssertion
+      relyingPartyOrigin,
+      scopes: SCOPES_SIGN
     });
     return transport.send(
       PostMessageType.WALLET,
@@ -179,17 +246,23 @@ var getHeadlessEthereumMethods = ({
         wallet: params.wallet,
         options: params.options,
         userHandleB64url,
-        credentialIdB64url
+        credentialIdB64url,
+        presenceTokens: flattenPresenceTokens({
+          tokens,
+          userHandleB64url,
+          credentialIdB64url
+        })
       }
     );
-  }),
-  signEthereum7702AuthorizationHeadless: async (params) => withClearOnFailure(async () => {
+  },
+  signEthereum7702AuthorizationHeadless: async (params) => {
     if (!transport.isReady()) throw new Error("SDK not ready");
-    const { userHandleB64url, credentialIdB64url } = await assertPasskeyInParent({
+    const { userHandleB64url, credentialIdB64url, tokens } = await getInternalPresenceTokens({
       transport,
       passkey,
       publishableKey,
-      requireFreshAssertion: params.requireFreshAssertion
+      relyingPartyOrigin,
+      scopes: SCOPES_SIGN
     });
     return transport.send(
       PostMessageType.WALLET,
@@ -203,17 +276,23 @@ var getHeadlessEthereumMethods = ({
         wallet: params.wallet,
         options: params.options,
         userHandleB64url,
-        credentialIdB64url
+        credentialIdB64url,
+        presenceTokens: flattenPresenceTokens({
+          tokens,
+          userHandleB64url,
+          credentialIdB64url
+        })
       }
     );
-  }),
-  sendEthereumTransactionHeadless: async (params) => withClearOnFailure(async () => {
+  },
+  sendEthereumTransactionHeadless: async (params) => {
     if (!transport.isReady()) throw new Error("SDK not ready");
-    const { userHandleB64url, credentialIdB64url } = await assertPasskeyInParent({
+    const { userHandleB64url, credentialIdB64url, tokens } = await getInternalPresenceTokens({
       transport,
       passkey,
       publishableKey,
-      requireFreshAssertion: params.requireFreshAssertion
+      relyingPartyOrigin,
+      scopes: SCOPES_SIGN
     });
     const serializedTransaction = await serializeEthereumTransaction(
       params.transaction
@@ -227,7 +306,12 @@ var getHeadlessEthereumMethods = ({
         wallet: params.wallet,
         options: params.options,
         userHandleB64url,
-        credentialIdB64url
+        credentialIdB64url,
+        presenceTokens: flattenPresenceTokens({
+          tokens,
+          userHandleB64url,
+          credentialIdB64url
+        })
       }
     );
     if (!signed.serializedSigned) {
@@ -240,7 +324,7 @@ var getHeadlessEthereumMethods = ({
       signed.serializedSigned
     );
     return { hash };
-  }),
+  },
   getEthereumBalance: async (params) => {
     if (!transport.isReady()) throw new Error("SDK not ready");
     return transport.send(
@@ -276,18 +360,21 @@ var getHeadlessEthereumMethods = ({
 });
 
 // src/sdk/headless-solana.ts
+var SCOPES_SIGN2 = ["keyshare_read", "sign"];
 var getHeadlessSolanaMethods = ({
   transport,
   passkey,
-  publishableKey
+  publishableKey,
+  relyingPartyOrigin
 }) => ({
-  signSolanaMessageHeadless: async (params) => withClearOnFailure(async () => {
+  signSolanaMessageHeadless: async (params) => {
     if (!transport.isReady()) throw new Error("SDK not ready");
-    const { userHandleB64url, credentialIdB64url } = await assertPasskeyInParent({
+    const { userHandleB64url, credentialIdB64url, tokens } = await getInternalPresenceTokens({
       transport,
       passkey,
       publishableKey,
-      requireFreshAssertion: params.requireFreshAssertion
+      relyingPartyOrigin,
+      scopes: SCOPES_SIGN2
     });
     const { signature } = await transport.send(
       PostMessageType.WALLET,
@@ -298,18 +385,24 @@ var getHeadlessSolanaMethods = ({
         wallet: params.wallet,
         uiOptions: params.options?.uiOptions,
         userHandleB64url,
-        credentialIdB64url
+        credentialIdB64url,
+        presenceTokens: flattenPresenceTokens({
+          tokens,
+          userHandleB64url,
+          credentialIdB64url
+        })
       }
     );
     return { signature: arrayLikeToBytes(signature) };
-  }),
-  signSolanaTransactionHeadless: async (params) => withClearOnFailure(async () => {
+  },
+  signSolanaTransactionHeadless: async (params) => {
     if (!transport.isReady()) throw new Error("SDK not ready");
-    const { userHandleB64url, credentialIdB64url } = await assertPasskeyInParent({
+    const { userHandleB64url, credentialIdB64url, tokens } = await getInternalPresenceTokens({
       transport,
       passkey,
       publishableKey,
-      requireFreshAssertion: params.requireFreshAssertion
+      relyingPartyOrigin,
+      scopes: SCOPES_SIGN2
     });
     const { signedTransaction } = await transport.send(
       PostMessageType.WALLET,
@@ -320,18 +413,24 @@ var getHeadlessSolanaMethods = ({
         wallet: params.wallet,
         options: params.options,
         userHandleB64url,
-        credentialIdB64url
+        credentialIdB64url,
+        presenceTokens: flattenPresenceTokens({
+          tokens,
+          userHandleB64url,
+          credentialIdB64url
+        })
       }
     );
     return { signedTransaction: await bs58ToBytes(signedTransaction) };
-  }),
-  sendSolanaTransactionHeadless: async (params) => withClearOnFailure(async () => {
+  },
+  sendSolanaTransactionHeadless: async (params) => {
     if (!transport.isReady()) throw new Error("SDK not ready");
-    const { userHandleB64url, credentialIdB64url } = await assertPasskeyInParent({
+    const { userHandleB64url, credentialIdB64url, tokens } = await getInternalPresenceTokens({
       transport,
       passkey,
       publishableKey,
-      requireFreshAssertion: params.requireFreshAssertion
+      relyingPartyOrigin,
+      scopes: SCOPES_SIGN2
     });
     const { signedTransaction } = await transport.send(
       PostMessageType.WALLET,
@@ -342,7 +441,12 @@ var getHeadlessSolanaMethods = ({
         wallet: params.wallet,
         options: params.options,
         userHandleB64url,
-        credentialIdB64url
+        credentialIdB64url,
+        presenceTokens: flattenPresenceTokens({
+          tokens,
+          userHandleB64url,
+          credentialIdB64url
+        })
       }
     );
     const broadcastSignature = await broadcastSolanaSigned(
@@ -350,7 +454,7 @@ var getHeadlessSolanaMethods = ({
       signedTransaction
     );
     return { signature: await bs58ToBytes(broadcastSignature) };
-  }),
+  },
   getSolanaBalance: async (params) => {
     if (!transport.isReady()) throw new Error("SDK not ready");
     return transport.send(
@@ -462,11 +566,17 @@ var getHeadlessAuthenticationMethods = ({
 });
 
 // src/sdk/headless-general.ts
+var SCOPES_CREATE_WALLET = ["dek_bootstrap", "keyshare_write"];
+var SCOPES_IMPORT_KEY = ["dek_bootstrap", "keyshare_write"];
+var SCOPES_REMOVE_PASSKEY = ["passkey_remove"];
+var SCOPES_PROVISION_EPHEMERAL_SIGNER = ["keyshare_read"];
+var SCOPES_REVOKE_EPHEMERAL_SIGNER = ["ephemeral_signer_revoke"];
 var getHeadlessGeneralMethods = ({
   transport,
   passkey,
   storage,
   publishableKey,
+  relyingPartyOrigin,
   setIsAuthenticated,
   setUser
 }) => ({
@@ -476,18 +586,38 @@ var getHeadlessGeneralMethods = ({
     { publishableKey }
   ),
   removePasskey: async (credentialIdB64url) => {
+    const {
+      tokens,
+      userHandleB64url,
+      credentialIdB64url: assertedCredId
+    } = await getInternalPresenceTokens({
+      transport,
+      passkey,
+      publishableKey,
+      relyingPartyOrigin,
+      scopes: SCOPES_REMOVE_PASSKEY
+    });
     await transport.send(
       PostMessageType.AUTH,
       PostMessageMethod.REMOVE_PASSKEY,
-      { publishableKey, credentialIdB64url }
+      {
+        publishableKey,
+        credentialIdB64url,
+        presenceTokens: flattenPresenceTokens({
+          tokens,
+          userHandleB64url,
+          credentialIdB64url: assertedCredId
+        })
+      }
     );
   },
-  createWallet: (walletType, options) => withClearOnFailure(async () => {
-    const { userHandleB64url, credentialIdB64url } = await assertPasskeyInParent({
+  createWallet: async (walletType, options) => {
+    const { userHandleB64url, credentialIdB64url, tokens } = await getInternalPresenceTokens({
       transport,
       passkey,
       publishableKey,
-      requireFreshAssertion: options?.requireFreshAssertion
+      relyingPartyOrigin,
+      scopes: SCOPES_CREATE_WALLET
     });
     const wallet = await transport.send(
       PostMessageType.WALLET,
@@ -497,17 +627,23 @@ var getHeadlessGeneralMethods = ({
         publishableKey,
         options,
         userHandleB64url,
-        credentialIdB64url
+        credentialIdB64url,
+        presenceTokens: flattenPresenceTokens({
+          tokens,
+          userHandleB64url,
+          credentialIdB64url
+        })
       }
     );
     return { wallet };
-  }),
-  importKey: (walletType, key, options) => withClearOnFailure(async () => {
-    const { userHandleB64url, credentialIdB64url } = await assertPasskeyInParent({
+  },
+  importKey: async (walletType, key) => {
+    const { userHandleB64url, credentialIdB64url, tokens } = await getInternalPresenceTokens({
       transport,
       passkey,
       publishableKey,
-      requireFreshAssertion: options?.requireFreshAssertion
+      relyingPartyOrigin,
+      scopes: SCOPES_IMPORT_KEY
     });
     const wallet = await transport.send(
       PostMessageType.WALLET,
@@ -517,11 +653,93 @@ var getHeadlessGeneralMethods = ({
         publishableKey,
         key,
         userHandleB64url,
-        credentialIdB64url
+        credentialIdB64url,
+        presenceTokens: flattenPresenceTokens({
+          tokens,
+          userHandleB64url,
+          credentialIdB64url
+        })
       }
     );
     return { wallet };
-  }),
+  },
+  provisionEphemeralSigner: async (params) => {
+    const walletCount = params.walletIds.length;
+    if (walletCount === 0) {
+      throw new Error(
+        "provisionEphemeralSigner: at least one walletId required"
+      );
+    }
+    const { userHandleB64url, credentialIdB64url, tokenBatches } = await getInternalPresenceTokens({
+      transport,
+      passkey,
+      publishableKey,
+      relyingPartyOrigin,
+      scopeCounts: { [SCOPES_PROVISION_EPHEMERAL_SIGNER[0]]: walletCount }
+    });
+    const keyshareReadBatch = (tokenBatches[SCOPES_PROVISION_EPHEMERAL_SIGNER[0]] ?? []).map((t) => t.token);
+    if (keyshareReadBatch.length !== walletCount) {
+      throw new Error(
+        `provisionEphemeralSigner: server returned ${keyshareReadBatch.length} tokens, expected ${walletCount}`
+      );
+    }
+    return transport.send(
+      PostMessageType.WALLET,
+      PostMessageMethod.PROVISION_EPHEMERAL_SIGNER,
+      {
+        publishableKey,
+        userHandleB64url,
+        credentialIdB64url,
+        // One keyshare_read token per wallet, parallel to params.walletIds
+        // (iframe consumes them positionally after wallet resolution).
+        presenceTokenBatches: {
+          [SCOPES_PROVISION_EPHEMERAL_SIGNER[0]]: keyshareReadBatch
+        },
+        walletIds: params.walletIds,
+        expiresAt: params.expiresAt?.toISOString(),
+        label: params.label
+      }
+    );
+  },
+  // Read-only: list the user's active (non-revoked) provisioned agents
+  // for the current app. No WebAuthn ceremony needed — the wallet
+  // session JWT is enough since this exposes only metadata (api_pub,
+  // key_ids, expiry) and not the private agent material.
+  listEphemeralSigners: async () => {
+    return transport.send(
+      PostMessageType.WALLET,
+      PostMessageMethod.LIST_EPHEMERAL_SIGNERS,
+      { publishableKey }
+    );
+  },
+  // Soft-revoke a signer (and forward the revoke to SES). Requires a
+  // fresh WebAuthn-bound presence token: ephemeral_signer_revoke scope. Wallet JWT
+  // alone isn't enough because revoke is destructive (DoS-grade) — the
+  // presence proof confirms it's really the user driving it.
+  revokeEphemeralSigner: async (params) => {
+    const { userHandleB64url, credentialIdB64url, tokens } = await getInternalPresenceTokens({
+      transport,
+      passkey,
+      publishableKey,
+      relyingPartyOrigin,
+      scopes: SCOPES_REVOKE_EPHEMERAL_SIGNER
+    });
+    await transport.send(
+      PostMessageType.WALLET,
+      PostMessageMethod.REVOKE_EPHEMERAL_SIGNER,
+      {
+        publishableKey,
+        apiPubHex: params.apiPubHex,
+        userHandleB64url,
+        credentialIdB64url,
+        presenceTokens: flattenPresenceTokens({
+          tokens,
+          userHandleB64url,
+          credentialIdB64url
+        })
+      }
+    );
+  },
   getWallets: async (walletType) => {
     const { wallets } = await transport.send(
       PostMessageType.WALLET,
@@ -538,11 +756,9 @@ var getHeadlessGeneralMethods = ({
   // silently extend session lifetime.
   getSessionTokens: async () => {
     try {
-      const session = await transport.send(
-        PostMessageType.AUTH,
-        PostMessageMethod.GET_CURRENT_SESSION,
-        { publishableKey }
-      );
+      const session = await transport.send(PostMessageType.AUTH, PostMessageMethod.GET_CURRENT_SESSION, {
+        publishableKey
+      });
       return session ? {
         accessToken: session.accessToken,
         identityToken: session.identityToken,
@@ -561,7 +777,6 @@ var getHeadlessGeneralMethods = ({
       await transport.send(PostMessageType.AUTH, PostMessageMethod.LOGOUT, {
         publishableKey
       });
-      clearParentAssertCache();
       await storage.remove("id_token");
       if (setIsAuthenticated) setIsAuthenticated(false);
       if (setUser) setUser(null);
@@ -607,11 +822,156 @@ var getHeadlessGeneralMethods = ({
     }
   }
 });
+
+// src/sdk/ephemeral-signer-sign.ts
+import { ed25519 } from "@noble/curves/ed25519";
+import { bytesToHex, hexToBytes } from "@noble/hashes/utils";
+function normalizeBase(url) {
+  return url.replace(/\/+$/, "");
+}
+var EphemeralSignerSignError = class extends Error {
+  constructor(message, status, body) {
+    super(message);
+    this.status = status;
+    this.body = body;
+    this.name = "EphemeralSignerSignError";
+  }
+};
+var bindingsCache = /* @__PURE__ */ new Map();
+async function resolveBinding(input) {
+  const cached = bindingsCache.get(input.apiPubHex);
+  if (cached) {
+    const hit2 = cached.find((b) => b.walletId === input.walletId);
+    if (hit2) return hit2;
+  }
+  const issuedAt = (/* @__PURE__ */ new Date()).toISOString();
+  const signedBodyBytes = new TextEncoder().encode(
+    JSON.stringify({ issued_at: issuedAt })
+  );
+  const apiPrivBytes = hexToBytes(input.apiPrivHex);
+  const agentSig = ed25519.sign(signedBodyBytes, apiPrivBytes);
+  const url = `${normalizeBase(input.baseUrl)}/v0/wallets/ephemeral-signers/me/wallets`;
+  const fetchFn = input.fetchImpl ?? fetch;
+  let response;
+  try {
+    response = await fetchFn(url, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        Authorization: `PublicToken ${input.publishableKey}`
+      },
+      body: JSON.stringify({
+        api_pub: input.apiPubHex,
+        signed_body: bytesToHex(signedBodyBytes),
+        agent_signature: bytesToHex(agentSig)
+      })
+    });
+  } catch (e) {
+    throw new EphemeralSignerSignError(
+      `wallet binding fetch failed: ${e instanceof Error ? e.message : String(e)}`
+    );
+  }
+  if (!response.ok) {
+    const body = await response.text().catch(() => "");
+    throw new EphemeralSignerSignError(
+      `wallet binding fetch failed: ${response.status}`,
+      response.status,
+      body
+    );
+  }
+  const json = await response.json();
+  const bindings = json.wallets.map((w) => ({
+    walletId: w.wallet_id,
+    keyId: w.key_id,
+    derivationPath: w.derivation_path
+  }));
+  bindingsCache.set(input.apiPubHex, bindings);
+  const hit = bindings.find((b) => b.walletId === input.walletId);
+  if (!hit) {
+    throw new EphemeralSignerSignError(
+      `walletId ${input.walletId} is not authorized for this agent`
+    );
+  }
+  return hit;
+}
+async function signWithEphemeralSigner(input) {
+  if (!/^[0-9a-f]{64}$/i.test(input.apiPubHex)) {
+    throw new EphemeralSignerSignError(
+      "apiPubHex must be 64 lowercase hex chars (32-byte Ed25519 pubkey)"
+    );
+  }
+  if (!/^[0-9a-f]{64}$/i.test(input.apiPrivHex)) {
+    throw new EphemeralSignerSignError(
+      "apiPrivHex must be 64 lowercase hex chars (32-byte Ed25519 privkey)"
+    );
+  }
+  if (!input.walletId) {
+    throw new EphemeralSignerSignError("walletId is required");
+  }
+  if (!input.rawSigningPayloadHex || !/^[0-9a-f]+$/i.test(input.rawSigningPayloadHex)) {
+    throw new EphemeralSignerSignError(
+      "rawSigningPayloadHex must be a non-empty lowercase hex string"
+    );
+  }
+  if (!input.publishableKey) {
+    throw new EphemeralSignerSignError(
+      "publishableKey is required \u2014 wallets backend gates /ephemeral-signers/* with RequirePublicToken"
+    );
+  }
+  const binding = await resolveBinding(input);
+  const issuedAt = (input.issuedAt ?? /* @__PURE__ */ new Date()).toISOString();
+  const signedPayload = {
+    raw_signing_payload: input.rawSigningPayloadHex,
+    key_id: binding.keyId,
+    derivation_path: binding.derivationPath,
+    issued_at: issuedAt
+  };
+  const signedBodyBytes = new TextEncoder().encode(
+    JSON.stringify(signedPayload)
+  );
+  const apiPrivBytes = hexToBytes(input.apiPrivHex);
+  const agentSig = ed25519.sign(signedBodyBytes, apiPrivBytes);
+  const requestBody = {
+    api_pub: input.apiPubHex,
+    signed_body: bytesToHex(signedBodyBytes),
+    agent_signature: bytesToHex(agentSig)
+  };
+  const url = `${normalizeBase(input.baseUrl)}/v0/wallets/ephemeral-signers/sign`;
+  const fetchFn = input.fetchImpl ?? fetch;
+  let response;
+  try {
+    response = await fetchFn(url, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        Authorization: `PublicToken ${input.publishableKey}`
+      },
+      body: JSON.stringify(requestBody)
+    });
+  } catch (e) {
+    throw new EphemeralSignerSignError(
+      `transport failure: ${e instanceof Error ? e.message : String(e)}`
+    );
+  }
+  if (!response.ok) {
+    const body = await response.text().catch(() => "");
+    throw new EphemeralSignerSignError(
+      `ephemeral signer sign failed: ${response.status}`,
+      response.status,
+      body
+    );
+  }
+  return await response.json();
+}
 export {
+  EphemeralSignerSignError,
   assertPasskeyInParent,
+  flattenPresenceTokens,
   getHeadlessAuthenticationMethods,
   getHeadlessEthereumMethods,
   getHeadlessGeneralMethods,
   getHeadlessSolanaMethods,
-  getPresenceToken
+  getInternalPresenceTokens,
+  getPresenceToken,
+  signWithEphemeralSigner
 };