@moon-x/core 0.3.0 → 0.5.0

package/dist/types/index.d.mts

@@ -1,5 +1,49 @@
-import { a as ChainLikeWithId, C as Chain } from '../chain-C9dvKXUY.mjs';
-export { B as BlockExplorer, E as EthereumChainConfig, N as NativeCurrency, R as RpcConfig, b as RpcUrls } from '../chain-C9dvKXUY.mjs';
+type RpcUrls = {
+    http: readonly string[];
+    webSocket?: readonly string[];
+};
+type NativeCurrency = {
+    name: string;
+    symbol: string;
+    decimals: number;
+};
+type BlockExplorer = {
+    name: string;
+    url: string;
+};
+type Chain = {
+    id: number;
+    name: string;
+    network?: string;
+    nativeCurrency: NativeCurrency;
+    blockExplorers?: {
+        [key: string]: BlockExplorer;
+        default: BlockExplorer;
+    };
+    rpcUrls: {
+        [key: string]: RpcUrls;
+        default: RpcUrls;
+    };
+    testnet?: boolean;
+};
+type ChainLikeWithId = {
+    id: number;
+};
+type RpcConfig = {
+    rpcUrls?: {
+        [chainId: number]: string;
+    };
+    rpcTimeout?: number;
+};
+interface EthereumChainConfig {
+    defaultChain?: any;
+    supportedChains?: any[];
+    rpcs?: {
+        'ethereum:mainnet': {
+            rpc: string;
+        };
+    };
+}
 
 interface PublicWallet {
     id: string;
@@ -280,7 +324,6 @@ type Sign7702AuthorizationResponse = Sign7702AuthorizationResult | Sign7702Autho
 interface EthereumSignMessageParams {
     message: string;
     wallet: PublicWallet;
-    requireFreshAssertion?: boolean;
     options?: {
         uiOptions?: {
             title?: string;
@@ -298,7 +341,6 @@ interface EthereumSignMessageResult {
 interface EthereumSignTransactionParams {
     transaction: string;
     wallet: PublicWallet;
-    requireFreshAssertion?: boolean;
     options?: {
         preflightCommitment?: "finalized" | "confirmed" | "processed";
         minContextSlot?: number;
@@ -324,7 +366,6 @@ interface EthereumSignTypedDataParams {
     primaryType: SignTypedDataParams["primaryType"];
     message: SignTypedDataParams["message"];
     wallet: PublicWallet;
-    requireFreshAssertion?: boolean;
     options?: {
         uiOptions?: any;
     };
@@ -335,7 +376,6 @@ interface EthereumSignTypedDataResult {
 interface EthereumSignHashParams {
     hash: `0x${string}` | string;
     wallet: PublicWallet;
-    requireFreshAssertion?: boolean;
     options?: {
         uiOptions?: any;
     };
@@ -349,7 +389,6 @@ interface EthereumSign7702AuthorizationParams {
     nonce?: number;
     executor?: "self" | `0x${string}`;
     wallet: PublicWallet;
-    requireFreshAssertion?: boolean;
     options?: {
         uiOptions?: any;
     };
@@ -378,7 +417,6 @@ interface EthereumSendTransactionParams {
     };
     wallet: PublicWallet;
     rpcUrl: string;
-    requireFreshAssertion?: boolean;
     options?: {
         commitment?: TransactionCommitment;
         skipPreflight?: boolean;
@@ -522,7 +560,6 @@ interface UseFundWalletInterface {
 interface SolanaSignMessageParams {
     message: string;
     wallet: PublicWallet;
-    requireFreshAssertion?: boolean;
     options?: {
         uiOptions?: {
             title?: string;
@@ -541,7 +578,6 @@ interface SolanaSignMessageResult {
 interface SolanaSignTransactionParams {
     transaction: string;
     wallet: PublicWallet;
-    requireFreshAssertion?: boolean;
     options?: {
         preflightCommitment?: "finalized" | "confirmed" | "processed";
         minContextSlot?: number;
@@ -564,7 +600,6 @@ interface SolanaSendTransactionParams {
     transaction: string;
     wallet: PublicWallet;
     rpcUrl: string;
-    requireFreshAssertion?: boolean;
     options?: {
         commitment?: TransactionCommitment;
         skipPreflight?: boolean;
@@ -628,6 +663,94 @@ interface SolanaGetTokenAccountsByOwnerResult {
     tokenAccounts: any[];
 }
 
+type EphemeralSignerScheme = "ecdsa_secp256k1" | "eddsa_ed25519";
+type EphemeralSignerChain = "ethereum" | "solana";
+interface ProvisionEphemeralSignerParams {
+    /**
+     * Wallet IDs (from `user.wallets[i].id`) the agent will be authorized
+     * over. The iframe resolves each ID to its `key_id`, chain → MPC
+     * scheme, and stored `derivation_path` — integrator code doesn't need
+     * to know about MPC internals or BIP-32 path formatting.
+     */
+    walletIds: string[];
+    /**
+     * Optional expiration. If set, the SES enclave refuses sign requests
+     * issued after this timestamp. Omit for an open-ended provisioning
+     * the user can revoke later.
+     */
+    expiresAt?: Date;
+    /**
+     * Optional user-facing name ("DCA bot"). Stored on the wallets
+     * backend for the manage view — not sealed into the SES AAD, so
+     * renaming later is a DB-only edit and doesn't invalidate the
+     * provisioned signer.
+     */
+    label?: string;
+}
+/**
+ * Per-wallet display entry inside an EphemeralSigner. The list
+ * response is deliberately slim — schemes / derivation paths stay
+ * server-side (SES enforces them) and are exposed via a per-signer
+ * detail endpoint if ever needed.
+ */
+interface EphemeralSignerWallet {
+    /** Wallet's public address/key, as stored in `platform.wallets.public_key`. */
+    address: string;
+    /** "ethereum", "solana", etc. */
+    chain: string;
+}
+/**
+ * One previously-provisioned ephemeral signer as returned by the list
+ * endpoint. Lighter than ProvisionEphemeralSignerResult — no enclave
+ * attestation metadata, no priv key. Drives the manage view.
+ */
+interface EphemeralSigner {
+    /** Lowercase-hex Ed25519 public key. Unique within the app. */
+    api_pub: string;
+    label?: string;
+    /** One entry per wallet the signer is authorized over, in provisioning order. */
+    wallets: EphemeralSignerWallet[];
+    /** RFC3339. Omitted if the signer has no expiration. */
+    expires_at?: string;
+    /** RFC3339. When the row was created. */
+    provisioned_at: string;
+}
+interface ListEphemeralSignersResult {
+    signers: EphemeralSigner[];
+}
+interface RevokeEphemeralSignerParams {
+    /** Lowercase-hex Ed25519 signer public key, no 0x. */
+    apiPubHex: string;
+}
+interface ProvisionEphemeralSignerResult {
+    /** 32-byte Ed25519 signer public key (lowercase hex, no 0x). Already provisioned in the SES enclave. */
+    apiPubHex: string;
+    /**
+     * 32-byte Ed25519 signer private key (lowercase hex, no 0x). MoonX
+     * does not persist this — the caller is responsible for surfacing it
+     * to the user exactly once and never storing it server-side.
+     */
+    apiPrivHex: string;
+    /** AWS Nitro module ID from the verified attestation (e.g. `i-…-enc…`). */
+    moduleId: string;
+    /** PCR indices that matched the operator-pinned allowlist (typically [0,1,2]). */
+    pcrsMatched: number[];
+    /**
+     * The exact ProvisionAad JSON the iframe sealed to the enclave —
+     * useful for rendering a confirmation summary in the parent UI
+     * without rebuilding it from `wallets`.
+     */
+    aad: {
+        api_pub: string;
+        shares: Array<{
+            key_id: string;
+            scheme: EphemeralSignerScheme;
+            allowed_derivation_paths: string[];
+        }>;
+        expires_at: string | null;
+    };
+}
+
 type EmailOtpFlowState = {
     status: "start";
 } | {
@@ -1203,4 +1326,4 @@ interface WalletVerifyRequest {
     sessionExpiresIn: number;
 }
 
-export { type AccessTokenClaims, type AppConfigRequest, type AppConfigResponse, type AttachOAuthTokenRequest, type AttachOAuthTokenResponse, type AuthAppearance, type AuthFlow, type AuthFlowComponent, type AuthLoginMethod, type AuthProviderConfig, type BaseGetBalanceParams, type BaseGetBalanceResult, type BaseGetTokenAccountsParams, type BaseSendTransactionParams, type BaseSendTransactionResult, type BaseSignMessageParams, type BaseSignMessageResult, type BaseSignTransactionParams, type BaseSignTransactionResult, type BaseTokenClaims, type BaseUIOptions, type BaseWalletHooks, Chain, ChainLikeWithId, type ContractUIOptions, type CreateWalletResponse, type DefaultFundingMethod, type DeleteSessionRequest, type DeleteSessionResponse, type DetachOAuthTokenRequest, type DeviceFingerprint, type DisplayMode, type EmailOtpConfig, type EmailOtpFlowState, type EthereumFundingConfig, type EthereumGetBalanceParams, type EthereumGetBalanceResult, type EthereumGetTokenAccountsByOwnerParams, type EthereumGetTokenAccountsByOwnerResult, type EthereumSendTransactionParams, type EthereumSendTransactionRequest, type EthereumSendTransactionResult, type EthereumSign7702AuthorizationParams, type EthereumSign7702AuthorizationResult, type EthereumSignHashParams, type EthereumSignHashResult, type EthereumSignMessageParams, type EthereumSignMessageResult, type EthereumSignTransactionParams, type EthereumSignTransactionResult, type EthereumSignTypedDataParams, type EthereumSignTypedDataResult, type EthereumSwitchChainParams, type ExportKeyConfig, type Factor, type FlexibleTheme, type FundWalletConfig, type FundingEvents, type FundingMethod, type FundingUIConfig, type GetCurrentSessionRequest, type GetCurrentSessionResponse, type Hex, type IdentityTokenClaims, type IdpProvider, type IsAuthenticatedRequest, type IsAuthenticatedResponse, type LoginTokenBundle, type LogoutRequest, type LogoutResponse, type MessageTypeProperty, type MessageTypes, type MoonKeyThemeConfig, type MoonPaySignRequest, type MoonPaySignResponse, type MpcKeyShares, Network, type OAuthRequest, type OAuthResponse, type OnrampFundingSettings, type PasskeyEnrollConfig, type PasskeySettings, type PreferredCardProvider, type PrefillConfig, type PresenceTokenClaims, type PublicEthereumWallet, type PublicSessionData, type PublicWallet, type RefreshSessionRequest, type RefreshSessionResponse, type RetrieveWalletKeyRequest, type RetrieveWalletKeyResponse, type SdkSettings, type SendEmailOtpRequest, type SendEmailOtpResponse, type SendTransactionConfig, type SendTransactionRequest, type SessionData, type SharesDeviceRequest, type SharesDeviceResponse, type Sign7702AuthorizationError, type Sign7702AuthorizationParams, type Sign7702AuthorizationResponse, type Sign7702AuthorizationResult, type SignMessageConfig, type SignTransactionConfig, type SignTypedDataError, type SignTypedDataParams, type SignTypedDataResponse, type SignTypedDataResult, type SmsSettings, type SolanaChain, type SolanaFundingConfig, type SolanaGetBalanceParams, type SolanaGetBalanceResult, type SolanaGetTokenAccountsByOwnerParams, type SolanaGetTokenAccountsByOwnerResult, type SolanaSendTransactionParams, type SolanaSendTransactionResult, type SolanaSignMessageParams, type SolanaSignMessageResult, type SolanaSignTransactionParams, type SolanaSignTransactionResult, type TransactionCommitment, type TransactionEncoding, type TransactionUIOptions, type TypedMessage, type UseFundWalletInterface, type UsersMePublicResponse, type UsersMeRequest, type UsersMeResponse, type VerifiedSession, type VerifyEmailOtpRequest, type VerifyEmailOtpResponse, type VerifyEmailOtpUser, type VerifyOAuthTokenRequest, type VerifyOAuthTokenResponse, type VerifySiweWalletRegistrationRequest, WALLET_ERROR_CODES, type Wallet, type WalletChain, type WalletChainType, type WalletConnectConfig, WalletCreationError, type WalletError, type WalletErrorCode, type WalletKeyRequest, type WalletListEntry, type WalletRegistrationNonceRequest, type WalletRegistrationNonceResponse, type WalletType, type WalletVerifyRequest };
+export { type AccessTokenClaims, type AppConfigRequest, type AppConfigResponse, type AttachOAuthTokenRequest, type AttachOAuthTokenResponse, type AuthAppearance, type AuthFlow, type AuthFlowComponent, type AuthLoginMethod, type AuthProviderConfig, type BaseGetBalanceParams, type BaseGetBalanceResult, type BaseGetTokenAccountsParams, type BaseSendTransactionParams, type BaseSendTransactionResult, type BaseSignMessageParams, type BaseSignMessageResult, type BaseSignTransactionParams, type BaseSignTransactionResult, type BaseTokenClaims, type BaseUIOptions, type BaseWalletHooks, type BlockExplorer, type Chain, type ChainLikeWithId, type ContractUIOptions, type CreateWalletResponse, type DefaultFundingMethod, type DeleteSessionRequest, type DeleteSessionResponse, type DetachOAuthTokenRequest, type DeviceFingerprint, type DisplayMode, type EmailOtpConfig, type EmailOtpFlowState, type EphemeralSigner, type EphemeralSignerChain, type EphemeralSignerScheme, type EphemeralSignerWallet, type EthereumChainConfig, type EthereumFundingConfig, type EthereumGetBalanceParams, type EthereumGetBalanceResult, type EthereumGetTokenAccountsByOwnerParams, type EthereumGetTokenAccountsByOwnerResult, type EthereumSendTransactionParams, type EthereumSendTransactionRequest, type EthereumSendTransactionResult, type EthereumSign7702AuthorizationParams, type EthereumSign7702AuthorizationResult, type EthereumSignHashParams, type EthereumSignHashResult, type EthereumSignMessageParams, type EthereumSignMessageResult, type EthereumSignTransactionParams, type EthereumSignTransactionResult, type EthereumSignTypedDataParams, type EthereumSignTypedDataResult, type EthereumSwitchChainParams, type ExportKeyConfig, type Factor, type FlexibleTheme, type FundWalletConfig, type FundingEvents, type FundingMethod, type FundingUIConfig, type GetCurrentSessionRequest, type GetCurrentSessionResponse, type Hex, type IdentityTokenClaims, type IdpProvider, type IsAuthenticatedRequest, type IsAuthenticatedResponse, type ListEphemeralSignersResult, type LoginTokenBundle, type LogoutRequest, type LogoutResponse, type MessageTypeProperty, type MessageTypes, type MoonKeyThemeConfig, type MoonPaySignRequest, type MoonPaySignResponse, type MpcKeyShares, type NativeCurrency, Network, type OAuthRequest, type OAuthResponse, type OnrampFundingSettings, type PasskeyEnrollConfig, type PasskeySettings, type PreferredCardProvider, type PrefillConfig, type PresenceTokenClaims, type ProvisionEphemeralSignerParams, type ProvisionEphemeralSignerResult, type PublicEthereumWallet, type PublicSessionData, type PublicWallet, type RefreshSessionRequest, type RefreshSessionResponse, type RetrieveWalletKeyRequest, type RetrieveWalletKeyResponse, type RevokeEphemeralSignerParams, type RpcConfig, type RpcUrls, type SdkSettings, type SendEmailOtpRequest, type SendEmailOtpResponse, type SendTransactionConfig, type SendTransactionRequest, type SessionData, type SharesDeviceRequest, type SharesDeviceResponse, type Sign7702AuthorizationError, type Sign7702AuthorizationParams, type Sign7702AuthorizationResponse, type Sign7702AuthorizationResult, type SignMessageConfig, type SignTransactionConfig, type SignTypedDataError, type SignTypedDataParams, type SignTypedDataResponse, type SignTypedDataResult, type SmsSettings, type SolanaChain, type SolanaFundingConfig, type SolanaGetBalanceParams, type SolanaGetBalanceResult, type SolanaGetTokenAccountsByOwnerParams, type SolanaGetTokenAccountsByOwnerResult, type SolanaSendTransactionParams, type SolanaSendTransactionResult, type SolanaSignMessageParams, type SolanaSignMessageResult, type SolanaSignTransactionParams, type SolanaSignTransactionResult, type TransactionCommitment, type TransactionEncoding, type TransactionUIOptions, type TypedMessage, type UseFundWalletInterface, type UsersMePublicResponse, type UsersMeRequest, type UsersMeResponse, type VerifiedSession, type VerifyEmailOtpRequest, type VerifyEmailOtpResponse, type VerifyEmailOtpUser, type VerifyOAuthTokenRequest, type VerifyOAuthTokenResponse, type VerifySiweWalletRegistrationRequest, WALLET_ERROR_CODES, type Wallet, type WalletChain, type WalletChainType, type WalletConnectConfig, WalletCreationError, type WalletError, type WalletErrorCode, type WalletKeyRequest, type WalletListEntry, type WalletRegistrationNonceRequest, type WalletRegistrationNonceResponse, type WalletType, type WalletVerifyRequest };

package/dist/types/index.d.ts

@@ -1,5 +1,49 @@
-import { a as ChainLikeWithId, C as Chain } from '../chain-C9dvKXUY.js';
-export { B as BlockExplorer, E as EthereumChainConfig, N as NativeCurrency, R as RpcConfig, b as RpcUrls } from '../chain-C9dvKXUY.js';
+type RpcUrls = {
+    http: readonly string[];
+    webSocket?: readonly string[];
+};
+type NativeCurrency = {
+    name: string;
+    symbol: string;
+    decimals: number;
+};
+type BlockExplorer = {
+    name: string;
+    url: string;
+};
+type Chain = {
+    id: number;
+    name: string;
+    network?: string;
+    nativeCurrency: NativeCurrency;
+    blockExplorers?: {
+        [key: string]: BlockExplorer;
+        default: BlockExplorer;
+    };
+    rpcUrls: {
+        [key: string]: RpcUrls;
+        default: RpcUrls;
+    };
+    testnet?: boolean;
+};
+type ChainLikeWithId = {
+    id: number;
+};
+type RpcConfig = {
+    rpcUrls?: {
+        [chainId: number]: string;
+    };
+    rpcTimeout?: number;
+};
+interface EthereumChainConfig {
+    defaultChain?: any;
+    supportedChains?: any[];
+    rpcs?: {
+        'ethereum:mainnet': {
+            rpc: string;
+        };
+    };
+}
 
 interface PublicWallet {
     id: string;
@@ -280,7 +324,6 @@ type Sign7702AuthorizationResponse = Sign7702AuthorizationResult | Sign7702Autho
 interface EthereumSignMessageParams {
     message: string;
     wallet: PublicWallet;
-    requireFreshAssertion?: boolean;
     options?: {
         uiOptions?: {
             title?: string;
@@ -298,7 +341,6 @@ interface EthereumSignMessageResult {
 interface EthereumSignTransactionParams {
     transaction: string;
     wallet: PublicWallet;
-    requireFreshAssertion?: boolean;
     options?: {
         preflightCommitment?: "finalized" | "confirmed" | "processed";
         minContextSlot?: number;
@@ -324,7 +366,6 @@ interface EthereumSignTypedDataParams {
     primaryType: SignTypedDataParams["primaryType"];
     message: SignTypedDataParams["message"];
     wallet: PublicWallet;
-    requireFreshAssertion?: boolean;
     options?: {
         uiOptions?: any;
     };
@@ -335,7 +376,6 @@ interface EthereumSignTypedDataResult {
 interface EthereumSignHashParams {
     hash: `0x${string}` | string;
     wallet: PublicWallet;
-    requireFreshAssertion?: boolean;
     options?: {
         uiOptions?: any;
     };
@@ -349,7 +389,6 @@ interface EthereumSign7702AuthorizationParams {
     nonce?: number;
     executor?: "self" | `0x${string}`;
     wallet: PublicWallet;
-    requireFreshAssertion?: boolean;
     options?: {
         uiOptions?: any;
     };
@@ -378,7 +417,6 @@ interface EthereumSendTransactionParams {
     };
     wallet: PublicWallet;
     rpcUrl: string;
-    requireFreshAssertion?: boolean;
     options?: {
         commitment?: TransactionCommitment;
         skipPreflight?: boolean;
@@ -522,7 +560,6 @@ interface UseFundWalletInterface {
 interface SolanaSignMessageParams {
     message: string;
     wallet: PublicWallet;
-    requireFreshAssertion?: boolean;
     options?: {
         uiOptions?: {
             title?: string;
@@ -541,7 +578,6 @@ interface SolanaSignMessageResult {
 interface SolanaSignTransactionParams {
     transaction: string;
     wallet: PublicWallet;
-    requireFreshAssertion?: boolean;
     options?: {
         preflightCommitment?: "finalized" | "confirmed" | "processed";
         minContextSlot?: number;
@@ -564,7 +600,6 @@ interface SolanaSendTransactionParams {
     transaction: string;
     wallet: PublicWallet;
     rpcUrl: string;
-    requireFreshAssertion?: boolean;
     options?: {
         commitment?: TransactionCommitment;
         skipPreflight?: boolean;
@@ -628,6 +663,94 @@ interface SolanaGetTokenAccountsByOwnerResult {
     tokenAccounts: any[];
 }
 
+type EphemeralSignerScheme = "ecdsa_secp256k1" | "eddsa_ed25519";
+type EphemeralSignerChain = "ethereum" | "solana";
+interface ProvisionEphemeralSignerParams {
+    /**
+     * Wallet IDs (from `user.wallets[i].id`) the agent will be authorized
+     * over. The iframe resolves each ID to its `key_id`, chain → MPC
+     * scheme, and stored `derivation_path` — integrator code doesn't need
+     * to know about MPC internals or BIP-32 path formatting.
+     */
+    walletIds: string[];
+    /**
+     * Optional expiration. If set, the SES enclave refuses sign requests
+     * issued after this timestamp. Omit for an open-ended provisioning
+     * the user can revoke later.
+     */
+    expiresAt?: Date;
+    /**
+     * Optional user-facing name ("DCA bot"). Stored on the wallets
+     * backend for the manage view — not sealed into the SES AAD, so
+     * renaming later is a DB-only edit and doesn't invalidate the
+     * provisioned signer.
+     */
+    label?: string;
+}
+/**
+ * Per-wallet display entry inside an EphemeralSigner. The list
+ * response is deliberately slim — schemes / derivation paths stay
+ * server-side (SES enforces them) and are exposed via a per-signer
+ * detail endpoint if ever needed.
+ */
+interface EphemeralSignerWallet {
+    /** Wallet's public address/key, as stored in `platform.wallets.public_key`. */
+    address: string;
+    /** "ethereum", "solana", etc. */
+    chain: string;
+}
+/**
+ * One previously-provisioned ephemeral signer as returned by the list
+ * endpoint. Lighter than ProvisionEphemeralSignerResult — no enclave
+ * attestation metadata, no priv key. Drives the manage view.
+ */
+interface EphemeralSigner {
+    /** Lowercase-hex Ed25519 public key. Unique within the app. */
+    api_pub: string;
+    label?: string;
+    /** One entry per wallet the signer is authorized over, in provisioning order. */
+    wallets: EphemeralSignerWallet[];
+    /** RFC3339. Omitted if the signer has no expiration. */
+    expires_at?: string;
+    /** RFC3339. When the row was created. */
+    provisioned_at: string;
+}
+interface ListEphemeralSignersResult {
+    signers: EphemeralSigner[];
+}
+interface RevokeEphemeralSignerParams {
+    /** Lowercase-hex Ed25519 signer public key, no 0x. */
+    apiPubHex: string;
+}
+interface ProvisionEphemeralSignerResult {
+    /** 32-byte Ed25519 signer public key (lowercase hex, no 0x). Already provisioned in the SES enclave. */
+    apiPubHex: string;
+    /**
+     * 32-byte Ed25519 signer private key (lowercase hex, no 0x). MoonX
+     * does not persist this — the caller is responsible for surfacing it
+     * to the user exactly once and never storing it server-side.
+     */
+    apiPrivHex: string;
+    /** AWS Nitro module ID from the verified attestation (e.g. `i-…-enc…`). */
+    moduleId: string;
+    /** PCR indices that matched the operator-pinned allowlist (typically [0,1,2]). */
+    pcrsMatched: number[];
+    /**
+     * The exact ProvisionAad JSON the iframe sealed to the enclave —
+     * useful for rendering a confirmation summary in the parent UI
+     * without rebuilding it from `wallets`.
+     */
+    aad: {
+        api_pub: string;
+        shares: Array<{
+            key_id: string;
+            scheme: EphemeralSignerScheme;
+            allowed_derivation_paths: string[];
+        }>;
+        expires_at: string | null;
+    };
+}
+
 type EmailOtpFlowState = {
     status: "start";
 } | {
@@ -1203,4 +1326,4 @@ interface WalletVerifyRequest {
     sessionExpiresIn: number;
 }
 
-export { type AccessTokenClaims, type AppConfigRequest, type AppConfigResponse, type AttachOAuthTokenRequest, type AttachOAuthTokenResponse, type AuthAppearance, type AuthFlow, type AuthFlowComponent, type AuthLoginMethod, type AuthProviderConfig, type BaseGetBalanceParams, type BaseGetBalanceResult, type BaseGetTokenAccountsParams, type BaseSendTransactionParams, type BaseSendTransactionResult, type BaseSignMessageParams, type BaseSignMessageResult, type BaseSignTransactionParams, type BaseSignTransactionResult, type BaseTokenClaims, type BaseUIOptions, type BaseWalletHooks, Chain, ChainLikeWithId, type ContractUIOptions, type CreateWalletResponse, type DefaultFundingMethod, type DeleteSessionRequest, type DeleteSessionResponse, type DetachOAuthTokenRequest, type DeviceFingerprint, type DisplayMode, type EmailOtpConfig, type EmailOtpFlowState, type EthereumFundingConfig, type EthereumGetBalanceParams, type EthereumGetBalanceResult, type EthereumGetTokenAccountsByOwnerParams, type EthereumGetTokenAccountsByOwnerResult, type EthereumSendTransactionParams, type EthereumSendTransactionRequest, type EthereumSendTransactionResult, type EthereumSign7702AuthorizationParams, type EthereumSign7702AuthorizationResult, type EthereumSignHashParams, type EthereumSignHashResult, type EthereumSignMessageParams, type EthereumSignMessageResult, type EthereumSignTransactionParams, type EthereumSignTransactionResult, type EthereumSignTypedDataParams, type EthereumSignTypedDataResult, type EthereumSwitchChainParams, type ExportKeyConfig, type Factor, type FlexibleTheme, type FundWalletConfig, type FundingEvents, type FundingMethod, type FundingUIConfig, type GetCurrentSessionRequest, type GetCurrentSessionResponse, type Hex, type IdentityTokenClaims, type IdpProvider, type IsAuthenticatedRequest, type IsAuthenticatedResponse, type LoginTokenBundle, type LogoutRequest, type LogoutResponse, type MessageTypeProperty, type MessageTypes, type MoonKeyThemeConfig, type MoonPaySignRequest, type MoonPaySignResponse, type MpcKeyShares, Network, type OAuthRequest, type OAuthResponse, type OnrampFundingSettings, type PasskeyEnrollConfig, type PasskeySettings, type PreferredCardProvider, type PrefillConfig, type PresenceTokenClaims, type PublicEthereumWallet, type PublicSessionData, type PublicWallet, type RefreshSessionRequest, type RefreshSessionResponse, type RetrieveWalletKeyRequest, type RetrieveWalletKeyResponse, type SdkSettings, type SendEmailOtpRequest, type SendEmailOtpResponse, type SendTransactionConfig, type SendTransactionRequest, type SessionData, type SharesDeviceRequest, type SharesDeviceResponse, type Sign7702AuthorizationError, type Sign7702AuthorizationParams, type Sign7702AuthorizationResponse, type Sign7702AuthorizationResult, type SignMessageConfig, type SignTransactionConfig, type SignTypedDataError, type SignTypedDataParams, type SignTypedDataResponse, type SignTypedDataResult, type SmsSettings, type SolanaChain, type SolanaFundingConfig, type SolanaGetBalanceParams, type SolanaGetBalanceResult, type SolanaGetTokenAccountsByOwnerParams, type SolanaGetTokenAccountsByOwnerResult, type SolanaSendTransactionParams, type SolanaSendTransactionResult, type SolanaSignMessageParams, type SolanaSignMessageResult, type SolanaSignTransactionParams, type SolanaSignTransactionResult, type TransactionCommitment, type TransactionEncoding, type TransactionUIOptions, type TypedMessage, type UseFundWalletInterface, type UsersMePublicResponse, type UsersMeRequest, type UsersMeResponse, type VerifiedSession, type VerifyEmailOtpRequest, type VerifyEmailOtpResponse, type VerifyEmailOtpUser, type VerifyOAuthTokenRequest, type VerifyOAuthTokenResponse, type VerifySiweWalletRegistrationRequest, WALLET_ERROR_CODES, type Wallet, type WalletChain, type WalletChainType, type WalletConnectConfig, WalletCreationError, type WalletError, type WalletErrorCode, type WalletKeyRequest, type WalletListEntry, type WalletRegistrationNonceRequest, type WalletRegistrationNonceResponse, type WalletType, type WalletVerifyRequest };
+export { type AccessTokenClaims, type AppConfigRequest, type AppConfigResponse, type AttachOAuthTokenRequest, type AttachOAuthTokenResponse, type AuthAppearance, type AuthFlow, type AuthFlowComponent, type AuthLoginMethod, type AuthProviderConfig, type BaseGetBalanceParams, type BaseGetBalanceResult, type BaseGetTokenAccountsParams, type BaseSendTransactionParams, type BaseSendTransactionResult, type BaseSignMessageParams, type BaseSignMessageResult, type BaseSignTransactionParams, type BaseSignTransactionResult, type BaseTokenClaims, type BaseUIOptions, type BaseWalletHooks, type BlockExplorer, type Chain, type ChainLikeWithId, type ContractUIOptions, type CreateWalletResponse, type DefaultFundingMethod, type DeleteSessionRequest, type DeleteSessionResponse, type DetachOAuthTokenRequest, type DeviceFingerprint, type DisplayMode, type EmailOtpConfig, type EmailOtpFlowState, type EphemeralSigner, type EphemeralSignerChain, type EphemeralSignerScheme, type EphemeralSignerWallet, type EthereumChainConfig, type EthereumFundingConfig, type EthereumGetBalanceParams, type EthereumGetBalanceResult, type EthereumGetTokenAccountsByOwnerParams, type EthereumGetTokenAccountsByOwnerResult, type EthereumSendTransactionParams, type EthereumSendTransactionRequest, type EthereumSendTransactionResult, type EthereumSign7702AuthorizationParams, type EthereumSign7702AuthorizationResult, type EthereumSignHashParams, type EthereumSignHashResult, type EthereumSignMessageParams, type EthereumSignMessageResult, type EthereumSignTransactionParams, type EthereumSignTransactionResult, type EthereumSignTypedDataParams, type EthereumSignTypedDataResult, type EthereumSwitchChainParams, type ExportKeyConfig, type Factor, type FlexibleTheme, type FundWalletConfig, type FundingEvents, type FundingMethod, type FundingUIConfig, type GetCurrentSessionRequest, type GetCurrentSessionResponse, type Hex, type IdentityTokenClaims, type IdpProvider, type IsAuthenticatedRequest, type IsAuthenticatedResponse, type ListEphemeralSignersResult, type LoginTokenBundle, type LogoutRequest, type LogoutResponse, type MessageTypeProperty, type MessageTypes, type MoonKeyThemeConfig, type MoonPaySignRequest, type MoonPaySignResponse, type MpcKeyShares, type NativeCurrency, Network, type OAuthRequest, type OAuthResponse, type OnrampFundingSettings, type PasskeyEnrollConfig, type PasskeySettings, type PreferredCardProvider, type PrefillConfig, type PresenceTokenClaims, type ProvisionEphemeralSignerParams, type ProvisionEphemeralSignerResult, type PublicEthereumWallet, type PublicSessionData, type PublicWallet, type RefreshSessionRequest, type RefreshSessionResponse, type RetrieveWalletKeyRequest, type RetrieveWalletKeyResponse, type RevokeEphemeralSignerParams, type RpcConfig, type RpcUrls, type SdkSettings, type SendEmailOtpRequest, type SendEmailOtpResponse, type SendTransactionConfig, type SendTransactionRequest, type SessionData, type SharesDeviceRequest, type SharesDeviceResponse, type Sign7702AuthorizationError, type Sign7702AuthorizationParams, type Sign7702AuthorizationResponse, type Sign7702AuthorizationResult, type SignMessageConfig, type SignTransactionConfig, type SignTypedDataError, type SignTypedDataParams, type SignTypedDataResponse, type SignTypedDataResult, type SmsSettings, type SolanaChain, type SolanaFundingConfig, type SolanaGetBalanceParams, type SolanaGetBalanceResult, type SolanaGetTokenAccountsByOwnerParams, type SolanaGetTokenAccountsByOwnerResult, type SolanaSendTransactionParams, type SolanaSendTransactionResult, type SolanaSignMessageParams, type SolanaSignMessageResult, type SolanaSignTransactionParams, type SolanaSignTransactionResult, type TransactionCommitment, type TransactionEncoding, type TransactionUIOptions, type TypedMessage, type UseFundWalletInterface, type UsersMePublicResponse, type UsersMeRequest, type UsersMeResponse, type VerifiedSession, type VerifyEmailOtpRequest, type VerifyEmailOtpResponse, type VerifyEmailOtpUser, type VerifyOAuthTokenRequest, type VerifyOAuthTokenResponse, type VerifySiweWalletRegistrationRequest, WALLET_ERROR_CODES, type Wallet, type WalletChain, type WalletChainType, type WalletConnectConfig, WalletCreationError, type WalletError, type WalletErrorCode, type WalletKeyRequest, type WalletListEntry, type WalletRegistrationNonceRequest, type WalletRegistrationNonceResponse, type WalletType, type WalletVerifyRequest };

package/dist/utils/index.d.mts

@@ -1,4 +1,4 @@
-export { F as FORWARDED_ERROR_FIELDS, P as PostMessageClient, a as PostMessageMethod, b as PostMessageServer, c as PostMessageType } from '../post-message-CmgAfkOS.mjs';
+export { F as FORWARDED_ERROR_FIELDS, P as PostMessageClient, a as PostMessageMethod, b as PostMessageServer, c as PostMessageType } from '../post-message-Z6cLf0mS.mjs';
 
 /**
  * Get the appropriate MoonKey API URL based on environment configuration

package/dist/utils/index.d.ts

@@ -1,4 +1,4 @@
-export { F as FORWARDED_ERROR_FIELDS, P as PostMessageClient, a as PostMessageMethod, b as PostMessageServer, c as PostMessageType } from '../post-message-CmgAfkOS.js';
+export { F as FORWARDED_ERROR_FIELDS, P as PostMessageClient, a as PostMessageMethod, b as PostMessageServer, c as PostMessageType } from '../post-message-Z6cLf0mS.js';
 
 /**
  * Get the appropriate MoonKey API URL based on environment configuration

package/dist/utils/index.js

@@ -143,6 +143,20 @@ var PostMessageMethod = {
   // dispatcher boring.
   SIGN_HASH: "SIGN_HASH",
   SIGN_7702_AUTHORIZATION: "SIGN_7702_AUTHORIZATION",
+  // Provision a SES (Secure Ephemeral Signer) over one or more of the
+  // user's MPC wallets. Iframe verifies the Nitro attestation, decrypts
+  // the selected keyshares, HPKE-seals them to the verified enclave
+  // pubkey, and returns a freshly-generated Ed25519 signer keypair.
+  // MoonX never persists the private key — the parent must hand it to
+  // the user immediately.
+  PROVISION_EPHEMERAL_SIGNER: "PROVISION_EPHEMERAL_SIGNER",
+  // List the user's active provisioned ephemeral signers from the
+  // wallets backend. Read-only; doesn't touch SES or the enclave.
+  LIST_EPHEMERAL_SIGNERS: "LIST_EPHEMERAL_SIGNERS",
+  // Soft-revoke a previously-provisioned ephemeral signer. The wallets
+  // backend updates revoked_at locally and forwards the revoke to SES
+  // so the enclave drops the policy.
+  REVOKE_EPHEMERAL_SIGNER: "REVOKE_EPHEMERAL_SIGNER",
   VERIFY_EMAIL_OTP: "VERIFY_EMAIL_OTP",
   VERIFY_OAUTH: "VERIFY_OAUTH",
   START_OAUTH: "START_OAUTH",

package/dist/utils/index.mjs

@@ -9,7 +9,7 @@ import {
   PostMessageMethod,
   PostMessageServer,
   PostMessageType
-} from "../chunk-VVL65GIB.mjs";
+} from "../chunk-JU5MWLXH.mjs";
 import {
   getMoonKeyApiUrl
 } from "../chunk-GQKIA37O.mjs";

package/dist/web/index.d.mts

@@ -1,5 +1,5 @@
-import { P as PostMessageClient } from '../post-message-CmgAfkOS.mjs';
-import { T as Transport, P as PasskeyAssertor, K as KvStorage } from '../interfaces-CYtJHALV.mjs';
+import { P as PostMessageClient } from '../post-message-Z6cLf0mS.mjs';
+import { T as Transport, P as PasskeyAssertor, K as KvStorage } from '../interfaces-BdIeMGGD.mjs';
 
 declare const getCachedPostMessageClient: (contentWindow: Window) => PostMessageClient;
 /**

package/dist/web/index.d.ts

@@ -1,5 +1,5 @@
-import { P as PostMessageClient } from '../post-message-CmgAfkOS.js';
-import { T as Transport, P as PasskeyAssertor, K as KvStorage } from '../interfaces-Bm7fGOAI.js';
+import { P as PostMessageClient } from '../post-message-Z6cLf0mS.js';
+import { T as Transport, P as PasskeyAssertor, K as KvStorage } from '../interfaces-1vfik3Ef.js';
 
 declare const getCachedPostMessageClient: (contentWindow: Window) => PostMessageClient;
 /**

package/dist/web/index.js

@@ -338,6 +338,35 @@ var createWebAuthnPasskey = () => ({
       authenticatorAttachment: result.authenticatorAttachment
     };
     return sanitized;
+  },
+  assertForInternalPresence: async ({ optionsJSON }) => {
+    const result = await (0, import_browser.startAuthentication)({
+      optionsJSON: {
+        ...optionsJSON,
+        allowCredentials: []
+      }
+    });
+    if (!result.response.userHandle) {
+      throw new Error("user_handle_missing");
+    }
+    const sanitized = {
+      id: result.id,
+      rawId: result.rawId,
+      type: result.type,
+      response: {
+        clientDataJSON: result.response.clientDataJSON,
+        authenticatorData: result.response.authenticatorData,
+        signature: result.response.signature,
+        userHandle: void 0
+      },
+      clientExtensionResults: result.clientExtensionResults,
+      authenticatorAttachment: result.authenticatorAttachment
+    };
+    return {
+      response: sanitized,
+      userHandleB64url: result.response.userHandle,
+      credentialIdB64url: result.rawId
+    };
   }
 });
 

package/dist/web/index.mjs

@@ -5,7 +5,7 @@ import {
 import {
   PostMessageClient,
   PostMessageServer
-} from "../chunk-VVL65GIB.mjs";
+} from "../chunk-JU5MWLXH.mjs";
 
 // src/web/iframe-transport.ts
 var clientCache = /* @__PURE__ */ new WeakMap();
@@ -81,6 +81,35 @@ var createWebAuthnPasskey = () => ({
       authenticatorAttachment: result.authenticatorAttachment
     };
     return sanitized;
+  },
+  assertForInternalPresence: async ({ optionsJSON }) => {
+    const result = await startAuthentication({
+      optionsJSON: {
+        ...optionsJSON,
+        allowCredentials: []
+      }
+    });
+    if (!result.response.userHandle) {
+      throw new Error("user_handle_missing");
+    }
+    const sanitized = {
+      id: result.id,
+      rawId: result.rawId,
+      type: result.type,
+      response: {
+        clientDataJSON: result.response.clientDataJSON,
+        authenticatorData: result.response.authenticatorData,
+        signature: result.response.signature,
+        userHandle: void 0
+      },
+      clientExtensionResults: result.clientExtensionResults,
+      authenticatorAttachment: result.authenticatorAttachment
+    };
+    return {
+      response: sanitized,
+      userHandleB64url: result.response.userHandle,
+      credentialIdB64url: result.rawId
+    };
   }
 });
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@moon-x/core",
-  "version": "0.3.0",
+  "version": "0.5.0",
   "license": "UNLICENSED",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -58,6 +58,8 @@
     "access": "public"
   },
   "dependencies": {
+    "@noble/curves": "1.8.0",
+    "@noble/hashes": "1.8.0",
     "@simplewebauthn/browser": "^13.2.2"
   },
   "devDependencies": {

package/dist/chain-C9dvKXUY.d.mts

@@ -1,48 +0,0 @@
-type RpcUrls = {
-    http: readonly string[];
-    webSocket?: readonly string[];
-};
-type NativeCurrency = {
-    name: string;
-    symbol: string;
-    decimals: number;
-};
-type BlockExplorer = {
-    name: string;
-    url: string;
-};
-type Chain = {
-    id: number;
-    name: string;
-    network?: string;
-    nativeCurrency: NativeCurrency;
-    blockExplorers?: {
-        [key: string]: BlockExplorer;
-        default: BlockExplorer;
-    };
-    rpcUrls: {
-        [key: string]: RpcUrls;
-        default: RpcUrls;
-    };
-    testnet?: boolean;
-};
-type ChainLikeWithId = {
-    id: number;
-};
-type RpcConfig = {
-    rpcUrls?: {
-        [chainId: number]: string;
-    };
-    rpcTimeout?: number;
-};
-interface EthereumChainConfig {
-    defaultChain?: any;
-    supportedChains?: any[];
-    rpcs?: {
-        'ethereum:mainnet': {
-            rpc: string;
-        };
-    };
-}
-
-export type { BlockExplorer as B, Chain as C, EthereumChainConfig as E, NativeCurrency as N, RpcConfig as R, ChainLikeWithId as a, RpcUrls as b };