@moon-x/core 0.4.0 → 0.6.0

package/dist/sdk/index.d.ts

@@ -1,9 +1,8 @@
-import { T as Transport, P as PasskeyAssertor, K as KvStorage } from '../interfaces-pNTEOKaK.js';
-export { O as OAuthOpener, a as PlatformImpls, W as WebAuthnAssertionResponse, b as WebAuthnRequestOptions } from '../interfaces-pNTEOKaK.js';
+import { T as Transport, P as PasskeyAssertor, R as RelyingPartyOriginInput, K as KvStorage } from '../interfaces-BZ5GMWS9.js';
+export { O as OAuthOpener, a as PlatformImpls, W as WebAuthnAssertionResponse, b as WebAuthnRequestOptions, r as resolveRelyingPartyOrigin } from '../interfaces-BZ5GMWS9.js';
 import { C as CachedAssertion } from '../passkey-cache-WnDFQ-v4.js';
-import { EthereumSignMessageParams, EthereumSignMessageResult, EthereumSignTransactionParams, EthereumSignTransactionResult, EthereumSignTypedDataParams, EthereumSignTypedDataResult, EthereumSignHashParams, EthereumSignHashResult, EthereumSign7702AuthorizationParams, EthereumSign7702AuthorizationResult, EthereumSendTransactionParams, EthereumSendTransactionResult, EthereumGetBalanceParams, EthereumGetBalanceResult, EthereumGetTokenAccountsByOwnerParams, EthereumGetTokenAccountsByOwnerResult, SolanaSignMessageParams, SolanaSignMessageResult, SolanaSignTransactionParams, SolanaSignTransactionResult, SolanaSendTransactionParams, SolanaSendTransactionResult, SolanaGetBalanceParams, SolanaGetBalanceResult, SolanaGetTokenAccountsByOwnerParams, SolanaGetTokenAccountsByOwnerResult, SendEmailOtpResponse, PublicWallet } from '../types/index.js';
-import '../post-message-CmgAfkOS.js';
-import '../chain-C9dvKXUY.js';
+import { EthereumSignMessageParams, EthereumSignMessageResult, EthereumSignTransactionParams, EthereumSignTransactionResult, EthereumSignTypedDataParams, EthereumSignTypedDataResult, EthereumSignHashParams, EthereumSignHashResult, EthereumSign7702AuthorizationParams, EthereumSign7702AuthorizationResult, EthereumSendTransactionParams, EthereumSendTransactionResult, EthereumGetBalanceParams, EthereumGetBalanceResult, EthereumGetTokenAccountsByOwnerParams, EthereumGetTokenAccountsByOwnerResult, SolanaSignMessageParams, SolanaSignMessageResult, SolanaSignTransactionParams, SolanaSignTransactionResult, SolanaSendTransactionParams, SolanaSendTransactionResult, SolanaGetBalanceParams, SolanaGetBalanceResult, SolanaGetTokenAccountsByOwnerParams, SolanaGetTokenAccountsByOwnerResult, SendEmailOtpResponse, PublicWallet, ProvisionEphemeralSignerParams, ProvisionEphemeralSignerResult, ListEphemeralSignersResult, RevokeEphemeralSignerParams } from '../types/index.js';
+import '../post-message-Z6cLf0mS.js';
 
 type AssertPasskeyInParentResult = CachedAssertion;
 declare const assertPasskeyInParent: ({ transport, passkey, publishableKey, validateCredentialInAllowList, }: {
@@ -21,7 +20,7 @@ declare const getPresenceToken: ({ transport, passkey, publishableKey, relyingPa
     transport: Transport;
     passkey: PasskeyAssertor;
     publishableKey: string;
-    relyingPartyOrigin: string;
+    relyingPartyOrigin: RelyingPartyOriginInput;
 }) => Promise<GetPresenceTokenResult>;
 
 interface ScopedPresenceToken {
@@ -30,23 +29,25 @@ interface ScopedPresenceToken {
 }
 interface GetInternalPresenceTokensResult {
     tokens: Record<string, ScopedPresenceToken>;
+    tokenBatches: Record<string, ScopedPresenceToken[]>;
     userHandleB64url: string;
     credentialIdB64url: string;
 }
-declare const getInternalPresenceTokens: ({ transport, passkey, publishableKey, relyingPartyOrigin, scopes, }: {
+declare const getInternalPresenceTokens: ({ transport, passkey, publishableKey, relyingPartyOrigin, scopes, scopeCounts, }: {
     transport: Transport;
     passkey: PasskeyAssertor;
     publishableKey: string;
-    relyingPartyOrigin: string;
-    scopes: string[];
+    relyingPartyOrigin: RelyingPartyOriginInput;
+    scopes?: string[];
+    scopeCounts?: Record<string, number>;
 }) => Promise<GetInternalPresenceTokensResult>;
-declare const flattenPresenceTokens: (result: GetInternalPresenceTokensResult) => Record<string, string>;
+declare const flattenPresenceTokens: (result: Pick<GetInternalPresenceTokensResult, "tokens"> & Partial<GetInternalPresenceTokensResult>) => Record<string, string>;
 
 declare const getHeadlessEthereumMethods: ({ transport, passkey, publishableKey, relyingPartyOrigin, }: {
     transport: Transport;
     passkey: PasskeyAssertor;
     publishableKey: string;
-    relyingPartyOrigin: string;
+    relyingPartyOrigin: RelyingPartyOriginInput;
 }) => {
     signEthereumMessageHeadless: (params: EthereumSignMessageParams) => Promise<EthereumSignMessageResult>;
     signEthereumTransactionHeadless: (params: EthereumSignTransactionParams) => Promise<EthereumSignTransactionResult>;
@@ -68,7 +69,7 @@ declare const getHeadlessSolanaMethods: ({ transport, passkey, publishableKey, r
     transport: Transport;
     passkey: PasskeyAssertor;
     publishableKey: string;
-    relyingPartyOrigin: string;
+    relyingPartyOrigin: RelyingPartyOriginInput;
 }) => {
     signSolanaMessageHeadless: (params: SolanaSignMessageParams) => Promise<SolanaSignMessageResult>;
     signSolanaTransactionHeadless: (params: SolanaSignTransactionParams) => Promise<SolanaSignTransactionResult>;
@@ -122,7 +123,7 @@ declare const getHeadlessGeneralMethods: ({ transport, passkey, storage, publish
     passkey: PasskeyAssertor;
     storage: KvStorage;
     publishableKey: string;
-    relyingPartyOrigin: string;
+    relyingPartyOrigin: RelyingPartyOriginInput;
     setIsAuthenticated?: (isAuth: boolean) => void;
     setUser?: (user: unknown | null) => void;
 }) => {
@@ -137,6 +138,9 @@ declare const getHeadlessGeneralMethods: ({ transport, passkey, storage, publish
     importKey: (walletType: "solana" | "ethereum", key: string) => Promise<{
         wallet: PublicWallet;
     }>;
+    provisionEphemeralSigner: (params: ProvisionEphemeralSignerParams) => Promise<ProvisionEphemeralSignerResult>;
+    listEphemeralSigners: () => Promise<ListEphemeralSignersResult>;
+    revokeEphemeralSigner: (params: RevokeEphemeralSignerParams) => Promise<void>;
     getWallets: (walletType: "solana" | "ethereum") => Promise<{
         wallets: unknown[];
         walletType: string;
@@ -154,4 +158,54 @@ declare const getHeadlessGeneralMethods: ({ transport, passkey, storage, publish
     getUser: () => Promise<unknown>;
 };
 
-export { type AssertPasskeyInParentResult, type GetInternalPresenceTokensResult, type GetPresenceTokenResult, KvStorage, type LoginWithCodeParams, PasskeyAssertor, type ScopedPresenceToken, type SendCodeParams, Transport, type VerifyOAuthParams, assertPasskeyInParent, flattenPresenceTokens, getHeadlessAuthenticationMethods, getHeadlessEthereumMethods, getHeadlessGeneralMethods, getHeadlessSolanaMethods, getInternalPresenceTokens, getPresenceToken };
+interface EphemeralSignerSignInput {
+    /** Lowercase-hex 32-byte Ed25519 agent public key (no 0x prefix). */
+    apiPubHex: string;
+    /** Lowercase-hex 32-byte Ed25519 agent private key (no 0x prefix). */
+    apiPrivHex: string;
+    /**
+     * Wallet UUID (from `user.wallets[i].id`) the agent should sign on
+     * behalf of. Must be one of the wallets the agent was provisioned
+     * for. The SDK resolves this internally to the wallet's MPC `key_id`
+     * + stored `derivation_path` — integrators never see those values.
+     */
+    walletId: string;
+    /**
+     * Lowercase-hex digest to sign — keccak256 of the message/tx for
+     * ECDSA, raw bytes for Ed25519. No 0x prefix.
+     */
+    rawSigningPayloadHex: string;
+    /** Defaults to now. SES rejects timestamps further than ±5 min from its clock. */
+    issuedAt?: Date;
+    /** Wallets backend base URL (no trailing slash). */
+    baseUrl: string;
+    /**
+     * MoonX publishable key (`moon_pk_…`). The wallets backend's
+     * /ephemeral-signers/* router group is gated by RequirePublicToken — every
+     * call needs an `Authorization: PublicToken <publishableKey>` header.
+     */
+    publishableKey: string;
+    /** Optional fetch override — e.g. for Next.js route handlers or test stubs. */
+    fetchImpl?: typeof fetch;
+}
+interface EphemeralSignerSignResult {
+    scheme: "ecdsa_secp256k1" | "eddsa_ed25519";
+    signature: {
+        /** ECDSA only. Lowercase-hex 32-byte r. */
+        r?: string;
+        /** ECDSA only. Lowercase-hex 32-byte s. */
+        s?: string;
+        /** ECDSA only. 0..3. */
+        recovery_id?: number;
+        /** Ed25519 only. Lowercase-hex 64-byte signature. */
+        signature?: string;
+    };
+}
+declare class EphemeralSignerSignError extends Error {
+    readonly status?: number | undefined;
+    readonly body?: string | undefined;
+    constructor(message: string, status?: number | undefined, body?: string | undefined);
+}
+declare function signWithEphemeralSigner(input: EphemeralSignerSignInput): Promise<EphemeralSignerSignResult>;
+
+export { type AssertPasskeyInParentResult, EphemeralSignerSignError, type EphemeralSignerSignInput, type EphemeralSignerSignResult, type GetInternalPresenceTokensResult, type GetPresenceTokenResult, KvStorage, type LoginWithCodeParams, PasskeyAssertor, RelyingPartyOriginInput, type ScopedPresenceToken, type SendCodeParams, Transport, type VerifyOAuthParams, assertPasskeyInParent, flattenPresenceTokens, getHeadlessAuthenticationMethods, getHeadlessEthereumMethods, getHeadlessGeneralMethods, getHeadlessSolanaMethods, getInternalPresenceTokens, getPresenceToken, signWithEphemeralSigner };

package/dist/sdk/index.js

@@ -30,6 +30,7 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/sdk/index.ts
 var sdk_exports = {};
 __export(sdk_exports, {
+  EphemeralSignerSignError: () => EphemeralSignerSignError,
   assertPasskeyInParent: () => assertPasskeyInParent,
   flattenPresenceTokens: () => flattenPresenceTokens,
   getHeadlessAuthenticationMethods: () => getHeadlessAuthenticationMethods,
@@ -37,10 +38,15 @@ __export(sdk_exports, {
   getHeadlessGeneralMethods: () => getHeadlessGeneralMethods,
   getHeadlessSolanaMethods: () => getHeadlessSolanaMethods,
   getInternalPresenceTokens: () => getInternalPresenceTokens,
-  getPresenceToken: () => getPresenceToken
+  getPresenceToken: () => getPresenceToken,
+  resolveRelyingPartyOrigin: () => resolveRelyingPartyOrigin,
+  signWithEphemeralSigner: () => signWithEphemeralSigner
 });
 module.exports = __toCommonJS(sdk_exports);
 
+// src/sdk/interfaces.ts
+var resolveRelyingPartyOrigin = async (input) => typeof input === "function" ? input() : input;
+
 // src/lib/auth/authentication-state.ts
 var AuthenticationState = class {
   constructor() {
@@ -244,6 +250,20 @@ var PostMessageMethod = {
   // dispatcher boring.
   SIGN_HASH: "SIGN_HASH",
   SIGN_7702_AUTHORIZATION: "SIGN_7702_AUTHORIZATION",
+  // Provision a SES (Secure Ephemeral Signer) over one or more of the
+  // user's MPC wallets. Iframe verifies the Nitro attestation, decrypts
+  // the selected keyshares, HPKE-seals them to the verified enclave
+  // pubkey, and returns a freshly-generated Ed25519 signer keypair.
+  // MoonX never persists the private key — the parent must hand it to
+  // the user immediately.
+  PROVISION_EPHEMERAL_SIGNER: "PROVISION_EPHEMERAL_SIGNER",
+  // List the user's active provisioned ephemeral signers from the
+  // wallets backend. Read-only; doesn't touch SES or the enclave.
+  LIST_EPHEMERAL_SIGNERS: "LIST_EPHEMERAL_SIGNERS",
+  // Soft-revoke a previously-provisioned ephemeral signer. The wallets
+  // backend updates revoked_at locally and forwards the revoke to SES
+  // so the enclave drops the policy.
+  REVOKE_EPHEMERAL_SIGNER: "REVOKE_EPHEMERAL_SIGNER",
   VERIFY_EMAIL_OTP: "VERIFY_EMAIL_OTP",
   VERIFY_OAUTH: "VERIFY_OAUTH",
   START_OAUTH: "START_OAUTH",
@@ -329,10 +349,11 @@ var getPresenceToken = async ({
   publishableKey,
   relyingPartyOrigin
 }) => {
+  const rpOrigin = await resolveRelyingPartyOrigin(relyingPartyOrigin);
   const { token, optionsJSON } = await transport.send(
     PostMessageType.AUTH,
     PostMessageMethod.PASSKEY_PRESENCE_BEGIN,
-    { publishableKey, relyingPartyOrigin }
+    { publishableKey, relyingPartyOrigin: rpOrigin }
   );
   const response = await passkey.assertForServer({ optionsJSON });
   const verify = await transport.send(
@@ -340,7 +361,7 @@ var getPresenceToken = async ({
     PostMessageMethod.PASSKEY_PRESENCE_VERIFY,
     {
       publishableKey,
-      relyingPartyOrigin,
+      relyingPartyOrigin: rpOrigin,
       token,
       response
     }
@@ -357,32 +378,46 @@ var getInternalPresenceTokens = async ({
   passkey,
   publishableKey,
   relyingPartyOrigin,
-  scopes
+  scopes,
+  scopeCounts
 }) => {
+  const rpOrigin = await resolveRelyingPartyOrigin(relyingPartyOrigin);
   const { token, optionsJSON } = await transport.send(
     PostMessageType.AUTH,
     PostMessageMethod.PASSKEY_PRESENCE_BEGIN,
-    { publishableKey, relyingPartyOrigin }
+    { publishableKey, relyingPartyOrigin: rpOrigin }
   );
   const { response, userHandleB64url, credentialIdB64url } = await passkey.assertForInternalPresence({ optionsJSON });
+  const verifyPayload = {
+    publishableKey,
+    relyingPartyOrigin: rpOrigin,
+    token,
+    response,
+    purpose: "internal"
+  };
+  if (scopes && scopes.length > 0) verifyPayload.scopes = scopes;
+  if (scopeCounts && Object.keys(scopeCounts).length > 0) {
+    verifyPayload.scope_counts = scopeCounts;
+  }
   const verify = await transport.send(
     PostMessageType.AUTH,
     PostMessageMethod.PASSKEY_PRESENCE_VERIFY,
-    {
-      publishableKey,
-      relyingPartyOrigin,
-      token,
-      response,
-      purpose: "internal",
-      scopes
-    }
+    verifyPayload
   );
   const out = {};
   for (const [scope, t] of Object.entries(verify.tokens ?? {})) {
     out[scope] = { token: t.token, expiresAt: t.expires_at };
   }
+  const outBatches = {};
+  for (const [scope, batch] of Object.entries(verify.token_batches ?? {})) {
+    outBatches[scope] = batch.map((t) => ({
+      token: t.token,
+      expiresAt: t.expires_at
+    }));
+  }
   return {
     tokens: out,
+    tokenBatches: outBatches,
     userHandleB64url,
     credentialIdB64url
   };
@@ -829,6 +864,8 @@ var getHeadlessAuthenticationMethods = ({
 var SCOPES_CREATE_WALLET = ["dek_bootstrap", "keyshare_write"];
 var SCOPES_IMPORT_KEY = ["dek_bootstrap", "keyshare_write"];
 var SCOPES_REMOVE_PASSKEY = ["passkey_remove"];
+var SCOPES_PROVISION_EPHEMERAL_SIGNER = ["keyshare_read"];
+var SCOPES_REVOKE_EPHEMERAL_SIGNER = ["ephemeral_signer_revoke"];
 var getHeadlessGeneralMethods = ({
   transport,
   passkey,
@@ -844,7 +881,11 @@ var getHeadlessGeneralMethods = ({
     { publishableKey }
   ),
   removePasskey: async (credentialIdB64url) => {
-    const { tokens, userHandleB64url, credentialIdB64url: assertedCredId } = await getInternalPresenceTokens({
+    const {
+      tokens,
+      userHandleB64url,
+      credentialIdB64url: assertedCredId
+    } = await getInternalPresenceTokens({
       transport,
       passkey,
       publishableKey,
@@ -917,6 +958,83 @@ var getHeadlessGeneralMethods = ({
     );
     return { wallet };
   },
+  provisionEphemeralSigner: async (params) => {
+    const walletCount = params.walletIds.length;
+    if (walletCount === 0) {
+      throw new Error(
+        "provisionEphemeralSigner: at least one walletId required"
+      );
+    }
+    const { userHandleB64url, credentialIdB64url, tokenBatches } = await getInternalPresenceTokens({
+      transport,
+      passkey,
+      publishableKey,
+      relyingPartyOrigin,
+      scopeCounts: { [SCOPES_PROVISION_EPHEMERAL_SIGNER[0]]: walletCount }
+    });
+    const keyshareReadBatch = (tokenBatches[SCOPES_PROVISION_EPHEMERAL_SIGNER[0]] ?? []).map((t) => t.token);
+    if (keyshareReadBatch.length !== walletCount) {
+      throw new Error(
+        `provisionEphemeralSigner: server returned ${keyshareReadBatch.length} tokens, expected ${walletCount}`
+      );
+    }
+    return transport.send(
+      PostMessageType.WALLET,
+      PostMessageMethod.PROVISION_EPHEMERAL_SIGNER,
+      {
+        publishableKey,
+        userHandleB64url,
+        credentialIdB64url,
+        // One keyshare_read token per wallet, parallel to params.walletIds
+        // (iframe consumes them positionally after wallet resolution).
+        presenceTokenBatches: {
+          [SCOPES_PROVISION_EPHEMERAL_SIGNER[0]]: keyshareReadBatch
+        },
+        walletIds: params.walletIds,
+        expiresAt: params.expiresAt?.toISOString(),
+        label: params.label
+      }
+    );
+  },
+  // Read-only: list the user's active (non-revoked) provisioned agents
+  // for the current app. No WebAuthn ceremony needed — the wallet
+  // session JWT is enough since this exposes only metadata (api_pub,
+  // key_ids, expiry) and not the private agent material.
+  listEphemeralSigners: async () => {
+    return transport.send(
+      PostMessageType.WALLET,
+      PostMessageMethod.LIST_EPHEMERAL_SIGNERS,
+      { publishableKey }
+    );
+  },
+  // Soft-revoke a signer (and forward the revoke to SES). Requires a
+  // fresh WebAuthn-bound presence token: ephemeral_signer_revoke scope. Wallet JWT
+  // alone isn't enough because revoke is destructive (DoS-grade) — the
+  // presence proof confirms it's really the user driving it.
+  revokeEphemeralSigner: async (params) => {
+    const { userHandleB64url, credentialIdB64url, tokens } = await getInternalPresenceTokens({
+      transport,
+      passkey,
+      publishableKey,
+      relyingPartyOrigin,
+      scopes: SCOPES_REVOKE_EPHEMERAL_SIGNER
+    });
+    await transport.send(
+      PostMessageType.WALLET,
+      PostMessageMethod.REVOKE_EPHEMERAL_SIGNER,
+      {
+        publishableKey,
+        apiPubHex: params.apiPubHex,
+        userHandleB64url,
+        credentialIdB64url,
+        presenceTokens: flattenPresenceTokens({
+          tokens,
+          userHandleB64url,
+          credentialIdB64url
+        })
+      }
+    );
+  },
   getWallets: async (walletType) => {
     const { wallets } = await transport.send(
       PostMessageType.WALLET,
@@ -933,11 +1051,9 @@ var getHeadlessGeneralMethods = ({
   // silently extend session lifetime.
   getSessionTokens: async () => {
     try {
-      const session = await transport.send(
-        PostMessageType.AUTH,
-        PostMessageMethod.GET_CURRENT_SESSION,
-        { publishableKey }
-      );
+      const session = await transport.send(PostMessageType.AUTH, PostMessageMethod.GET_CURRENT_SESSION, {
+        publishableKey
+      });
       return session ? {
         accessToken: session.accessToken,
         identityToken: session.identityToken,
@@ -1001,8 +1117,150 @@ var getHeadlessGeneralMethods = ({
     }
   }
 });
+
+// src/sdk/ephemeral-signer-sign.ts
+var import_ed25519 = require("@noble/curves/ed25519");
+var import_utils = require("@noble/hashes/utils");
+function normalizeBase(url) {
+  return url.replace(/\/+$/, "");
+}
+var EphemeralSignerSignError = class extends Error {
+  constructor(message, status, body) {
+    super(message);
+    this.status = status;
+    this.body = body;
+    this.name = "EphemeralSignerSignError";
+  }
+};
+var bindingsCache = /* @__PURE__ */ new Map();
+async function resolveBinding(input) {
+  const cached = bindingsCache.get(input.apiPubHex);
+  if (cached) {
+    const hit2 = cached.find((b) => b.walletId === input.walletId);
+    if (hit2) return hit2;
+  }
+  const issuedAt = (/* @__PURE__ */ new Date()).toISOString();
+  const signedBodyBytes = new TextEncoder().encode(
+    JSON.stringify({ issued_at: issuedAt })
+  );
+  const apiPrivBytes = (0, import_utils.hexToBytes)(input.apiPrivHex);
+  const agentSig = import_ed25519.ed25519.sign(signedBodyBytes, apiPrivBytes);
+  const url = `${normalizeBase(input.baseUrl)}/v0/wallets/ephemeral-signers/me/wallets`;
+  const fetchFn = input.fetchImpl ?? fetch;
+  let response;
+  try {
+    response = await fetchFn(url, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        Authorization: `PublicToken ${input.publishableKey}`
+      },
+      body: JSON.stringify({
+        api_pub: input.apiPubHex,
+        signed_body: (0, import_utils.bytesToHex)(signedBodyBytes),
+        agent_signature: (0, import_utils.bytesToHex)(agentSig)
+      })
+    });
+  } catch (e) {
+    throw new EphemeralSignerSignError(
+      `wallet binding fetch failed: ${e instanceof Error ? e.message : String(e)}`
+    );
+  }
+  if (!response.ok) {
+    const body = await response.text().catch(() => "");
+    throw new EphemeralSignerSignError(
+      `wallet binding fetch failed: ${response.status}`,
+      response.status,
+      body
+    );
+  }
+  const json = await response.json();
+  const bindings = json.wallets.map((w) => ({
+    walletId: w.wallet_id,
+    keyId: w.key_id,
+    derivationPath: w.derivation_path
+  }));
+  bindingsCache.set(input.apiPubHex, bindings);
+  const hit = bindings.find((b) => b.walletId === input.walletId);
+  if (!hit) {
+    throw new EphemeralSignerSignError(
+      `walletId ${input.walletId} is not authorized for this agent`
+    );
+  }
+  return hit;
+}
+async function signWithEphemeralSigner(input) {
+  if (!/^[0-9a-f]{64}$/i.test(input.apiPubHex)) {
+    throw new EphemeralSignerSignError(
+      "apiPubHex must be 64 lowercase hex chars (32-byte Ed25519 pubkey)"
+    );
+  }
+  if (!/^[0-9a-f]{64}$/i.test(input.apiPrivHex)) {
+    throw new EphemeralSignerSignError(
+      "apiPrivHex must be 64 lowercase hex chars (32-byte Ed25519 privkey)"
+    );
+  }
+  if (!input.walletId) {
+    throw new EphemeralSignerSignError("walletId is required");
+  }
+  if (!input.rawSigningPayloadHex || !/^[0-9a-f]+$/i.test(input.rawSigningPayloadHex)) {
+    throw new EphemeralSignerSignError(
+      "rawSigningPayloadHex must be a non-empty lowercase hex string"
+    );
+  }
+  if (!input.publishableKey) {
+    throw new EphemeralSignerSignError(
+      "publishableKey is required \u2014 wallets backend gates /ephemeral-signers/* with RequirePublicToken"
+    );
+  }
+  const binding = await resolveBinding(input);
+  const issuedAt = (input.issuedAt ?? /* @__PURE__ */ new Date()).toISOString();
+  const signedPayload = {
+    raw_signing_payload: input.rawSigningPayloadHex,
+    key_id: binding.keyId,
+    derivation_path: binding.derivationPath,
+    issued_at: issuedAt
+  };
+  const signedBodyBytes = new TextEncoder().encode(
+    JSON.stringify(signedPayload)
+  );
+  const apiPrivBytes = (0, import_utils.hexToBytes)(input.apiPrivHex);
+  const agentSig = import_ed25519.ed25519.sign(signedBodyBytes, apiPrivBytes);
+  const requestBody = {
+    api_pub: input.apiPubHex,
+    signed_body: (0, import_utils.bytesToHex)(signedBodyBytes),
+    agent_signature: (0, import_utils.bytesToHex)(agentSig)
+  };
+  const url = `${normalizeBase(input.baseUrl)}/v0/wallets/ephemeral-signers/sign`;
+  const fetchFn = input.fetchImpl ?? fetch;
+  let response;
+  try {
+    response = await fetchFn(url, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        Authorization: `PublicToken ${input.publishableKey}`
+      },
+      body: JSON.stringify(requestBody)
+    });
+  } catch (e) {
+    throw new EphemeralSignerSignError(
+      `transport failure: ${e instanceof Error ? e.message : String(e)}`
+    );
+  }
+  if (!response.ok) {
+    const body = await response.text().catch(() => "");
+    throw new EphemeralSignerSignError(
+      `ephemeral signer sign failed: ${response.status}`,
+      response.status,
+      body
+    );
+  }
+  return await response.json();
+}
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  EphemeralSignerSignError,
   assertPasskeyInParent,
   flattenPresenceTokens,
   getHeadlessAuthenticationMethods,
@@ -1010,5 +1268,7 @@ var getHeadlessGeneralMethods = ({
   getHeadlessGeneralMethods,
   getHeadlessSolanaMethods,
   getInternalPresenceTokens,
-  getPresenceToken
+  getPresenceToken,
+  resolveRelyingPartyOrigin,
+  signWithEphemeralSigner
 });