@moon-x/core 0.7.0 → 0.9.0

package/dist/{chunk-JU5MWLXH.mjs → chunk-KRZVIDBQ.mjs}

@@ -177,8 +177,11 @@ var sendReactNativeReply = (response) => {
   } catch {
   }
 };
+var QUEUE_TTL_MS = 2e4;
+var MAX_PENDING_PER_KEY = 16;
 var PostMessageServer = class {
   constructor(originValidator) {
+    this.pending = /* @__PURE__ */ new Map();
     this.trustedSources = /* @__PURE__ */ new Set();
     this.handlers = /* @__PURE__ */ new Map();
     this.originValidator = originValidator;
@@ -193,6 +196,20 @@ var PostMessageServer = class {
   register(type, method, handler) {
     const key = `${type}:${method}`;
     this.handlers.set(key, handler);
+    const queued = this.pending.get(key);
+    if (queued?.length) {
+      this.pending.delete(key);
+      const now = Date.now();
+      for (const { request, reply, at } of queued) {
+        if (now - at < QUEUE_TTL_MS) {
+          void this.invokeHandler(
+            handler,
+            request,
+            reply
+          );
+        }
+      }
+    }
   }
   cleanup() {
     window.removeEventListener("message", this.handleMessage.bind(this));
@@ -257,29 +274,57 @@ var PostMessageServer = class {
     const key = `${request.type}:${request.method}`;
     const handler = this.handlers.get(key);
     if (handler) {
-      try {
-        const data = await handler(request.payload);
-        reply({
-          id: request.id,
-          type: request.type,
-          success: true,
-          data
-        });
-      } catch (error) {
-        const extras = {};
-        if (error && typeof error === "object") {
-          for (const key2 of FORWARDED_ERROR_FIELDS) {
-            const value = error[key2];
-            if (value !== void 0) extras[key2] = value;
-          }
+      await this.invokeHandler(handler, request, reply);
+    } else {
+      this.bufferRequest(key, request, reply);
+    }
+  }
+  async invokeHandler(handler, request, reply) {
+    try {
+      const data = await handler(request.payload);
+      reply({
+        id: request.id,
+        type: request.type,
+        success: true,
+        data
+      });
+    } catch (error) {
+      const extras = {};
+      if (error && typeof error === "object") {
+        for (const key of FORWARDED_ERROR_FIELDS) {
+          const value = error[key];
+          if (value !== void 0) extras[key] = value;
         }
-        reply({
-          ...extras,
-          id: request.id,
-          type: request.type,
-          success: false,
-          error: error instanceof Error ? error.message : "Unknown error"
-        });
+      }
+      reply({
+        ...extras,
+        id: request.id,
+        type: request.type,
+        success: false,
+        error: error instanceof Error ? error.message : "Unknown error"
+      });
+    }
+  }
+  bufferRequest(key, request, reply) {
+    this.evictExpiredPending();
+    let queue = this.pending.get(key);
+    if (!queue) {
+      queue = [];
+      this.pending.set(key, queue);
+    }
+    queue.push({ request, reply, at: Date.now() });
+    if (queue.length > MAX_PENDING_PER_KEY) {
+      queue.splice(0, queue.length - MAX_PENDING_PER_KEY);
+    }
+  }
+  evictExpiredPending() {
+    const now = Date.now();
+    for (const [key, queue] of this.pending) {
+      const fresh = queue.filter((e) => now - e.at < QUEUE_TTL_MS);
+      if (fresh.length) {
+        this.pending.set(key, fresh);
+      } else {
+        this.pending.delete(key);
       }
     }
   }

package/dist/index.d.mts

@@ -1,3 +1,3 @@
-export { AccessTokenClaims, AppConfigRequest, AppConfigResponse, AttachOAuthTokenRequest, AttachOAuthTokenResponse, AuthAppearance, AuthFlow, AuthFlowComponent, AuthLoginMethod, AuthProviderConfig, BaseGetBalanceParams, BaseGetBalanceResult, BaseGetTokenAccountsParams, BaseSendTransactionParams, BaseSendTransactionResult, BaseSignMessageParams, BaseSignMessageResult, BaseSignTransactionParams, BaseSignTransactionResult, BaseTokenClaims, BaseUIOptions, BaseWalletHooks, BlockExplorer, Chain, ChainLikeWithId, ContractUIOptions, CreateWalletResponse, DefaultFundingMethod, DeleteSessionRequest, DeleteSessionResponse, DetachOAuthTokenRequest, DeviceFingerprint, DisplayMode, EmailOtpConfig, EmailOtpFlowState, EphemeralSigner, EphemeralSignerChain, EphemeralSignerScheme, EphemeralSignerWallet, EthereumChainConfig, EthereumFundingConfig, EthereumGetBalanceParams, EthereumGetBalanceResult, EthereumGetTokenAccountsByOwnerParams, EthereumGetTokenAccountsByOwnerResult, EthereumSendTransactionParams, EthereumSendTransactionRequest, EthereumSendTransactionResult, EthereumSign7702AuthorizationParams, EthereumSign7702AuthorizationResult, EthereumSignHashParams, EthereumSignHashResult, EthereumSignMessageParams, EthereumSignMessageResult, EthereumSignTransactionParams, EthereumSignTransactionResult, EthereumSignTypedDataParams, EthereumSignTypedDataResult, EthereumSwitchChainParams, ExportKeyConfig, Factor, FlexibleTheme, FundWalletConfig, FundingEvents, FundingMethod, FundingUIConfig, GetCurrentSessionRequest, GetCurrentSessionResponse, Hex, IdentityTokenClaims, IdpProvider, IsAuthenticatedRequest, IsAuthenticatedResponse, ListEphemeralSignersResult, LoginTokenBundle, LogoutRequest, LogoutResponse, MessageTypeProperty, MessageTypes, MoonKeyThemeConfig, MoonPaySignRequest, MoonPaySignResponse, MpcKeyShares, NativeCurrency, Network, OAuthRequest, OAuthResponse, OnrampFundingSettings, PasskeyEnrollConfig, PasskeySettings, PreferredCardProvider, PrefillConfig, PresenceTokenClaims, ProvisionEphemeralSignerParams, ProvisionEphemeralSignerResult, PublicEthereumWallet, PublicSessionData, PublicWallet, RefreshSessionRequest, RefreshSessionResponse, RetrieveWalletKeyRequest, RetrieveWalletKeyResponse, RevokeEphemeralSignerParams, RpcConfig, RpcUrls, SdkSettings, SendEmailOtpRequest, SendEmailOtpResponse, SendTransactionConfig, SendTransactionRequest, SessionData, SharesDeviceRequest, SharesDeviceResponse, Sign7702AuthorizationError, Sign7702AuthorizationParams, Sign7702AuthorizationResponse, Sign7702AuthorizationResult, SignMessageConfig, SignTransactionConfig, SignTypedDataError, SignTypedDataParams, SignTypedDataResponse, SignTypedDataResult, SmsSettings, SolanaChain, SolanaFundingConfig, SolanaGetBalanceParams, SolanaGetBalanceResult, SolanaGetTokenAccountsByOwnerParams, SolanaGetTokenAccountsByOwnerResult, SolanaSendTransactionParams, SolanaSendTransactionResult, SolanaSignMessageParams, SolanaSignMessageResult, SolanaSignTransactionParams, SolanaSignTransactionResult, TransactionCommitment, TransactionEncoding, TransactionUIOptions, TypedMessage, UseFundWalletInterface, UsersMePublicResponse, UsersMeRequest, UsersMeResponse, VerifiedSession, VerifyEmailOtpRequest, VerifyEmailOtpResponse, VerifyEmailOtpUser, VerifyOAuthTokenRequest, VerifyOAuthTokenResponse, VerifySiweWalletRegistrationRequest, WALLET_ERROR_CODES, Wallet, WalletChain, WalletChainType, WalletConnectConfig, WalletCreationError, WalletError, WalletErrorCode, WalletKeyRequest, WalletListEntry, WalletRegistrationNonceRequest, WalletRegistrationNonceResponse, WalletType, WalletVerifyRequest } from './types/index.mjs';
+export { AccessTokenClaims, AppConfigRequest, AppConfigResponse, AttachOAuthTokenRequest, AttachOAuthTokenResponse, AuthAppearance, AuthFlow, AuthFlowComponent, AuthLoginMethod, AuthProviderConfig, BaseGetBalanceParams, BaseGetBalanceResult, BaseGetTokenAccountsParams, BaseSendTransactionParams, BaseSendTransactionResult, BaseSignMessageParams, BaseSignMessageResult, BaseSignTransactionParams, BaseSignTransactionResult, BaseTokenClaims, BaseUIOptions, BaseWalletHooks, BlockExplorer, Chain, ChainLikeWithId, ContractUIOptions, CreateWalletResponse, DefaultFundingMethod, DeleteSessionRequest, DeleteSessionResponse, DetachOAuthTokenRequest, DeviceFingerprint, DisplayMode, EmailOtpConfig, EmailOtpFlowState, EphemeralSigner, EphemeralSignerChain, EphemeralSignerScheme, EphemeralSignerWallet, EthereumChainConfig, EthereumFundingConfig, EthereumGetBalanceParams, EthereumGetBalanceResult, EthereumGetTokenAccountsByOwnerParams, EthereumGetTokenAccountsByOwnerResult, EthereumSendTransactionParams, EthereumSendTransactionRequest, EthereumSendTransactionResult, EthereumSign7702AuthorizationParams, EthereumSign7702AuthorizationResult, EthereumSignHashParams, EthereumSignHashResult, EthereumSignMessageParams, EthereumSignMessageResult, EthereumSignTransactionParams, EthereumSignTransactionResult, EthereumSignTypedDataParams, EthereumSignTypedDataResult, EthereumSwitchChainParams, ExportKeyConfig, Factor, FlexibleTheme, FundWalletConfig, FundingEvents, FundingMethod, FundingUIConfig, GetCurrentSessionRequest, GetCurrentSessionResponse, Hex, IdentityTokenClaims, IdpProvider, IsAuthenticatedRequest, IsAuthenticatedResponse, ListEphemeralSignersResult, LoginTokenBundle, LogoutRequest, LogoutResponse, MessageTypeProperty, MessageTypes, MoonKeyThemeConfig, MoonPaySignRequest, MoonPaySignResponse, MpcKeyShares, NativeCurrency, Network, OAuthRequest, OAuthResponse, OnrampFundingSettings, PasskeyEnrollConfig, PasskeySettings, PreferredCardProvider, PrefillConfig, PresenceTokenClaims, ProvisionEphemeralSignerParams, ProvisionEphemeralSignerResult, PublicEthereumWallet, PublicSessionData, PublicWallet, RefreshSessionRequest, RefreshSessionResponse, RetrieveWalletKeyRequest, RetrieveWalletKeyResponse, RevokeEphemeralSignerParams, RpcConfig, RpcUrls, SdkSettings, SendEmailOtpRequest, SendEmailOtpResponse, SendTransactionConfig, SendTransactionRequest, SessionData, SessionWallet, SharesDeviceRequest, SharesDeviceResponse, Sign7702AuthorizationError, Sign7702AuthorizationParams, Sign7702AuthorizationResponse, Sign7702AuthorizationResult, SignMessageConfig, SignTransactionConfig, SignTypedDataError, SignTypedDataParams, SignTypedDataResponse, SignTypedDataResult, SmsSettings, SolanaChain, SolanaFundingConfig, SolanaGetBalanceParams, SolanaGetBalanceResult, SolanaGetTokenAccountsByOwnerParams, SolanaGetTokenAccountsByOwnerResult, SolanaSendTransactionParams, SolanaSendTransactionResult, SolanaSignMessageParams, SolanaSignMessageResult, SolanaSignTransactionParams, SolanaSignTransactionResult, TransactionCommitment, TransactionEncoding, TransactionUIOptions, TypedMessage, UseFundWalletInterface, UsersMePublicResponse, UsersMeRequest, UsersMeResponse, VerifiedSession, VerifyEmailOtpRequest, VerifyEmailOtpResponse, VerifyEmailOtpUser, VerifyOAuthTokenRequest, VerifyOAuthTokenResponse, VerifySiweWalletRegistrationRequest, WALLET_ERROR_CODES, Wallet, WalletChain, WalletChainType, WalletConnectConfig, WalletCreationError, WalletError, WalletErrorCode, WalletKeyRequest, WalletListEntry, WalletRegistrationNonceRequest, WalletRegistrationNonceResponse, WalletType, WalletVerifyRequest } from './types/index.mjs';
 export { getIframeOrigin, getIframeUrl, getMoonKeyApiUrl } from './utils/index.mjs';
-export { F as FORWARDED_ERROR_FIELDS, P as PostMessageClient, a as PostMessageMethod, b as PostMessageServer, c as PostMessageType } from './post-message-Z6cLf0mS.mjs';
+export { F as FORWARDED_ERROR_FIELDS, P as PostMessageClient, a as PostMessageMethod, b as PostMessageServer, c as PostMessageType } from './post-message-2NAnU0Lf.mjs';

package/dist/index.d.ts

@@ -1,3 +1,3 @@
-export { AccessTokenClaims, AppConfigRequest, AppConfigResponse, AttachOAuthTokenRequest, AttachOAuthTokenResponse, AuthAppearance, AuthFlow, AuthFlowComponent, AuthLoginMethod, AuthProviderConfig, BaseGetBalanceParams, BaseGetBalanceResult, BaseGetTokenAccountsParams, BaseSendTransactionParams, BaseSendTransactionResult, BaseSignMessageParams, BaseSignMessageResult, BaseSignTransactionParams, BaseSignTransactionResult, BaseTokenClaims, BaseUIOptions, BaseWalletHooks, BlockExplorer, Chain, ChainLikeWithId, ContractUIOptions, CreateWalletResponse, DefaultFundingMethod, DeleteSessionRequest, DeleteSessionResponse, DetachOAuthTokenRequest, DeviceFingerprint, DisplayMode, EmailOtpConfig, EmailOtpFlowState, EphemeralSigner, EphemeralSignerChain, EphemeralSignerScheme, EphemeralSignerWallet, EthereumChainConfig, EthereumFundingConfig, EthereumGetBalanceParams, EthereumGetBalanceResult, EthereumGetTokenAccountsByOwnerParams, EthereumGetTokenAccountsByOwnerResult, EthereumSendTransactionParams, EthereumSendTransactionRequest, EthereumSendTransactionResult, EthereumSign7702AuthorizationParams, EthereumSign7702AuthorizationResult, EthereumSignHashParams, EthereumSignHashResult, EthereumSignMessageParams, EthereumSignMessageResult, EthereumSignTransactionParams, EthereumSignTransactionResult, EthereumSignTypedDataParams, EthereumSignTypedDataResult, EthereumSwitchChainParams, ExportKeyConfig, Factor, FlexibleTheme, FundWalletConfig, FundingEvents, FundingMethod, FundingUIConfig, GetCurrentSessionRequest, GetCurrentSessionResponse, Hex, IdentityTokenClaims, IdpProvider, IsAuthenticatedRequest, IsAuthenticatedResponse, ListEphemeralSignersResult, LoginTokenBundle, LogoutRequest, LogoutResponse, MessageTypeProperty, MessageTypes, MoonKeyThemeConfig, MoonPaySignRequest, MoonPaySignResponse, MpcKeyShares, NativeCurrency, Network, OAuthRequest, OAuthResponse, OnrampFundingSettings, PasskeyEnrollConfig, PasskeySettings, PreferredCardProvider, PrefillConfig, PresenceTokenClaims, ProvisionEphemeralSignerParams, ProvisionEphemeralSignerResult, PublicEthereumWallet, PublicSessionData, PublicWallet, RefreshSessionRequest, RefreshSessionResponse, RetrieveWalletKeyRequest, RetrieveWalletKeyResponse, RevokeEphemeralSignerParams, RpcConfig, RpcUrls, SdkSettings, SendEmailOtpRequest, SendEmailOtpResponse, SendTransactionConfig, SendTransactionRequest, SessionData, SharesDeviceRequest, SharesDeviceResponse, Sign7702AuthorizationError, Sign7702AuthorizationParams, Sign7702AuthorizationResponse, Sign7702AuthorizationResult, SignMessageConfig, SignTransactionConfig, SignTypedDataError, SignTypedDataParams, SignTypedDataResponse, SignTypedDataResult, SmsSettings, SolanaChain, SolanaFundingConfig, SolanaGetBalanceParams, SolanaGetBalanceResult, SolanaGetTokenAccountsByOwnerParams, SolanaGetTokenAccountsByOwnerResult, SolanaSendTransactionParams, SolanaSendTransactionResult, SolanaSignMessageParams, SolanaSignMessageResult, SolanaSignTransactionParams, SolanaSignTransactionResult, TransactionCommitment, TransactionEncoding, TransactionUIOptions, TypedMessage, UseFundWalletInterface, UsersMePublicResponse, UsersMeRequest, UsersMeResponse, VerifiedSession, VerifyEmailOtpRequest, VerifyEmailOtpResponse, VerifyEmailOtpUser, VerifyOAuthTokenRequest, VerifyOAuthTokenResponse, VerifySiweWalletRegistrationRequest, WALLET_ERROR_CODES, Wallet, WalletChain, WalletChainType, WalletConnectConfig, WalletCreationError, WalletError, WalletErrorCode, WalletKeyRequest, WalletListEntry, WalletRegistrationNonceRequest, WalletRegistrationNonceResponse, WalletType, WalletVerifyRequest } from './types/index.js';
+export { AccessTokenClaims, AppConfigRequest, AppConfigResponse, AttachOAuthTokenRequest, AttachOAuthTokenResponse, AuthAppearance, AuthFlow, AuthFlowComponent, AuthLoginMethod, AuthProviderConfig, BaseGetBalanceParams, BaseGetBalanceResult, BaseGetTokenAccountsParams, BaseSendTransactionParams, BaseSendTransactionResult, BaseSignMessageParams, BaseSignMessageResult, BaseSignTransactionParams, BaseSignTransactionResult, BaseTokenClaims, BaseUIOptions, BaseWalletHooks, BlockExplorer, Chain, ChainLikeWithId, ContractUIOptions, CreateWalletResponse, DefaultFundingMethod, DeleteSessionRequest, DeleteSessionResponse, DetachOAuthTokenRequest, DeviceFingerprint, DisplayMode, EmailOtpConfig, EmailOtpFlowState, EphemeralSigner, EphemeralSignerChain, EphemeralSignerScheme, EphemeralSignerWallet, EthereumChainConfig, EthereumFundingConfig, EthereumGetBalanceParams, EthereumGetBalanceResult, EthereumGetTokenAccountsByOwnerParams, EthereumGetTokenAccountsByOwnerResult, EthereumSendTransactionParams, EthereumSendTransactionRequest, EthereumSendTransactionResult, EthereumSign7702AuthorizationParams, EthereumSign7702AuthorizationResult, EthereumSignHashParams, EthereumSignHashResult, EthereumSignMessageParams, EthereumSignMessageResult, EthereumSignTransactionParams, EthereumSignTransactionResult, EthereumSignTypedDataParams, EthereumSignTypedDataResult, EthereumSwitchChainParams, ExportKeyConfig, Factor, FlexibleTheme, FundWalletConfig, FundingEvents, FundingMethod, FundingUIConfig, GetCurrentSessionRequest, GetCurrentSessionResponse, Hex, IdentityTokenClaims, IdpProvider, IsAuthenticatedRequest, IsAuthenticatedResponse, ListEphemeralSignersResult, LoginTokenBundle, LogoutRequest, LogoutResponse, MessageTypeProperty, MessageTypes, MoonKeyThemeConfig, MoonPaySignRequest, MoonPaySignResponse, MpcKeyShares, NativeCurrency, Network, OAuthRequest, OAuthResponse, OnrampFundingSettings, PasskeyEnrollConfig, PasskeySettings, PreferredCardProvider, PrefillConfig, PresenceTokenClaims, ProvisionEphemeralSignerParams, ProvisionEphemeralSignerResult, PublicEthereumWallet, PublicSessionData, PublicWallet, RefreshSessionRequest, RefreshSessionResponse, RetrieveWalletKeyRequest, RetrieveWalletKeyResponse, RevokeEphemeralSignerParams, RpcConfig, RpcUrls, SdkSettings, SendEmailOtpRequest, SendEmailOtpResponse, SendTransactionConfig, SendTransactionRequest, SessionData, SessionWallet, SharesDeviceRequest, SharesDeviceResponse, Sign7702AuthorizationError, Sign7702AuthorizationParams, Sign7702AuthorizationResponse, Sign7702AuthorizationResult, SignMessageConfig, SignTransactionConfig, SignTypedDataError, SignTypedDataParams, SignTypedDataResponse, SignTypedDataResult, SmsSettings, SolanaChain, SolanaFundingConfig, SolanaGetBalanceParams, SolanaGetBalanceResult, SolanaGetTokenAccountsByOwnerParams, SolanaGetTokenAccountsByOwnerResult, SolanaSendTransactionParams, SolanaSendTransactionResult, SolanaSignMessageParams, SolanaSignMessageResult, SolanaSignTransactionParams, SolanaSignTransactionResult, TransactionCommitment, TransactionEncoding, TransactionUIOptions, TypedMessage, UseFundWalletInterface, UsersMePublicResponse, UsersMeRequest, UsersMeResponse, VerifiedSession, VerifyEmailOtpRequest, VerifyEmailOtpResponse, VerifyEmailOtpUser, VerifyOAuthTokenRequest, VerifyOAuthTokenResponse, VerifySiweWalletRegistrationRequest, WALLET_ERROR_CODES, Wallet, WalletChain, WalletChainType, WalletConnectConfig, WalletCreationError, WalletError, WalletErrorCode, WalletKeyRequest, WalletListEntry, WalletRegistrationNonceRequest, WalletRegistrationNonceResponse, WalletType, WalletVerifyRequest } from './types/index.js';
 export { getIframeOrigin, getIframeUrl, getMoonKeyApiUrl } from './utils/index.js';
-export { F as FORWARDED_ERROR_FIELDS, P as PostMessageClient, a as PostMessageMethod, b as PostMessageServer, c as PostMessageType } from './post-message-Z6cLf0mS.js';
+export { F as FORWARDED_ERROR_FIELDS, P as PostMessageClient, a as PostMessageMethod, b as PostMessageServer, c as PostMessageType } from './post-message-2NAnU0Lf.js';

package/dist/index.js

@@ -303,8 +303,11 @@ var sendReactNativeReply = (response) => {
   } catch {
   }
 };
+var QUEUE_TTL_MS = 2e4;
+var MAX_PENDING_PER_KEY = 16;
 var PostMessageServer = class {
   constructor(originValidator) {
+    this.pending = /* @__PURE__ */ new Map();
     this.trustedSources = /* @__PURE__ */ new Set();
     this.handlers = /* @__PURE__ */ new Map();
     this.originValidator = originValidator;
@@ -319,6 +322,20 @@ var PostMessageServer = class {
   register(type, method, handler) {
     const key = `${type}:${method}`;
     this.handlers.set(key, handler);
+    const queued = this.pending.get(key);
+    if (queued?.length) {
+      this.pending.delete(key);
+      const now = Date.now();
+      for (const { request, reply, at } of queued) {
+        if (now - at < QUEUE_TTL_MS) {
+          void this.invokeHandler(
+            handler,
+            request,
+            reply
+          );
+        }
+      }
+    }
   }
   cleanup() {
     window.removeEventListener("message", this.handleMessage.bind(this));
@@ -383,29 +400,57 @@ var PostMessageServer = class {
     const key = `${request.type}:${request.method}`;
     const handler = this.handlers.get(key);
     if (handler) {
-      try {
-        const data = await handler(request.payload);
-        reply({
-          id: request.id,
-          type: request.type,
-          success: true,
-          data
-        });
-      } catch (error) {
-        const extras = {};
-        if (error && typeof error === "object") {
-          for (const key2 of FORWARDED_ERROR_FIELDS) {
-            const value = error[key2];
-            if (value !== void 0) extras[key2] = value;
-          }
+      await this.invokeHandler(handler, request, reply);
+    } else {
+      this.bufferRequest(key, request, reply);
+    }
+  }
+  async invokeHandler(handler, request, reply) {
+    try {
+      const data = await handler(request.payload);
+      reply({
+        id: request.id,
+        type: request.type,
+        success: true,
+        data
+      });
+    } catch (error) {
+      const extras = {};
+      if (error && typeof error === "object") {
+        for (const key of FORWARDED_ERROR_FIELDS) {
+          const value = error[key];
+          if (value !== void 0) extras[key] = value;
         }
-        reply({
-          ...extras,
-          id: request.id,
-          type: request.type,
-          success: false,
-          error: error instanceof Error ? error.message : "Unknown error"
-        });
+      }
+      reply({
+        ...extras,
+        id: request.id,
+        type: request.type,
+        success: false,
+        error: error instanceof Error ? error.message : "Unknown error"
+      });
+    }
+  }
+  bufferRequest(key, request, reply) {
+    this.evictExpiredPending();
+    let queue = this.pending.get(key);
+    if (!queue) {
+      queue = [];
+      this.pending.set(key, queue);
+    }
+    queue.push({ request, reply, at: Date.now() });
+    if (queue.length > MAX_PENDING_PER_KEY) {
+      queue.splice(0, queue.length - MAX_PENDING_PER_KEY);
+    }
+  }
+  evictExpiredPending() {
+    const now = Date.now();
+    for (const [key, queue] of this.pending) {
+      const fresh = queue.filter((e) => now - e.at < QUEUE_TTL_MS);
+      if (fresh.length) {
+        this.pending.set(key, fresh);
+      } else {
+        this.pending.delete(key);
       }
     }
   }

package/dist/index.mjs

@@ -14,7 +14,7 @@ import {
   PostMessageMethod,
   PostMessageServer,
   PostMessageType
-} from "./chunk-JU5MWLXH.mjs";
+} from "./chunk-KRZVIDBQ.mjs";
 import {
   getMoonKeyApiUrl
 } from "./chunk-GQKIA37O.mjs";

package/dist/{interfaces-BZ5GMWS9.d.ts → interfaces-B5zxo2Jx.d.ts}

@@ -1,4 +1,4 @@
-import { c as PostMessageType, a as PostMessageMethod } from './post-message-Z6cLf0mS.js';
+import { c as PostMessageType, a as PostMessageMethod } from './post-message-2NAnU0Lf.js';
 
 /**
  * Transport — the bidirectional postMessage channel between the parent

package/dist/{interfaces-BWxOajnD.d.mts → interfaces-CF5UrEBb.d.mts}

@@ -1,4 +1,4 @@
-import { c as PostMessageType, a as PostMessageMethod } from './post-message-Z6cLf0mS.mjs';
+import { c as PostMessageType, a as PostMessageMethod } from './post-message-2NAnU0Lf.mjs';
 
 /**
  * Transport — the bidirectional postMessage channel between the parent

package/dist/{post-message-Z6cLf0mS.d.ts → post-message-2NAnU0Lf.d.mts}

@@ -60,6 +60,7 @@ declare class PostMessageClient {
 }
 declare class PostMessageServer {
     private handlers;
+    private pending;
     private originValidator?;
     private trustedSources;
     constructor(originValidator?: (origin: string, publishableKey?: string) => Promise<boolean>);
@@ -70,6 +71,9 @@ declare class PostMessageServer {
     private static isLocalhostOrigin;
     private isValidPostMessageRequest;
     private handleMessage;
+    private invokeHandler;
+    private bufferRequest;
+    private evictExpiredPending;
 }
 
 export { FORWARDED_ERROR_FIELDS as F, PostMessageClient as P, PostMessageMethod as a, PostMessageServer as b, PostMessageType as c };

package/dist/{post-message-Z6cLf0mS.d.mts → post-message-2NAnU0Lf.d.ts}

@@ -60,6 +60,7 @@ declare class PostMessageClient {
 }
 declare class PostMessageServer {
     private handlers;
+    private pending;
     private originValidator?;
     private trustedSources;
     constructor(originValidator?: (origin: string, publishableKey?: string) => Promise<boolean>);
@@ -70,6 +71,9 @@ declare class PostMessageServer {
     private static isLocalhostOrigin;
     private isValidPostMessageRequest;
     private handleMessage;
+    private invokeHandler;
+    private bufferRequest;
+    private evictExpiredPending;
 }
 
 export { FORWARDED_ERROR_FIELDS as F, PostMessageClient as P, PostMessageMethod as a, PostMessageServer as b, PostMessageType as c };

package/dist/sdk/index.d.mts

@@ -1,8 +1,8 @@
-import { T as Transport, P as PasskeyAssertor, R as RelyingPartyOriginInput, K as KvStorage } from '../interfaces-BWxOajnD.mjs';
-export { O as OAuthOpener, a as PlatformImpls, W as WebAuthnAssertionResponse, b as WebAuthnRequestOptions, r as resolveRelyingPartyOrigin } from '../interfaces-BWxOajnD.mjs';
+import { T as Transport, P as PasskeyAssertor, R as RelyingPartyOriginInput, K as KvStorage } from '../interfaces-CF5UrEBb.mjs';
+export { O as OAuthOpener, a as PlatformImpls, W as WebAuthnAssertionResponse, b as WebAuthnRequestOptions, r as resolveRelyingPartyOrigin } from '../interfaces-CF5UrEBb.mjs';
 import { C as CachedAssertion } from '../passkey-cache-WnDFQ-v4.mjs';
 import { EthereumSignMessageParams, EthereumSignMessageResult, EthereumSignTransactionParams, EthereumSignTransactionResult, EthereumSignTypedDataParams, EthereumSignTypedDataResult, EthereumSignHashParams, EthereumSignHashResult, EthereumSign7702AuthorizationParams, EthereumSign7702AuthorizationResult, EthereumSendTransactionParams, EthereumSendTransactionResult, EthereumGetBalanceParams, EthereumGetBalanceResult, EthereumGetTokenAccountsByOwnerParams, EthereumGetTokenAccountsByOwnerResult, SolanaSignMessageParams, SolanaSignMessageResult, SolanaSignTransactionParams, SolanaSignTransactionResult, SolanaSendTransactionParams, SolanaSendTransactionResult, SolanaGetBalanceParams, SolanaGetBalanceResult, SolanaGetTokenAccountsByOwnerParams, SolanaGetTokenAccountsByOwnerResult, SendEmailOtpResponse, PublicWallet, ProvisionEphemeralSignerParams, ProvisionEphemeralSignerResult, ListEphemeralSignersResult, RevokeEphemeralSignerParams } from '../types/index.mjs';
-import '../post-message-Z6cLf0mS.mjs';
+import '../post-message-2NAnU0Lf.mjs';
 
 type AssertPasskeyInParentResult = CachedAssertion;
 declare const assertPasskeyInParent: ({ transport, passkey, publishableKey, validateCredentialInAllowList, }: {
@@ -178,14 +178,19 @@ interface EphemeralSignerSignInput {
     rawSigningPayloadHex: string;
     /** Defaults to now. SES rejects timestamps further than ±5 min from its clock. */
     issuedAt?: Date;
-    /** Wallets backend base URL (no trailing slash). */
-    baseUrl: string;
     /**
-     * MoonX publishable key (`moon_pk_…`). The wallets backend's
-     * /ephemeral-signers/* router group is gated by RequirePublicToken — every
-     * call needs an `Authorization: PublicToken <publishableKey>` header.
+     * Wallets backend base URL (no trailing slash). Optional — defaults to
+     * {@link DEFAULT_API_BASE_URL}, the standard MoonX deployment. Override
+     * only for local/dev or a non-default environment.
      */
-    publishableKey: string;
+    baseUrl?: string;
+    /**
+     * MoonX secret key (`moon_sk_*`). The wallets backend's server-side
+     * ephemeral-signer routes (/me/wallets, /sign) are secret-key-only
+     * (RequireSecretKey), so every call needs an `Authorization: Bearer
+     * <secretKey>` header. Server-only; never expose to the browser.
+     */
+    secretKey: string;
     /** Optional fetch override — e.g. for Next.js route handlers or test stubs. */
     fetchImpl?: typeof fetch;
 }
@@ -202,6 +207,12 @@ interface EphemeralSignerSignResult {
         signature?: string;
     };
 }
+/**
+ * Default MoonX API base URL for the ephemeral-signer routes. Matches the
+ * node-sdk's default deployment. Callers override `baseUrl` only for local
+ * development or a non-standard environment.
+ */
+declare const DEFAULT_API_BASE_URL = "https://api.moonx-dev.com";
 declare class EphemeralSignerSignError extends Error {
     readonly status?: number | undefined;
     readonly body?: string | undefined;
@@ -209,4 +220,4 @@ declare class EphemeralSignerSignError extends Error {
 }
 declare function signWithEphemeralSigner(input: EphemeralSignerSignInput): Promise<EphemeralSignerSignResult>;
 
-export { type AssertPasskeyInParentResult, EphemeralSignerSignError, type EphemeralSignerSignInput, type EphemeralSignerSignResult, type GetInternalPresenceTokensResult, type GetPresenceTokenResult, KvStorage, type LoginWithCodeParams, PasskeyAssertor, RelyingPartyOriginInput, type ScopedPresenceToken, type SendCodeParams, Transport, type VerifyOAuthParams, assertPasskeyInParent, flattenPresenceTokens, getHeadlessAuthenticationMethods, getHeadlessEthereumMethods, getHeadlessGeneralMethods, getHeadlessSolanaMethods, getInternalPresenceTokens, getPresenceToken, signWithEphemeralSigner };
+export { type AssertPasskeyInParentResult, DEFAULT_API_BASE_URL, EphemeralSignerSignError, type EphemeralSignerSignInput, type EphemeralSignerSignResult, type GetInternalPresenceTokensResult, type GetPresenceTokenResult, KvStorage, type LoginWithCodeParams, PasskeyAssertor, RelyingPartyOriginInput, type ScopedPresenceToken, type SendCodeParams, Transport, type VerifyOAuthParams, assertPasskeyInParent, flattenPresenceTokens, getHeadlessAuthenticationMethods, getHeadlessEthereumMethods, getHeadlessGeneralMethods, getHeadlessSolanaMethods, getInternalPresenceTokens, getPresenceToken, signWithEphemeralSigner };

package/dist/sdk/index.d.ts

@@ -1,8 +1,8 @@
-import { T as Transport, P as PasskeyAssertor, R as RelyingPartyOriginInput, K as KvStorage } from '../interfaces-BZ5GMWS9.js';
-export { O as OAuthOpener, a as PlatformImpls, W as WebAuthnAssertionResponse, b as WebAuthnRequestOptions, r as resolveRelyingPartyOrigin } from '../interfaces-BZ5GMWS9.js';
+import { T as Transport, P as PasskeyAssertor, R as RelyingPartyOriginInput, K as KvStorage } from '../interfaces-B5zxo2Jx.js';
+export { O as OAuthOpener, a as PlatformImpls, W as WebAuthnAssertionResponse, b as WebAuthnRequestOptions, r as resolveRelyingPartyOrigin } from '../interfaces-B5zxo2Jx.js';
 import { C as CachedAssertion } from '../passkey-cache-WnDFQ-v4.js';
 import { EthereumSignMessageParams, EthereumSignMessageResult, EthereumSignTransactionParams, EthereumSignTransactionResult, EthereumSignTypedDataParams, EthereumSignTypedDataResult, EthereumSignHashParams, EthereumSignHashResult, EthereumSign7702AuthorizationParams, EthereumSign7702AuthorizationResult, EthereumSendTransactionParams, EthereumSendTransactionResult, EthereumGetBalanceParams, EthereumGetBalanceResult, EthereumGetTokenAccountsByOwnerParams, EthereumGetTokenAccountsByOwnerResult, SolanaSignMessageParams, SolanaSignMessageResult, SolanaSignTransactionParams, SolanaSignTransactionResult, SolanaSendTransactionParams, SolanaSendTransactionResult, SolanaGetBalanceParams, SolanaGetBalanceResult, SolanaGetTokenAccountsByOwnerParams, SolanaGetTokenAccountsByOwnerResult, SendEmailOtpResponse, PublicWallet, ProvisionEphemeralSignerParams, ProvisionEphemeralSignerResult, ListEphemeralSignersResult, RevokeEphemeralSignerParams } from '../types/index.js';
-import '../post-message-Z6cLf0mS.js';
+import '../post-message-2NAnU0Lf.js';
 
 type AssertPasskeyInParentResult = CachedAssertion;
 declare const assertPasskeyInParent: ({ transport, passkey, publishableKey, validateCredentialInAllowList, }: {
@@ -178,14 +178,19 @@ interface EphemeralSignerSignInput {
     rawSigningPayloadHex: string;
     /** Defaults to now. SES rejects timestamps further than ±5 min from its clock. */
     issuedAt?: Date;
-    /** Wallets backend base URL (no trailing slash). */
-    baseUrl: string;
     /**
-     * MoonX publishable key (`moon_pk_…`). The wallets backend's
-     * /ephemeral-signers/* router group is gated by RequirePublicToken — every
-     * call needs an `Authorization: PublicToken <publishableKey>` header.
+     * Wallets backend base URL (no trailing slash). Optional — defaults to
+     * {@link DEFAULT_API_BASE_URL}, the standard MoonX deployment. Override
+     * only for local/dev or a non-default environment.
      */
-    publishableKey: string;
+    baseUrl?: string;
+    /**
+     * MoonX secret key (`moon_sk_*`). The wallets backend's server-side
+     * ephemeral-signer routes (/me/wallets, /sign) are secret-key-only
+     * (RequireSecretKey), so every call needs an `Authorization: Bearer
+     * <secretKey>` header. Server-only; never expose to the browser.
+     */
+    secretKey: string;
     /** Optional fetch override — e.g. for Next.js route handlers or test stubs. */
     fetchImpl?: typeof fetch;
 }
@@ -202,6 +207,12 @@ interface EphemeralSignerSignResult {
         signature?: string;
     };
 }
+/**
+ * Default MoonX API base URL for the ephemeral-signer routes. Matches the
+ * node-sdk's default deployment. Callers override `baseUrl` only for local
+ * development or a non-standard environment.
+ */
+declare const DEFAULT_API_BASE_URL = "https://api.moonx-dev.com";
 declare class EphemeralSignerSignError extends Error {
     readonly status?: number | undefined;
     readonly body?: string | undefined;
@@ -209,4 +220,4 @@ declare class EphemeralSignerSignError extends Error {
 }
 declare function signWithEphemeralSigner(input: EphemeralSignerSignInput): Promise<EphemeralSignerSignResult>;
 
-export { type AssertPasskeyInParentResult, EphemeralSignerSignError, type EphemeralSignerSignInput, type EphemeralSignerSignResult, type GetInternalPresenceTokensResult, type GetPresenceTokenResult, KvStorage, type LoginWithCodeParams, PasskeyAssertor, RelyingPartyOriginInput, type ScopedPresenceToken, type SendCodeParams, Transport, type VerifyOAuthParams, assertPasskeyInParent, flattenPresenceTokens, getHeadlessAuthenticationMethods, getHeadlessEthereumMethods, getHeadlessGeneralMethods, getHeadlessSolanaMethods, getInternalPresenceTokens, getPresenceToken, signWithEphemeralSigner };
+export { type AssertPasskeyInParentResult, DEFAULT_API_BASE_URL, EphemeralSignerSignError, type EphemeralSignerSignInput, type EphemeralSignerSignResult, type GetInternalPresenceTokensResult, type GetPresenceTokenResult, KvStorage, type LoginWithCodeParams, PasskeyAssertor, RelyingPartyOriginInput, type ScopedPresenceToken, type SendCodeParams, Transport, type VerifyOAuthParams, assertPasskeyInParent, flattenPresenceTokens, getHeadlessAuthenticationMethods, getHeadlessEthereumMethods, getHeadlessGeneralMethods, getHeadlessSolanaMethods, getInternalPresenceTokens, getPresenceToken, signWithEphemeralSigner };

package/dist/sdk/index.js

@@ -30,6 +30,7 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/sdk/index.ts
 var sdk_exports = {};
 __export(sdk_exports, {
+  DEFAULT_API_BASE_URL: () => DEFAULT_API_BASE_URL,
   EphemeralSignerSignError: () => EphemeralSignerSignError,
   assertPasskeyInParent: () => assertPasskeyInParent,
   flattenPresenceTokens: () => flattenPresenceTokens,
@@ -1123,6 +1124,7 @@ var getHeadlessGeneralMethods = ({
 // src/sdk/ephemeral-signer-sign.ts
 var import_ed25519 = require("@noble/curves/ed25519");
 var import_utils = require("@noble/hashes/utils");
+var DEFAULT_API_BASE_URL = "https://api.moonx-dev.com";
 function normalizeBase(url) {
   return url.replace(/\/+$/, "");
 }
@@ -1147,7 +1149,7 @@ async function resolveBinding(input) {
   );
   const apiPrivBytes = (0, import_utils.hexToBytes)(input.apiPrivHex);
   const agentSig = import_ed25519.ed25519.sign(signedBodyBytes, apiPrivBytes);
-  const url = `${normalizeBase(input.baseUrl)}/v0/wallets/ephemeral-signers/me/wallets`;
+  const url = `${normalizeBase(input.baseUrl || DEFAULT_API_BASE_URL)}/v0/wallets/ephemeral-signers/me/wallets`;
   const fetchFn = input.fetchImpl ?? fetch;
   let response;
   try {
@@ -1155,7 +1157,7 @@ async function resolveBinding(input) {
       method: "POST",
       headers: {
         "Content-Type": "application/json",
-        Authorization: `PublicToken ${input.publishableKey}`
+        Authorization: `Bearer ${input.secretKey}`
       },
       body: JSON.stringify({
         api_pub: input.apiPubHex,
@@ -1210,9 +1212,14 @@ async function signWithEphemeralSigner(input) {
       "rawSigningPayloadHex must be a non-empty lowercase hex string"
     );
   }
-  if (!input.publishableKey) {
+  if (!input.secretKey) {
     throw new EphemeralSignerSignError(
-      "publishableKey is required \u2014 wallets backend gates /ephemeral-signers/* with RequirePublicToken"
+      "secretKey is required: the wallets server-side ephemeral-signer routes (/me/wallets, /sign) are secret-key-only"
+    );
+  }
+  if (!input.secretKey.startsWith("moon_sk_")) {
+    throw new EphemeralSignerSignError(
+      "secretKey must start with 'moon_sk_' (did you pass a publishable key?)"
     );
   }
   const binding = await resolveBinding(input);
@@ -1233,7 +1240,7 @@ async function signWithEphemeralSigner(input) {
     signed_body: (0, import_utils.bytesToHex)(signedBodyBytes),
     agent_signature: (0, import_utils.bytesToHex)(agentSig)
   };
-  const url = `${normalizeBase(input.baseUrl)}/v0/wallets/ephemeral-signers/sign`;
+  const url = `${normalizeBase(input.baseUrl || DEFAULT_API_BASE_URL)}/v0/wallets/ephemeral-signers/sign`;
   const fetchFn = input.fetchImpl ?? fetch;
   let response;
   try {
@@ -1241,7 +1248,7 @@ async function signWithEphemeralSigner(input) {
       method: "POST",
       headers: {
         "Content-Type": "application/json",
-        Authorization: `PublicToken ${input.publishableKey}`
+        Authorization: `Bearer ${input.secretKey}`
       },
       body: JSON.stringify(requestBody)
     });
@@ -1262,6 +1269,7 @@ async function signWithEphemeralSigner(input) {
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  DEFAULT_API_BASE_URL,
   EphemeralSignerSignError,
   assertPasskeyInParent,
   flattenPresenceTokens,

package/dist/sdk/index.mjs

@@ -1,7 +1,7 @@
 import {
   PostMessageMethod,
   PostMessageType
-} from "../chunk-JU5MWLXH.mjs";
+} from "../chunk-KRZVIDBQ.mjs";
 import {
   arrayLikeToBytes,
   authState,
@@ -833,6 +833,7 @@ var getHeadlessGeneralMethods = ({
 // src/sdk/ephemeral-signer-sign.ts
 import { ed25519 } from "@noble/curves/ed25519";
 import { bytesToHex, hexToBytes } from "@noble/hashes/utils";
+var DEFAULT_API_BASE_URL = "https://api.moonx-dev.com";
 function normalizeBase(url) {
   return url.replace(/\/+$/, "");
 }
@@ -857,7 +858,7 @@ async function resolveBinding(input) {
   );
   const apiPrivBytes = hexToBytes(input.apiPrivHex);
   const agentSig = ed25519.sign(signedBodyBytes, apiPrivBytes);
-  const url = `${normalizeBase(input.baseUrl)}/v0/wallets/ephemeral-signers/me/wallets`;
+  const url = `${normalizeBase(input.baseUrl || DEFAULT_API_BASE_URL)}/v0/wallets/ephemeral-signers/me/wallets`;
   const fetchFn = input.fetchImpl ?? fetch;
   let response;
   try {
@@ -865,7 +866,7 @@ async function resolveBinding(input) {
       method: "POST",
       headers: {
         "Content-Type": "application/json",
-        Authorization: `PublicToken ${input.publishableKey}`
+        Authorization: `Bearer ${input.secretKey}`
       },
       body: JSON.stringify({
         api_pub: input.apiPubHex,
@@ -920,9 +921,14 @@ async function signWithEphemeralSigner(input) {
       "rawSigningPayloadHex must be a non-empty lowercase hex string"
     );
   }
-  if (!input.publishableKey) {
+  if (!input.secretKey) {
     throw new EphemeralSignerSignError(
-      "publishableKey is required \u2014 wallets backend gates /ephemeral-signers/* with RequirePublicToken"
+      "secretKey is required: the wallets server-side ephemeral-signer routes (/me/wallets, /sign) are secret-key-only"
+    );
+  }
+  if (!input.secretKey.startsWith("moon_sk_")) {
+    throw new EphemeralSignerSignError(
+      "secretKey must start with 'moon_sk_' (did you pass a publishable key?)"
     );
   }
   const binding = await resolveBinding(input);
@@ -943,7 +949,7 @@ async function signWithEphemeralSigner(input) {
     signed_body: bytesToHex(signedBodyBytes),
     agent_signature: bytesToHex(agentSig)
   };
-  const url = `${normalizeBase(input.baseUrl)}/v0/wallets/ephemeral-signers/sign`;
+  const url = `${normalizeBase(input.baseUrl || DEFAULT_API_BASE_URL)}/v0/wallets/ephemeral-signers/sign`;
   const fetchFn = input.fetchImpl ?? fetch;
   let response;
   try {
@@ -951,7 +957,7 @@ async function signWithEphemeralSigner(input) {
       method: "POST",
       headers: {
         "Content-Type": "application/json",
-        Authorization: `PublicToken ${input.publishableKey}`
+        Authorization: `Bearer ${input.secretKey}`
       },
       body: JSON.stringify(requestBody)
     });
@@ -971,6 +977,7 @@ async function signWithEphemeralSigner(input) {
   return await response.json();
 }
 export {
+  DEFAULT_API_BASE_URL,
   EphemeralSignerSignError,
   assertPasskeyInParent,
   flattenPresenceTokens,

package/dist/types/index.d.mts

@@ -49,7 +49,6 @@ interface PublicWallet {
     id: string;
     app_id: string;
     user_id: string;
-    key_id: string;
     key_share: string;
     public_address: string;
     wallet_type: WalletChain;
@@ -57,6 +56,9 @@ interface PublicWallet {
     derivation_path?: string;
     created_at: string;
 }
+interface SessionWallet extends PublicWallet {
+    key_id: string;
+}
 interface PublicEthereumWallet extends PublicWallet {
     chainId?: number;
     switchChain?: (targetChainId: number) => Promise<void>;
@@ -1148,7 +1150,7 @@ interface UsersMeResponse {
     status?: string;
     created_at?: string;
     emails: Email[];
-    wallets: PublicWallet[];
+    wallets: SessionWallet[];
 }
 interface UsersMePublicResponse {
     user_id: string;
@@ -1326,4 +1328,4 @@ interface WalletVerifyRequest {
     sessionExpiresIn: number;
 }
 
-export { type AccessTokenClaims, type AppConfigRequest, type AppConfigResponse, type AttachOAuthTokenRequest, type AttachOAuthTokenResponse, type AuthAppearance, type AuthFlow, type AuthFlowComponent, type AuthLoginMethod, type AuthProviderConfig, type BaseGetBalanceParams, type BaseGetBalanceResult, type BaseGetTokenAccountsParams, type BaseSendTransactionParams, type BaseSendTransactionResult, type BaseSignMessageParams, type BaseSignMessageResult, type BaseSignTransactionParams, type BaseSignTransactionResult, type BaseTokenClaims, type BaseUIOptions, type BaseWalletHooks, type BlockExplorer, type Chain, type ChainLikeWithId, type ContractUIOptions, type CreateWalletResponse, type DefaultFundingMethod, type DeleteSessionRequest, type DeleteSessionResponse, type DetachOAuthTokenRequest, type DeviceFingerprint, type DisplayMode, type EmailOtpConfig, type EmailOtpFlowState, type EphemeralSigner, type EphemeralSignerChain, type EphemeralSignerScheme, type EphemeralSignerWallet, type EthereumChainConfig, type EthereumFundingConfig, type EthereumGetBalanceParams, type EthereumGetBalanceResult, type EthereumGetTokenAccountsByOwnerParams, type EthereumGetTokenAccountsByOwnerResult, type EthereumSendTransactionParams, type EthereumSendTransactionRequest, type EthereumSendTransactionResult, type EthereumSign7702AuthorizationParams, type EthereumSign7702AuthorizationResult, type EthereumSignHashParams, type EthereumSignHashResult, type EthereumSignMessageParams, type EthereumSignMessageResult, type EthereumSignTransactionParams, type EthereumSignTransactionResult, type EthereumSignTypedDataParams, type EthereumSignTypedDataResult, type EthereumSwitchChainParams, type ExportKeyConfig, type Factor, type FlexibleTheme, type FundWalletConfig, type FundingEvents, type FundingMethod, type FundingUIConfig, type GetCurrentSessionRequest, type GetCurrentSessionResponse, type Hex, type IdentityTokenClaims, type IdpProvider, type IsAuthenticatedRequest, type IsAuthenticatedResponse, type ListEphemeralSignersResult, type LoginTokenBundle, type LogoutRequest, type LogoutResponse, type MessageTypeProperty, type MessageTypes, type MoonKeyThemeConfig, type MoonPaySignRequest, type MoonPaySignResponse, type MpcKeyShares, type NativeCurrency, Network, type OAuthRequest, type OAuthResponse, type OnrampFundingSettings, type PasskeyEnrollConfig, type PasskeySettings, type PreferredCardProvider, type PrefillConfig, type PresenceTokenClaims, type ProvisionEphemeralSignerParams, type ProvisionEphemeralSignerResult, type PublicEthereumWallet, type PublicSessionData, type PublicWallet, type RefreshSessionRequest, type RefreshSessionResponse, type RetrieveWalletKeyRequest, type RetrieveWalletKeyResponse, type RevokeEphemeralSignerParams, type RpcConfig, type RpcUrls, type SdkSettings, type SendEmailOtpRequest, type SendEmailOtpResponse, type SendTransactionConfig, type SendTransactionRequest, type SessionData, type SharesDeviceRequest, type SharesDeviceResponse, type Sign7702AuthorizationError, type Sign7702AuthorizationParams, type Sign7702AuthorizationResponse, type Sign7702AuthorizationResult, type SignMessageConfig, type SignTransactionConfig, type SignTypedDataError, type SignTypedDataParams, type SignTypedDataResponse, type SignTypedDataResult, type SmsSettings, type SolanaChain, type SolanaFundingConfig, type SolanaGetBalanceParams, type SolanaGetBalanceResult, type SolanaGetTokenAccountsByOwnerParams, type SolanaGetTokenAccountsByOwnerResult, type SolanaSendTransactionParams, type SolanaSendTransactionResult, type SolanaSignMessageParams, type SolanaSignMessageResult, type SolanaSignTransactionParams, type SolanaSignTransactionResult, type TransactionCommitment, type TransactionEncoding, type TransactionUIOptions, type TypedMessage, type UseFundWalletInterface, type UsersMePublicResponse, type UsersMeRequest, type UsersMeResponse, type VerifiedSession, type VerifyEmailOtpRequest, type VerifyEmailOtpResponse, type VerifyEmailOtpUser, type VerifyOAuthTokenRequest, type VerifyOAuthTokenResponse, type VerifySiweWalletRegistrationRequest, WALLET_ERROR_CODES, type Wallet, type WalletChain, type WalletChainType, type WalletConnectConfig, WalletCreationError, type WalletError, type WalletErrorCode, type WalletKeyRequest, type WalletListEntry, type WalletRegistrationNonceRequest, type WalletRegistrationNonceResponse, type WalletType, type WalletVerifyRequest };
+export { type AccessTokenClaims, type AppConfigRequest, type AppConfigResponse, type AttachOAuthTokenRequest, type AttachOAuthTokenResponse, type AuthAppearance, type AuthFlow, type AuthFlowComponent, type AuthLoginMethod, type AuthProviderConfig, type BaseGetBalanceParams, type BaseGetBalanceResult, type BaseGetTokenAccountsParams, type BaseSendTransactionParams, type BaseSendTransactionResult, type BaseSignMessageParams, type BaseSignMessageResult, type BaseSignTransactionParams, type BaseSignTransactionResult, type BaseTokenClaims, type BaseUIOptions, type BaseWalletHooks, type BlockExplorer, type Chain, type ChainLikeWithId, type ContractUIOptions, type CreateWalletResponse, type DefaultFundingMethod, type DeleteSessionRequest, type DeleteSessionResponse, type DetachOAuthTokenRequest, type DeviceFingerprint, type DisplayMode, type EmailOtpConfig, type EmailOtpFlowState, type EphemeralSigner, type EphemeralSignerChain, type EphemeralSignerScheme, type EphemeralSignerWallet, type EthereumChainConfig, type EthereumFundingConfig, type EthereumGetBalanceParams, type EthereumGetBalanceResult, type EthereumGetTokenAccountsByOwnerParams, type EthereumGetTokenAccountsByOwnerResult, type EthereumSendTransactionParams, type EthereumSendTransactionRequest, type EthereumSendTransactionResult, type EthereumSign7702AuthorizationParams, type EthereumSign7702AuthorizationResult, type EthereumSignHashParams, type EthereumSignHashResult, type EthereumSignMessageParams, type EthereumSignMessageResult, type EthereumSignTransactionParams, type EthereumSignTransactionResult, type EthereumSignTypedDataParams, type EthereumSignTypedDataResult, type EthereumSwitchChainParams, type ExportKeyConfig, type Factor, type FlexibleTheme, type FundWalletConfig, type FundingEvents, type FundingMethod, type FundingUIConfig, type GetCurrentSessionRequest, type GetCurrentSessionResponse, type Hex, type IdentityTokenClaims, type IdpProvider, type IsAuthenticatedRequest, type IsAuthenticatedResponse, type ListEphemeralSignersResult, type LoginTokenBundle, type LogoutRequest, type LogoutResponse, type MessageTypeProperty, type MessageTypes, type MoonKeyThemeConfig, type MoonPaySignRequest, type MoonPaySignResponse, type MpcKeyShares, type NativeCurrency, Network, type OAuthRequest, type OAuthResponse, type OnrampFundingSettings, type PasskeyEnrollConfig, type PasskeySettings, type PreferredCardProvider, type PrefillConfig, type PresenceTokenClaims, type ProvisionEphemeralSignerParams, type ProvisionEphemeralSignerResult, type PublicEthereumWallet, type PublicSessionData, type PublicWallet, type RefreshSessionRequest, type RefreshSessionResponse, type RetrieveWalletKeyRequest, type RetrieveWalletKeyResponse, type RevokeEphemeralSignerParams, type RpcConfig, type RpcUrls, type SdkSettings, type SendEmailOtpRequest, type SendEmailOtpResponse, type SendTransactionConfig, type SendTransactionRequest, type SessionData, type SessionWallet, type SharesDeviceRequest, type SharesDeviceResponse, type Sign7702AuthorizationError, type Sign7702AuthorizationParams, type Sign7702AuthorizationResponse, type Sign7702AuthorizationResult, type SignMessageConfig, type SignTransactionConfig, type SignTypedDataError, type SignTypedDataParams, type SignTypedDataResponse, type SignTypedDataResult, type SmsSettings, type SolanaChain, type SolanaFundingConfig, type SolanaGetBalanceParams, type SolanaGetBalanceResult, type SolanaGetTokenAccountsByOwnerParams, type SolanaGetTokenAccountsByOwnerResult, type SolanaSendTransactionParams, type SolanaSendTransactionResult, type SolanaSignMessageParams, type SolanaSignMessageResult, type SolanaSignTransactionParams, type SolanaSignTransactionResult, type TransactionCommitment, type TransactionEncoding, type TransactionUIOptions, type TypedMessage, type UseFundWalletInterface, type UsersMePublicResponse, type UsersMeRequest, type UsersMeResponse, type VerifiedSession, type VerifyEmailOtpRequest, type VerifyEmailOtpResponse, type VerifyEmailOtpUser, type VerifyOAuthTokenRequest, type VerifyOAuthTokenResponse, type VerifySiweWalletRegistrationRequest, WALLET_ERROR_CODES, type Wallet, type WalletChain, type WalletChainType, type WalletConnectConfig, WalletCreationError, type WalletError, type WalletErrorCode, type WalletKeyRequest, type WalletListEntry, type WalletRegistrationNonceRequest, type WalletRegistrationNonceResponse, type WalletType, type WalletVerifyRequest };

package/dist/types/index.d.ts

@@ -49,7 +49,6 @@ interface PublicWallet {
     id: string;
     app_id: string;
     user_id: string;
-    key_id: string;
     key_share: string;
     public_address: string;
     wallet_type: WalletChain;
@@ -57,6 +56,9 @@ interface PublicWallet {
     derivation_path?: string;
     created_at: string;
 }
+interface SessionWallet extends PublicWallet {
+    key_id: string;
+}
 interface PublicEthereumWallet extends PublicWallet {
     chainId?: number;
     switchChain?: (targetChainId: number) => Promise<void>;
@@ -1148,7 +1150,7 @@ interface UsersMeResponse {
     status?: string;
     created_at?: string;
     emails: Email[];
-    wallets: PublicWallet[];
+    wallets: SessionWallet[];
 }
 interface UsersMePublicResponse {
     user_id: string;
@@ -1326,4 +1328,4 @@ interface WalletVerifyRequest {
     sessionExpiresIn: number;
 }
 
-export { type AccessTokenClaims, type AppConfigRequest, type AppConfigResponse, type AttachOAuthTokenRequest, type AttachOAuthTokenResponse, type AuthAppearance, type AuthFlow, type AuthFlowComponent, type AuthLoginMethod, type AuthProviderConfig, type BaseGetBalanceParams, type BaseGetBalanceResult, type BaseGetTokenAccountsParams, type BaseSendTransactionParams, type BaseSendTransactionResult, type BaseSignMessageParams, type BaseSignMessageResult, type BaseSignTransactionParams, type BaseSignTransactionResult, type BaseTokenClaims, type BaseUIOptions, type BaseWalletHooks, type BlockExplorer, type Chain, type ChainLikeWithId, type ContractUIOptions, type CreateWalletResponse, type DefaultFundingMethod, type DeleteSessionRequest, type DeleteSessionResponse, type DetachOAuthTokenRequest, type DeviceFingerprint, type DisplayMode, type EmailOtpConfig, type EmailOtpFlowState, type EphemeralSigner, type EphemeralSignerChain, type EphemeralSignerScheme, type EphemeralSignerWallet, type EthereumChainConfig, type EthereumFundingConfig, type EthereumGetBalanceParams, type EthereumGetBalanceResult, type EthereumGetTokenAccountsByOwnerParams, type EthereumGetTokenAccountsByOwnerResult, type EthereumSendTransactionParams, type EthereumSendTransactionRequest, type EthereumSendTransactionResult, type EthereumSign7702AuthorizationParams, type EthereumSign7702AuthorizationResult, type EthereumSignHashParams, type EthereumSignHashResult, type EthereumSignMessageParams, type EthereumSignMessageResult, type EthereumSignTransactionParams, type EthereumSignTransactionResult, type EthereumSignTypedDataParams, type EthereumSignTypedDataResult, type EthereumSwitchChainParams, type ExportKeyConfig, type Factor, type FlexibleTheme, type FundWalletConfig, type FundingEvents, type FundingMethod, type FundingUIConfig, type GetCurrentSessionRequest, type GetCurrentSessionResponse, type Hex, type IdentityTokenClaims, type IdpProvider, type IsAuthenticatedRequest, type IsAuthenticatedResponse, type ListEphemeralSignersResult, type LoginTokenBundle, type LogoutRequest, type LogoutResponse, type MessageTypeProperty, type MessageTypes, type MoonKeyThemeConfig, type MoonPaySignRequest, type MoonPaySignResponse, type MpcKeyShares, type NativeCurrency, Network, type OAuthRequest, type OAuthResponse, type OnrampFundingSettings, type PasskeyEnrollConfig, type PasskeySettings, type PreferredCardProvider, type PrefillConfig, type PresenceTokenClaims, type ProvisionEphemeralSignerParams, type ProvisionEphemeralSignerResult, type PublicEthereumWallet, type PublicSessionData, type PublicWallet, type RefreshSessionRequest, type RefreshSessionResponse, type RetrieveWalletKeyRequest, type RetrieveWalletKeyResponse, type RevokeEphemeralSignerParams, type RpcConfig, type RpcUrls, type SdkSettings, type SendEmailOtpRequest, type SendEmailOtpResponse, type SendTransactionConfig, type SendTransactionRequest, type SessionData, type SharesDeviceRequest, type SharesDeviceResponse, type Sign7702AuthorizationError, type Sign7702AuthorizationParams, type Sign7702AuthorizationResponse, type Sign7702AuthorizationResult, type SignMessageConfig, type SignTransactionConfig, type SignTypedDataError, type SignTypedDataParams, type SignTypedDataResponse, type SignTypedDataResult, type SmsSettings, type SolanaChain, type SolanaFundingConfig, type SolanaGetBalanceParams, type SolanaGetBalanceResult, type SolanaGetTokenAccountsByOwnerParams, type SolanaGetTokenAccountsByOwnerResult, type SolanaSendTransactionParams, type SolanaSendTransactionResult, type SolanaSignMessageParams, type SolanaSignMessageResult, type SolanaSignTransactionParams, type SolanaSignTransactionResult, type TransactionCommitment, type TransactionEncoding, type TransactionUIOptions, type TypedMessage, type UseFundWalletInterface, type UsersMePublicResponse, type UsersMeRequest, type UsersMeResponse, type VerifiedSession, type VerifyEmailOtpRequest, type VerifyEmailOtpResponse, type VerifyEmailOtpUser, type VerifyOAuthTokenRequest, type VerifyOAuthTokenResponse, type VerifySiweWalletRegistrationRequest, WALLET_ERROR_CODES, type Wallet, type WalletChain, type WalletChainType, type WalletConnectConfig, WalletCreationError, type WalletError, type WalletErrorCode, type WalletKeyRequest, type WalletListEntry, type WalletRegistrationNonceRequest, type WalletRegistrationNonceResponse, type WalletType, type WalletVerifyRequest };
+export { type AccessTokenClaims, type AppConfigRequest, type AppConfigResponse, type AttachOAuthTokenRequest, type AttachOAuthTokenResponse, type AuthAppearance, type AuthFlow, type AuthFlowComponent, type AuthLoginMethod, type AuthProviderConfig, type BaseGetBalanceParams, type BaseGetBalanceResult, type BaseGetTokenAccountsParams, type BaseSendTransactionParams, type BaseSendTransactionResult, type BaseSignMessageParams, type BaseSignMessageResult, type BaseSignTransactionParams, type BaseSignTransactionResult, type BaseTokenClaims, type BaseUIOptions, type BaseWalletHooks, type BlockExplorer, type Chain, type ChainLikeWithId, type ContractUIOptions, type CreateWalletResponse, type DefaultFundingMethod, type DeleteSessionRequest, type DeleteSessionResponse, type DetachOAuthTokenRequest, type DeviceFingerprint, type DisplayMode, type EmailOtpConfig, type EmailOtpFlowState, type EphemeralSigner, type EphemeralSignerChain, type EphemeralSignerScheme, type EphemeralSignerWallet, type EthereumChainConfig, type EthereumFundingConfig, type EthereumGetBalanceParams, type EthereumGetBalanceResult, type EthereumGetTokenAccountsByOwnerParams, type EthereumGetTokenAccountsByOwnerResult, type EthereumSendTransactionParams, type EthereumSendTransactionRequest, type EthereumSendTransactionResult, type EthereumSign7702AuthorizationParams, type EthereumSign7702AuthorizationResult, type EthereumSignHashParams, type EthereumSignHashResult, type EthereumSignMessageParams, type EthereumSignMessageResult, type EthereumSignTransactionParams, type EthereumSignTransactionResult, type EthereumSignTypedDataParams, type EthereumSignTypedDataResult, type EthereumSwitchChainParams, type ExportKeyConfig, type Factor, type FlexibleTheme, type FundWalletConfig, type FundingEvents, type FundingMethod, type FundingUIConfig, type GetCurrentSessionRequest, type GetCurrentSessionResponse, type Hex, type IdentityTokenClaims, type IdpProvider, type IsAuthenticatedRequest, type IsAuthenticatedResponse, type ListEphemeralSignersResult, type LoginTokenBundle, type LogoutRequest, type LogoutResponse, type MessageTypeProperty, type MessageTypes, type MoonKeyThemeConfig, type MoonPaySignRequest, type MoonPaySignResponse, type MpcKeyShares, type NativeCurrency, Network, type OAuthRequest, type OAuthResponse, type OnrampFundingSettings, type PasskeyEnrollConfig, type PasskeySettings, type PreferredCardProvider, type PrefillConfig, type PresenceTokenClaims, type ProvisionEphemeralSignerParams, type ProvisionEphemeralSignerResult, type PublicEthereumWallet, type PublicSessionData, type PublicWallet, type RefreshSessionRequest, type RefreshSessionResponse, type RetrieveWalletKeyRequest, type RetrieveWalletKeyResponse, type RevokeEphemeralSignerParams, type RpcConfig, type RpcUrls, type SdkSettings, type SendEmailOtpRequest, type SendEmailOtpResponse, type SendTransactionConfig, type SendTransactionRequest, type SessionData, type SessionWallet, type SharesDeviceRequest, type SharesDeviceResponse, type Sign7702AuthorizationError, type Sign7702AuthorizationParams, type Sign7702AuthorizationResponse, type Sign7702AuthorizationResult, type SignMessageConfig, type SignTransactionConfig, type SignTypedDataError, type SignTypedDataParams, type SignTypedDataResponse, type SignTypedDataResult, type SmsSettings, type SolanaChain, type SolanaFundingConfig, type SolanaGetBalanceParams, type SolanaGetBalanceResult, type SolanaGetTokenAccountsByOwnerParams, type SolanaGetTokenAccountsByOwnerResult, type SolanaSendTransactionParams, type SolanaSendTransactionResult, type SolanaSignMessageParams, type SolanaSignMessageResult, type SolanaSignTransactionParams, type SolanaSignTransactionResult, type TransactionCommitment, type TransactionEncoding, type TransactionUIOptions, type TypedMessage, type UseFundWalletInterface, type UsersMePublicResponse, type UsersMeRequest, type UsersMeResponse, type VerifiedSession, type VerifyEmailOtpRequest, type VerifyEmailOtpResponse, type VerifyEmailOtpUser, type VerifyOAuthTokenRequest, type VerifyOAuthTokenResponse, type VerifySiweWalletRegistrationRequest, WALLET_ERROR_CODES, type Wallet, type WalletChain, type WalletChainType, type WalletConnectConfig, WalletCreationError, type WalletError, type WalletErrorCode, type WalletKeyRequest, type WalletListEntry, type WalletRegistrationNonceRequest, type WalletRegistrationNonceResponse, type WalletType, type WalletVerifyRequest };

package/dist/utils/index.d.mts

@@ -1,4 +1,4 @@
-export { F as FORWARDED_ERROR_FIELDS, P as PostMessageClient, a as PostMessageMethod, b as PostMessageServer, c as PostMessageType } from '../post-message-Z6cLf0mS.mjs';
+export { F as FORWARDED_ERROR_FIELDS, P as PostMessageClient, a as PostMessageMethod, b as PostMessageServer, c as PostMessageType } from '../post-message-2NAnU0Lf.mjs';
 
 /**
  * Get the appropriate MoonKey API URL based on environment configuration

package/dist/utils/index.d.ts

@@ -1,4 +1,4 @@
-export { F as FORWARDED_ERROR_FIELDS, P as PostMessageClient, a as PostMessageMethod, b as PostMessageServer, c as PostMessageType } from '../post-message-Z6cLf0mS.js';
+export { F as FORWARDED_ERROR_FIELDS, P as PostMessageClient, a as PostMessageMethod, b as PostMessageServer, c as PostMessageType } from '../post-message-2NAnU0Lf.js';
 
 /**
  * Get the appropriate MoonKey API URL based on environment configuration

package/dist/utils/index.js

@@ -269,8 +269,11 @@ var sendReactNativeReply = (response) => {
   } catch {
   }
 };
+var QUEUE_TTL_MS = 2e4;
+var MAX_PENDING_PER_KEY = 16;
 var PostMessageServer = class {
   constructor(originValidator) {
+    this.pending = /* @__PURE__ */ new Map();
     this.trustedSources = /* @__PURE__ */ new Set();
     this.handlers = /* @__PURE__ */ new Map();
     this.originValidator = originValidator;
@@ -285,6 +288,20 @@ var PostMessageServer = class {
   register(type, method, handler) {
     const key = `${type}:${method}`;
     this.handlers.set(key, handler);
+    const queued = this.pending.get(key);
+    if (queued?.length) {
+      this.pending.delete(key);
+      const now = Date.now();
+      for (const { request, reply, at } of queued) {
+        if (now - at < QUEUE_TTL_MS) {
+          void this.invokeHandler(
+            handler,
+            request,
+            reply
+          );
+        }
+      }
+    }
   }
   cleanup() {
     window.removeEventListener("message", this.handleMessage.bind(this));
@@ -349,29 +366,57 @@ var PostMessageServer = class {
     const key = `${request.type}:${request.method}`;
     const handler = this.handlers.get(key);
     if (handler) {
-      try {
-        const data = await handler(request.payload);
-        reply({
-          id: request.id,
-          type: request.type,
-          success: true,
-          data
-        });
-      } catch (error) {
-        const extras = {};
-        if (error && typeof error === "object") {
-          for (const key2 of FORWARDED_ERROR_FIELDS) {
-            const value = error[key2];
-            if (value !== void 0) extras[key2] = value;
-          }
+      await this.invokeHandler(handler, request, reply);
+    } else {
+      this.bufferRequest(key, request, reply);
+    }
+  }
+  async invokeHandler(handler, request, reply) {
+    try {
+      const data = await handler(request.payload);
+      reply({
+        id: request.id,
+        type: request.type,
+        success: true,
+        data
+      });
+    } catch (error) {
+      const extras = {};
+      if (error && typeof error === "object") {
+        for (const key of FORWARDED_ERROR_FIELDS) {
+          const value = error[key];
+          if (value !== void 0) extras[key] = value;
         }
-        reply({
-          ...extras,
-          id: request.id,
-          type: request.type,
-          success: false,
-          error: error instanceof Error ? error.message : "Unknown error"
-        });
+      }
+      reply({
+        ...extras,
+        id: request.id,
+        type: request.type,
+        success: false,
+        error: error instanceof Error ? error.message : "Unknown error"
+      });
+    }
+  }
+  bufferRequest(key, request, reply) {
+    this.evictExpiredPending();
+    let queue = this.pending.get(key);
+    if (!queue) {
+      queue = [];
+      this.pending.set(key, queue);
+    }
+    queue.push({ request, reply, at: Date.now() });
+    if (queue.length > MAX_PENDING_PER_KEY) {
+      queue.splice(0, queue.length - MAX_PENDING_PER_KEY);
+    }
+  }
+  evictExpiredPending() {
+    const now = Date.now();
+    for (const [key, queue] of this.pending) {
+      const fresh = queue.filter((e) => now - e.at < QUEUE_TTL_MS);
+      if (fresh.length) {
+        this.pending.set(key, fresh);
+      } else {
+        this.pending.delete(key);
       }
     }
   }

package/dist/utils/index.mjs

@@ -9,7 +9,7 @@ import {
   PostMessageMethod,
   PostMessageServer,
   PostMessageType
-} from "../chunk-JU5MWLXH.mjs";
+} from "../chunk-KRZVIDBQ.mjs";
 import {
   getMoonKeyApiUrl
 } from "../chunk-GQKIA37O.mjs";

package/dist/web/index.d.mts

@@ -1,5 +1,5 @@
-import { P as PostMessageClient } from '../post-message-Z6cLf0mS.mjs';
-import { T as Transport, P as PasskeyAssertor, K as KvStorage } from '../interfaces-BWxOajnD.mjs';
+import { P as PostMessageClient } from '../post-message-2NAnU0Lf.mjs';
+import { T as Transport, P as PasskeyAssertor, K as KvStorage } from '../interfaces-CF5UrEBb.mjs';
 
 declare const getCachedPostMessageClient: (contentWindow: Window) => PostMessageClient;
 /**

package/dist/web/index.d.ts

@@ -1,5 +1,5 @@
-import { P as PostMessageClient } from '../post-message-Z6cLf0mS.js';
-import { T as Transport, P as PasskeyAssertor, K as KvStorage } from '../interfaces-BZ5GMWS9.js';
+import { P as PostMessageClient } from '../post-message-2NAnU0Lf.js';
+import { T as Transport, P as PasskeyAssertor, K as KvStorage } from '../interfaces-B5zxo2Jx.js';
 
 declare const getCachedPostMessageClient: (contentWindow: Window) => PostMessageClient;
 /**

package/dist/web/index.js

@@ -114,8 +114,11 @@ var sendReactNativeReply = (response) => {
   } catch {
   }
 };
+var QUEUE_TTL_MS = 2e4;
+var MAX_PENDING_PER_KEY = 16;
 var PostMessageServer = class {
   constructor(originValidator) {
+    this.pending = /* @__PURE__ */ new Map();
     this.trustedSources = /* @__PURE__ */ new Set();
     this.handlers = /* @__PURE__ */ new Map();
     this.originValidator = originValidator;
@@ -130,6 +133,20 @@ var PostMessageServer = class {
   register(type, method, handler) {
     const key = `${type}:${method}`;
     this.handlers.set(key, handler);
+    const queued = this.pending.get(key);
+    if (queued?.length) {
+      this.pending.delete(key);
+      const now = Date.now();
+      for (const { request, reply, at } of queued) {
+        if (now - at < QUEUE_TTL_MS) {
+          void this.invokeHandler(
+            handler,
+            request,
+            reply
+          );
+        }
+      }
+    }
   }
   cleanup() {
     window.removeEventListener("message", this.handleMessage.bind(this));
@@ -194,29 +211,57 @@ var PostMessageServer = class {
     const key = `${request.type}:${request.method}`;
     const handler = this.handlers.get(key);
     if (handler) {
-      try {
-        const data = await handler(request.payload);
-        reply({
-          id: request.id,
-          type: request.type,
-          success: true,
-          data
-        });
-      } catch (error) {
-        const extras = {};
-        if (error && typeof error === "object") {
-          for (const key2 of FORWARDED_ERROR_FIELDS) {
-            const value = error[key2];
-            if (value !== void 0) extras[key2] = value;
-          }
+      await this.invokeHandler(handler, request, reply);
+    } else {
+      this.bufferRequest(key, request, reply);
+    }
+  }
+  async invokeHandler(handler, request, reply) {
+    try {
+      const data = await handler(request.payload);
+      reply({
+        id: request.id,
+        type: request.type,
+        success: true,
+        data
+      });
+    } catch (error) {
+      const extras = {};
+      if (error && typeof error === "object") {
+        for (const key of FORWARDED_ERROR_FIELDS) {
+          const value = error[key];
+          if (value !== void 0) extras[key] = value;
         }
-        reply({
-          ...extras,
-          id: request.id,
-          type: request.type,
-          success: false,
-          error: error instanceof Error ? error.message : "Unknown error"
-        });
+      }
+      reply({
+        ...extras,
+        id: request.id,
+        type: request.type,
+        success: false,
+        error: error instanceof Error ? error.message : "Unknown error"
+      });
+    }
+  }
+  bufferRequest(key, request, reply) {
+    this.evictExpiredPending();
+    let queue = this.pending.get(key);
+    if (!queue) {
+      queue = [];
+      this.pending.set(key, queue);
+    }
+    queue.push({ request, reply, at: Date.now() });
+    if (queue.length > MAX_PENDING_PER_KEY) {
+      queue.splice(0, queue.length - MAX_PENDING_PER_KEY);
+    }
+  }
+  evictExpiredPending() {
+    const now = Date.now();
+    for (const [key, queue] of this.pending) {
+      const fresh = queue.filter((e) => now - e.at < QUEUE_TTL_MS);
+      if (fresh.length) {
+        this.pending.set(key, fresh);
+      } else {
+        this.pending.delete(key);
       }
     }
   }

package/dist/web/index.mjs

@@ -5,7 +5,7 @@ import {
 import {
   PostMessageClient,
   PostMessageServer
-} from "../chunk-JU5MWLXH.mjs";
+} from "../chunk-KRZVIDBQ.mjs";
 
 // src/web/iframe-transport.ts
 var clientCache = /* @__PURE__ */ new WeakMap();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@moon-x/core",
-  "version": "0.7.0",
+  "version": "0.9.0",
   "license": "UNLICENSED",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",