@moon-x/node-sdk 0.4.0 → 0.6.0

package/README.md

@@ -64,14 +64,14 @@ Construct once per process. Holds in-memory caches; reuse across requests.
 | Field | Type | Required | Default |
 |---|---|---|---|
 | `publishableKey` | `string` | Yes | — |
-| `secretKey` | `string` | No (v0.1 unused) | — |
+| `secretKey` | `string` | For `ephemeralSigners` | n/a |
 | `issuer` | `string` | No | `https://api.moonx-dev.com` |
 | `baseUrl` | `string` | No | Same as `issuer` |
 | `jwksTtlMs` | `number` | No | `300_000` (5 min) |
 | `appResolveTtlMs` | `number` | No | `3_600_000` (1 hour) |
 | `fetch` | `typeof fetch` | No | `globalThis.fetch` |
 
-The publishable key (`moon_pk_*`) is the same one your iframe / browser SDK uses. It's safe to put in any env var, but in node-sdk it typically reads from a server-only env var alongside the secret key. The secret key (`moon_sk_*`) field is reserved for v0.2 (data + swaps modules).
+The publishable key (`moon_pk_*`) is the same one your iframe / browser SDK uses; it resolves your app id and scopes JWKS lookups. The secret key (`moon_sk_*`) is required to use `ephemeralSigners` (the wallets server-side ephemeral-signer routes are secret-key-only) and by the v0.2 data + swaps modules. Read both from server-only env vars; never expose the secret key to the browser.
 
 ### `client.auth.verifyAccessToken(token)`
 
@@ -148,5 +148,5 @@ Auth providers ship server SDKs partly to abstract away `jose`-style JWT librari
 
 ## Roadmap
 
-- **v0.1 (current)** — auth: `verifyAccessToken`, `verifyIdentityToken`, `verifySession`.
-- **v0.2 (pending [MX-124](https://linear.app/moonpay/issue/MX-124))** — adds `client.tokens.*`, `client.wallets.*`, `client.swaps.*` once the backend's secret-key middleware lands.
+- **Current**: auth (`verifyAccessToken`, `verifyIdentityToken`, `verifySession`) plus `ephemeralSigners` (secret-key gated server-side signing).
+- **v0.2 ([MX-124](https://linear.app/moonpay/issue/MX-124))**: adds `client.tokens.*` and `client.swaps.*`.

package/dist/index.d.mts

@@ -61,8 +61,9 @@ interface MoonXClientConfig {
     publishableKey: string;
     /**
      * Optional. The secret key (`moon_sk_*`) for your MoonX app. Required
-     * for privileged endpoints (datalayer, swaps) — not used by v0.1
-     * (auth-only). Reserved for the v0.2 surface expansion.
+     * to use `ephemeralSigners`: the wallets server-side ephemeral-signer
+     * routes (/me/wallets, /sign) are secret-key-only (MX-124). Also used
+     * by the privileged datalayer / swaps endpoints in the v0.2 surface.
      *
      * NEVER hardcode. NEVER expose to the browser. Always read from a
      * server-only env var.
@@ -104,8 +105,13 @@ interface MoonXClientConfig {
 
 interface EphemeralSignersConfig {
     baseUrl: string;
-    /** MoonX publishable key — required for the Authorization header on /ephemeral-signers/* calls. */
-    publishableKey: string;
+    /**
+     * MoonX secret key (`moon_sk_*`). The server-side ephemeral-signer
+     * routes (/me/wallets, /sign) are secret-key-only. Optional here
+     * because MoonXClient takes it optionally; sign() throws if it is
+     * absent. Server-only; never expose to the browser.
+     */
+    secretKey?: string;
     fetchImpl?: typeof fetch;
 }
 interface SignEphemeralSignerParams {
@@ -159,9 +165,9 @@ declare class EphemeralSigners {
  *     // session.identity?.email   — OIDC profile claim (when identity token sent)
  *     // session.identity?.name    — etc.
  *
- * v0.1 ships the `auth` namespace only. The `tokens`, `wallets`, and
- * `swaps` namespaces will land in v0.2 once the secret-key middleware
- * (MX-124) ships on the backend.
+ * Today this ships the `auth` namespace plus `ephemeralSigners` (the
+ * latter is secret-key gated; see `secretKey`). The `tokens` and `swaps`
+ * namespaces land in v0.2.
  */
 declare class MoonXClient {
     readonly auth: Auth;

package/dist/index.d.ts

@@ -61,8 +61,9 @@ interface MoonXClientConfig {
     publishableKey: string;
     /**
      * Optional. The secret key (`moon_sk_*`) for your MoonX app. Required
-     * for privileged endpoints (datalayer, swaps) — not used by v0.1
-     * (auth-only). Reserved for the v0.2 surface expansion.
+     * to use `ephemeralSigners`: the wallets server-side ephemeral-signer
+     * routes (/me/wallets, /sign) are secret-key-only (MX-124). Also used
+     * by the privileged datalayer / swaps endpoints in the v0.2 surface.
      *
      * NEVER hardcode. NEVER expose to the browser. Always read from a
      * server-only env var.
@@ -104,8 +105,13 @@ interface MoonXClientConfig {
 
 interface EphemeralSignersConfig {
     baseUrl: string;
-    /** MoonX publishable key — required for the Authorization header on /ephemeral-signers/* calls. */
-    publishableKey: string;
+    /**
+     * MoonX secret key (`moon_sk_*`). The server-side ephemeral-signer
+     * routes (/me/wallets, /sign) are secret-key-only. Optional here
+     * because MoonXClient takes it optionally; sign() throws if it is
+     * absent. Server-only; never expose to the browser.
+     */
+    secretKey?: string;
     fetchImpl?: typeof fetch;
 }
 interface SignEphemeralSignerParams {
@@ -159,9 +165,9 @@ declare class EphemeralSigners {
  *     // session.identity?.email   — OIDC profile claim (when identity token sent)
  *     // session.identity?.name    — etc.
  *
- * v0.1 ships the `auth` namespace only. The `tokens`, `wallets`, and
- * `swaps` namespaces will land in v0.2 once the secret-key middleware
- * (MX-124) ships on the backend.
+ * Today this ships the `auth` namespace plus `ephemeralSigners` (the
+ * latter is secret-key gated; see `secretKey`). The `tokens` and `swaps`
+ * namespaces land in v0.2.
  */
 declare class MoonXClient {
     readonly auth: Auth;

package/dist/index.js

@@ -23,7 +23,7 @@ __export(src_exports, {
   AppResolutionError: () => AppResolutionError,
   AudienceMismatchError: () => AudienceMismatchError,
   ConfigurationError: () => ConfigurationError,
-  EphemeralSignerSignError: () => import_sdk2.EphemeralSignerSignError,
+  EphemeralSignerSignError: () => import_sdk3.EphemeralSignerSignError,
   EphemeralSigners: () => EphemeralSigners,
   ExpiredTokenError: () => ExpiredTokenError,
   InvalidTokenError: () => InvalidTokenError,
@@ -468,7 +468,8 @@ var Auth = class {
 };
 
 // src/config.ts
-var DEFAULT_ISSUER = "https://api.moonx-dev.com";
+var import_sdk = require("@moon-x/core/sdk");
+var DEFAULT_ISSUER = import_sdk.DEFAULT_API_BASE_URL;
 function resolveConfig(input) {
   if (!input.publishableKey) {
     throw new ConfigurationError(
@@ -480,7 +481,7 @@ function resolveConfig(input) {
       "MoonXClient: publishableKey must start with 'moon_pk_' (got a string that doesn't \u2014 did you pass a secret key by mistake?)"
     );
   }
-  if (input.secretKey !== void 0 && !input.secretKey.startsWith("moon_sk_")) {
+  if (input.secretKey && !input.secretKey.startsWith("moon_sk_")) {
     throw new ConfigurationError(
       "MoonXClient: secretKey must start with 'moon_sk_' (got a string that doesn't)"
     );
@@ -503,7 +504,7 @@ function resolveConfig(input) {
 }
 
 // src/ephemeral-signers/index.ts
-var import_sdk = require("@moon-x/core/sdk");
+var import_sdk2 = require("@moon-x/core/sdk");
 var EphemeralSigners = class {
   constructor(cfg) {
     this.cfg = cfg;
@@ -514,10 +515,15 @@ var EphemeralSigners = class {
    * — that's an implementation detail consumed by SES internally).
    */
   async sign(params) {
-    return (0, import_sdk.signWithEphemeralSigner)({
+    if (!this.cfg.secretKey) {
+      throw new Error(
+        "MoonXClient: secretKey is required to use ephemeralSigners. The wallets ephemeral-signer endpoints are secret-key-only; pass secretKey to new MoonXClient({ ... })."
+      );
+    }
+    return (0, import_sdk2.signWithEphemeralSigner)({
       ...params,
       baseUrl: this.cfg.baseUrl,
-      publishableKey: this.cfg.publishableKey,
+      secretKey: this.cfg.secretKey,
       fetchImpl: this.cfg.fetchImpl
     });
   }
@@ -537,14 +543,14 @@ var MoonXClient = class {
     });
     this.ephemeralSigners = new EphemeralSigners({
       baseUrl: cfg.baseUrl,
-      publishableKey: cfg.publishableKey,
+      secretKey: cfg.secretKey,
       fetchImpl: cfg.fetch
     });
   }
 };
 
 // src/index.ts
-var import_sdk2 = require("@moon-x/core/sdk");
+var import_sdk3 = require("@moon-x/core/sdk");
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   AppResolutionError,

package/dist/index.mjs

@@ -428,7 +428,8 @@ var Auth = class {
 };
 
 // src/config.ts
-var DEFAULT_ISSUER = "https://api.moonx-dev.com";
+import { DEFAULT_API_BASE_URL } from "@moon-x/core/sdk";
+var DEFAULT_ISSUER = DEFAULT_API_BASE_URL;
 function resolveConfig(input) {
   if (!input.publishableKey) {
     throw new ConfigurationError(
@@ -440,7 +441,7 @@ function resolveConfig(input) {
       "MoonXClient: publishableKey must start with 'moon_pk_' (got a string that doesn't \u2014 did you pass a secret key by mistake?)"
     );
   }
-  if (input.secretKey !== void 0 && !input.secretKey.startsWith("moon_sk_")) {
+  if (input.secretKey && !input.secretKey.startsWith("moon_sk_")) {
     throw new ConfigurationError(
       "MoonXClient: secretKey must start with 'moon_sk_' (got a string that doesn't)"
     );
@@ -476,10 +477,15 @@ var EphemeralSigners = class {
    * — that's an implementation detail consumed by SES internally).
    */
   async sign(params) {
+    if (!this.cfg.secretKey) {
+      throw new Error(
+        "MoonXClient: secretKey is required to use ephemeralSigners. The wallets ephemeral-signer endpoints are secret-key-only; pass secretKey to new MoonXClient({ ... })."
+      );
+    }
     return signWithEphemeralSigner({
       ...params,
       baseUrl: this.cfg.baseUrl,
-      publishableKey: this.cfg.publishableKey,
+      secretKey: this.cfg.secretKey,
       fetchImpl: this.cfg.fetchImpl
     });
   }
@@ -499,7 +505,7 @@ var MoonXClient = class {
     });
     this.ephemeralSigners = new EphemeralSigners({
       baseUrl: cfg.baseUrl,
-      publishableKey: cfg.publishableKey,
+      secretKey: cfg.secretKey,
       fetchImpl: cfg.fetch
     });
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@moon-x/node-sdk",
-  "version": "0.4.0",
+  "version": "0.6.0",
   "description": "MoonX server-side SDK for Node.js. Verify MoonX-issued access + identity tokens with zero runtime dependencies.",
   "main": "dist/index.js",
   "module": "dist/index.mjs",
@@ -30,7 +30,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@moon-x/core": "0.5.0"
+    "@moon-x/core": "0.9.0"
   },
   "devDependencies": {
     "tsup": "8.5.1",