@moon-x/node-sdk 0.7.1 → 0.8.0

package/README.md

@@ -87,6 +87,38 @@ Returns `Promise<{ access: AccessTokenClaims, identity: IdentityTokenClaims | nu
 
 Canonical entry point — use this from request handlers. Cross-checks the two tokens' subjects when both are present.
 
+### `client.funding.sign(params)`
+
+Request a signed MoonPay Buy-widget URL for a user's wallet, so your backend can drive the card-funding flow without holding MoonPay keys. Returns `Promise<MoonPaySignResponse>`.
+
+The route is publishable-key acceptable but signs **only** for an address that belongs to the authenticated user, so you forward that user's access token per call:
+
+```ts
+const funding = await moonx.funding.sign({
+  accessToken: req.headers["x-moonx-access-token"]!, // the end user's token
+  publicAddress: "0xUserWalletAddress",
+  useSandbox: true, // omit or false for production
+  currencyCode: "eth", // optional MoonPay presets
+  quoteCurrencyAmount: 50,
+});
+
+// funding.signed_url               — open this for the user
+// funding.external_transaction_id  — correlate the purchase
+// funding.provider_publishable_key — MoonPay pk the URL was signed with
+```
+
+| Param | Type | Required | Notes |
+|---|---|---|---|
+| `accessToken` | `string` | Yes | The end user's MoonX access token |
+| `publicAddress` | `string` | Yes | Wallet address to fund; must belong to the user |
+| `useSandbox` | `boolean` | No | `true` → MoonPay sandbox; defaults to `false` |
+| `currencyCode` | `string` | No | MoonPay currency to preselect |
+| `quoteCurrencyAmount` | `number` | No | Pin the fiat amount; omit to let the user choose |
+| `paymentMethod` | `string` | No | MoonPay payment method to preselect |
+| `uiConfig` | `{ theme?, accentColor? }` | No | Widget theming |
+
+Failures throw a typed `MoonXError` subclass: `IntegrationNotConfiguredError` (400), `UnauthorizedError` (401), `WalletOwnershipError` (403), `RateLimitedError` (429).
+
 ## Errors
 
 All thrown errors extend `MoonXError`, which carries a `.code` property for programmatic handling:
@@ -128,11 +160,16 @@ try {
 | `UnsupportedAlgorithmError` | `unsupported_algorithm` | Token uses something other than ES256 |
 | `JwksFetchError` | `jwks_fetch_failed` | Couldn't fetch the JWKS from MoonX |
 | `AppResolutionError` | `app_resolution_failed` | Publishable-key → app-id lookup failed |
-| `ConfigurationError` | `configuration_error` | Bad `MoonXClient` config (e.g. swapped pk/sk) |
+| `ConfigurationError` | `configuration_error` | Bad `MoonXClient` config, or a missing required call param |
+| `IntegrationNotConfiguredError` | `integration_not_configured` | MoonPay funding is not configured or is disabled for this app (400) |
+| `WalletOwnershipError` | `wallet_ownership` | The wallet address does not belong to the user (403) |
+| `UnauthorizedError` | `unauthorized` | Missing or invalid credentials (401) |
+| `RateLimitedError` | `rate_limited` | Request was rate limited (429) |
+| `RequestFailedError` | `request_failed` | Unexpected non-2xx response (carries `.status`) |
 
 ### Type imports
 
-`AccessTokenClaims`, `IdentityTokenClaims`, `BaseTokenClaims`, and `VerifiedSession` are also exported from `@moon-x/core/types` — the single source of truth shared with the browser + RN SDKs. Either import path works:
+`AccessTokenClaims`, `IdentityTokenClaims`, `BaseTokenClaims`, `VerifiedSession`, and `MoonPaySignResponse` are also exported from `@moon-x/core/types` — the single source of truth shared with the browser + RN SDKs. Either import path works:
 
 ```ts
 // From node-sdk (convenience re-export):
@@ -148,5 +185,5 @@ Auth providers ship server SDKs partly to abstract away `jose`-style JWT librari
 
 ## Roadmap
 
-- **Current**: auth (`verifyAccessToken`, `verifyIdentityToken`, `verifySession`) plus `ephemeralSigners` (secret-key gated server-side signing).
-- **v0.2 ([MX-124](https://linear.app/moonpay/issue/MX-124))**: adds `client.tokens.*` and `client.swaps.*`.
+- **Current**: auth (`verifyAccessToken`, `verifyIdentityToken`, `verifySession`), `ephemeralSigners` (secret-key gated server-side signing), and `funding` (MoonPay onramp signing).
+- **Next**: adds `client.tokens.*` and `client.swaps.*`.

package/dist/index.d.mts

@@ -1,5 +1,5 @@
-import { AccessTokenClaims, IdentityTokenClaims, PresenceTokenClaims, VerifiedSession } from '@moon-x/core/types';
-export { AccessTokenClaims, BaseTokenClaims, IdentityTokenClaims, PresenceTokenClaims, VerifiedSession } from '@moon-x/core/types';
+import { AccessTokenClaims, IdentityTokenClaims, PresenceTokenClaims, VerifiedSession, MoonPaySignResponse } from '@moon-x/core/types';
+export { AccessTokenClaims, BaseTokenClaims, IdentityTokenClaims, MoonPaySignResponse, PresenceTokenClaims, VerifiedSession } from '@moon-x/core/types';
 import { EphemeralSignerSignResult } from '@moon-x/core/sdk';
 export { EphemeralSignerSignError, EphemeralSignerSignResult } from '@moon-x/core/sdk';
 
@@ -143,6 +143,60 @@ declare class EphemeralSigners {
     sign(params: SignEphemeralSignerParams): Promise<EphemeralSignerSignResult>;
 }
 
+interface FundingConfig {
+    baseUrl: string;
+    /** App publishable key (`moon_pk_*`). Sent as `Authorization: PublicToken`. */
+    publishableKey: string;
+    /** Override for tests — defaults to globalThis.fetch. */
+    fetchImpl?: typeof fetch;
+}
+/** Optional MoonPay widget theming, forwarded to the Buy widget. */
+interface MoonPaySignUiConfig {
+    /** MoonPay widget theme. */
+    theme?: "light" | "dark";
+    /** Hex accent color for the widget, e.g. `#7C3AED`. */
+    accentColor?: string;
+}
+interface MoonPaySignParams {
+    /**
+     * The end-user's MoonX access token. The route refuses to sign unless
+     * `publicAddress` belongs to this user. Read it from your request (the
+     * `X-MoonX-Access-Token` header the browser SDK sends).
+     */
+    accessToken: string;
+    /** Wallet address that will receive the funds. Must belong to the user. */
+    publicAddress: string;
+    /**
+     * Route through MoonPay's sandbox (no real payment). Defaults to `false`
+     * (production). Requires the app's sandbox keys, or the platform sandbox
+     * defaults, to be configured.
+     */
+    useSandbox?: boolean;
+    /** MoonPay currency code to preselect, e.g. `"eth"`, `"usdc_sol"`. */
+    currencyCode?: string;
+    /**
+     * Pin the fiat amount to buy. Omit to let the user choose the amount inside
+     * the MoonPay widget.
+     */
+    quoteCurrencyAmount?: number;
+    /** MoonPay payment method to preselect, e.g. `"credit_debit_card"`. */
+    paymentMethod?: string;
+    /** MoonPay widget theming. */
+    uiConfig?: MoonPaySignUiConfig;
+}
+declare class Funding {
+    private readonly cfg;
+    constructor(cfg: FundingConfig);
+    /**
+     * Request a signed MoonPay Buy-widget URL for the user's wallet. Returns the
+     * `signed_url` to open (plus the transaction id and provider publishable key
+     * used to track the purchase). Throws a typed {@link MoonXError} subclass on
+     * failure: IntegrationNotConfiguredError (400), UnauthorizedError (401),
+     * WalletOwnershipError (403), RateLimitedError (429).
+     */
+    sign(params: MoonPaySignParams): Promise<MoonPaySignResponse>;
+}
+
 /**
  * MoonXClient is the entry point for the node SDK. Construct once per
  * process and reuse across requests — the client holds in-memory caches
@@ -165,17 +219,18 @@ declare class EphemeralSigners {
  *     // session.identity?.email   — OIDC profile claim (when identity token sent)
  *     // session.identity?.name    — etc.
  *
- * Today this ships the `auth` namespace plus `ephemeralSigners` (the
- * latter is secret-key gated; see `secretKey`). The `tokens` and `swaps`
- * namespaces land in v0.2.
+ * Today this ships the `auth` namespace, `ephemeralSigners` (secret-key
+ * gated; see `secretKey`), and `funding` (the MoonPay onramp sign surface).
+ * The `tokens` and `swaps` namespaces land in a later release.
  */
 declare class MoonXClient {
     readonly auth: Auth;
     readonly ephemeralSigners: EphemeralSigners;
+    readonly funding: Funding;
     constructor(input: MoonXClientConfig);
 }
 
-type MoonXErrorCode = "malformed_token" | "invalid_signature" | "expired_token" | "audience_mismatch" | "issuer_mismatch" | "subject_mismatch" | "kid_mismatch" | "unsupported_algorithm" | "jwks_fetch_failed" | "app_resolution_failed" | "configuration_error";
+type MoonXErrorCode = "malformed_token" | "invalid_signature" | "expired_token" | "audience_mismatch" | "issuer_mismatch" | "subject_mismatch" | "kid_mismatch" | "unsupported_algorithm" | "jwks_fetch_failed" | "app_resolution_failed" | "configuration_error" | "integration_not_configured" | "wallet_ownership" | "rate_limited" | "unauthorized" | "request_failed";
 declare class MoonXError extends Error {
     readonly code: MoonXErrorCode;
     constructor(code: MoonXErrorCode, message: string);
@@ -213,5 +268,21 @@ declare class AppResolutionError extends MoonXError {
 declare class ConfigurationError extends MoonXError {
     constructor(message: string);
 }
+declare class IntegrationNotConfiguredError extends MoonXError {
+    constructor(message?: string);
+}
+declare class WalletOwnershipError extends MoonXError {
+    constructor(message?: string);
+}
+declare class RateLimitedError extends MoonXError {
+    constructor(message?: string);
+}
+declare class UnauthorizedError extends MoonXError {
+    constructor(message?: string);
+}
+declare class RequestFailedError extends MoonXError {
+    readonly status: number;
+    constructor(status: number, message: string);
+}
 
-export { AppResolutionError, AudienceMismatchError, ConfigurationError, EphemeralSigners, ExpiredTokenError, InvalidTokenError, IssuerMismatchError, JwksFetchError, KidMismatchError, MalformedTokenError, MoonXClient, type MoonXClientConfig, MoonXError, type MoonXErrorCode, type SignEphemeralSignerParams, SubjectMismatchError, UnsupportedAlgorithmError };
+export { AppResolutionError, AudienceMismatchError, ConfigurationError, EphemeralSigners, ExpiredTokenError, Funding, type FundingConfig, IntegrationNotConfiguredError, InvalidTokenError, IssuerMismatchError, JwksFetchError, KidMismatchError, MalformedTokenError, type MoonPaySignParams, type MoonPaySignUiConfig, MoonXClient, type MoonXClientConfig, MoonXError, type MoonXErrorCode, RateLimitedError, RequestFailedError, type SignEphemeralSignerParams, SubjectMismatchError, UnauthorizedError, UnsupportedAlgorithmError, WalletOwnershipError };

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-import { AccessTokenClaims, IdentityTokenClaims, PresenceTokenClaims, VerifiedSession } from '@moon-x/core/types';
-export { AccessTokenClaims, BaseTokenClaims, IdentityTokenClaims, PresenceTokenClaims, VerifiedSession } from '@moon-x/core/types';
+import { AccessTokenClaims, IdentityTokenClaims, PresenceTokenClaims, VerifiedSession, MoonPaySignResponse } from '@moon-x/core/types';
+export { AccessTokenClaims, BaseTokenClaims, IdentityTokenClaims, MoonPaySignResponse, PresenceTokenClaims, VerifiedSession } from '@moon-x/core/types';
 import { EphemeralSignerSignResult } from '@moon-x/core/sdk';
 export { EphemeralSignerSignError, EphemeralSignerSignResult } from '@moon-x/core/sdk';
 
@@ -143,6 +143,60 @@ declare class EphemeralSigners {
     sign(params: SignEphemeralSignerParams): Promise<EphemeralSignerSignResult>;
 }
 
+interface FundingConfig {
+    baseUrl: string;
+    /** App publishable key (`moon_pk_*`). Sent as `Authorization: PublicToken`. */
+    publishableKey: string;
+    /** Override for tests — defaults to globalThis.fetch. */
+    fetchImpl?: typeof fetch;
+}
+/** Optional MoonPay widget theming, forwarded to the Buy widget. */
+interface MoonPaySignUiConfig {
+    /** MoonPay widget theme. */
+    theme?: "light" | "dark";
+    /** Hex accent color for the widget, e.g. `#7C3AED`. */
+    accentColor?: string;
+}
+interface MoonPaySignParams {
+    /**
+     * The end-user's MoonX access token. The route refuses to sign unless
+     * `publicAddress` belongs to this user. Read it from your request (the
+     * `X-MoonX-Access-Token` header the browser SDK sends).
+     */
+    accessToken: string;
+    /** Wallet address that will receive the funds. Must belong to the user. */
+    publicAddress: string;
+    /**
+     * Route through MoonPay's sandbox (no real payment). Defaults to `false`
+     * (production). Requires the app's sandbox keys, or the platform sandbox
+     * defaults, to be configured.
+     */
+    useSandbox?: boolean;
+    /** MoonPay currency code to preselect, e.g. `"eth"`, `"usdc_sol"`. */
+    currencyCode?: string;
+    /**
+     * Pin the fiat amount to buy. Omit to let the user choose the amount inside
+     * the MoonPay widget.
+     */
+    quoteCurrencyAmount?: number;
+    /** MoonPay payment method to preselect, e.g. `"credit_debit_card"`. */
+    paymentMethod?: string;
+    /** MoonPay widget theming. */
+    uiConfig?: MoonPaySignUiConfig;
+}
+declare class Funding {
+    private readonly cfg;
+    constructor(cfg: FundingConfig);
+    /**
+     * Request a signed MoonPay Buy-widget URL for the user's wallet. Returns the
+     * `signed_url` to open (plus the transaction id and provider publishable key
+     * used to track the purchase). Throws a typed {@link MoonXError} subclass on
+     * failure: IntegrationNotConfiguredError (400), UnauthorizedError (401),
+     * WalletOwnershipError (403), RateLimitedError (429).
+     */
+    sign(params: MoonPaySignParams): Promise<MoonPaySignResponse>;
+}
+
 /**
  * MoonXClient is the entry point for the node SDK. Construct once per
  * process and reuse across requests — the client holds in-memory caches
@@ -165,17 +219,18 @@ declare class EphemeralSigners {
  *     // session.identity?.email   — OIDC profile claim (when identity token sent)
  *     // session.identity?.name    — etc.
  *
- * Today this ships the `auth` namespace plus `ephemeralSigners` (the
- * latter is secret-key gated; see `secretKey`). The `tokens` and `swaps`
- * namespaces land in v0.2.
+ * Today this ships the `auth` namespace, `ephemeralSigners` (secret-key
+ * gated; see `secretKey`), and `funding` (the MoonPay onramp sign surface).
+ * The `tokens` and `swaps` namespaces land in a later release.
  */
 declare class MoonXClient {
     readonly auth: Auth;
     readonly ephemeralSigners: EphemeralSigners;
+    readonly funding: Funding;
     constructor(input: MoonXClientConfig);
 }
 
-type MoonXErrorCode = "malformed_token" | "invalid_signature" | "expired_token" | "audience_mismatch" | "issuer_mismatch" | "subject_mismatch" | "kid_mismatch" | "unsupported_algorithm" | "jwks_fetch_failed" | "app_resolution_failed" | "configuration_error";
+type MoonXErrorCode = "malformed_token" | "invalid_signature" | "expired_token" | "audience_mismatch" | "issuer_mismatch" | "subject_mismatch" | "kid_mismatch" | "unsupported_algorithm" | "jwks_fetch_failed" | "app_resolution_failed" | "configuration_error" | "integration_not_configured" | "wallet_ownership" | "rate_limited" | "unauthorized" | "request_failed";
 declare class MoonXError extends Error {
     readonly code: MoonXErrorCode;
     constructor(code: MoonXErrorCode, message: string);
@@ -213,5 +268,21 @@ declare class AppResolutionError extends MoonXError {
 declare class ConfigurationError extends MoonXError {
     constructor(message: string);
 }
+declare class IntegrationNotConfiguredError extends MoonXError {
+    constructor(message?: string);
+}
+declare class WalletOwnershipError extends MoonXError {
+    constructor(message?: string);
+}
+declare class RateLimitedError extends MoonXError {
+    constructor(message?: string);
+}
+declare class UnauthorizedError extends MoonXError {
+    constructor(message?: string);
+}
+declare class RequestFailedError extends MoonXError {
+    readonly status: number;
+    constructor(status: number, message: string);
+}
 
-export { AppResolutionError, AudienceMismatchError, ConfigurationError, EphemeralSigners, ExpiredTokenError, InvalidTokenError, IssuerMismatchError, JwksFetchError, KidMismatchError, MalformedTokenError, MoonXClient, type MoonXClientConfig, MoonXError, type MoonXErrorCode, type SignEphemeralSignerParams, SubjectMismatchError, UnsupportedAlgorithmError };
+export { AppResolutionError, AudienceMismatchError, ConfigurationError, EphemeralSigners, ExpiredTokenError, Funding, type FundingConfig, IntegrationNotConfiguredError, InvalidTokenError, IssuerMismatchError, JwksFetchError, KidMismatchError, MalformedTokenError, type MoonPaySignParams, type MoonPaySignUiConfig, MoonXClient, type MoonXClientConfig, MoonXError, type MoonXErrorCode, RateLimitedError, RequestFailedError, type SignEphemeralSignerParams, SubjectMismatchError, UnauthorizedError, UnsupportedAlgorithmError, WalletOwnershipError };

package/dist/index.js

@@ -26,6 +26,8 @@ __export(src_exports, {
   EphemeralSignerSignError: () => import_sdk3.EphemeralSignerSignError,
   EphemeralSigners: () => EphemeralSigners,
   ExpiredTokenError: () => ExpiredTokenError,
+  Funding: () => Funding,
+  IntegrationNotConfiguredError: () => IntegrationNotConfiguredError,
   InvalidTokenError: () => InvalidTokenError,
   IssuerMismatchError: () => IssuerMismatchError,
   JwksFetchError: () => JwksFetchError,
@@ -33,8 +35,12 @@ __export(src_exports, {
   MalformedTokenError: () => MalformedTokenError,
   MoonXClient: () => MoonXClient,
   MoonXError: () => MoonXError,
+  RateLimitedError: () => RateLimitedError,
+  RequestFailedError: () => RequestFailedError,
   SubjectMismatchError: () => SubjectMismatchError,
-  UnsupportedAlgorithmError: () => UnsupportedAlgorithmError
+  UnauthorizedError: () => UnauthorizedError,
+  UnsupportedAlgorithmError: () => UnsupportedAlgorithmError,
+  WalletOwnershipError: () => WalletOwnershipError
 });
 module.exports = __toCommonJS(src_exports);
 
@@ -127,6 +133,42 @@ var ConfigurationError = class extends MoonXError {
     Object.setPrototypeOf(this, new.target.prototype);
   }
 };
+var IntegrationNotConfiguredError = class extends MoonXError {
+  constructor(message = "MoonPay funding is not configured or is disabled for this app") {
+    super("integration_not_configured", message);
+    this.name = "IntegrationNotConfiguredError";
+    Object.setPrototypeOf(this, new.target.prototype);
+  }
+};
+var WalletOwnershipError = class extends MoonXError {
+  constructor(message = "wallet address does not belong to this user") {
+    super("wallet_ownership", message);
+    this.name = "WalletOwnershipError";
+    Object.setPrototypeOf(this, new.target.prototype);
+  }
+};
+var RateLimitedError = class extends MoonXError {
+  constructor(message = "request was rate limited") {
+    super("rate_limited", message);
+    this.name = "RateLimitedError";
+    Object.setPrototypeOf(this, new.target.prototype);
+  }
+};
+var UnauthorizedError = class extends MoonXError {
+  constructor(message = "missing or invalid credentials") {
+    super("unauthorized", message);
+    this.name = "UnauthorizedError";
+    Object.setPrototypeOf(this, new.target.prototype);
+  }
+};
+var RequestFailedError = class extends MoonXError {
+  constructor(status, message) {
+    super("request_failed", message);
+    this.name = "RequestFailedError";
+    this.status = status;
+    Object.setPrototypeOf(this, new.target.prototype);
+  }
+};
 
 // src/auth/app-resolver.ts
 var AppResolver = class {
@@ -529,6 +571,111 @@ var EphemeralSigners = class {
   }
 };
 
+// src/funding/sign.ts
+async function signMoonPay(args) {
+  if (!args.accessToken || !args.accessToken.trim()) {
+    throw new ConfigurationError("funding.sign: accessToken is required");
+  }
+  if (!args.publicAddress || !args.publicAddress.trim()) {
+    throw new ConfigurationError("funding.sign: publicAddress is required");
+  }
+  if (args.uiConfig?.theme !== void 0 && args.uiConfig.theme !== "light" && args.uiConfig.theme !== "dark") {
+    throw new ConfigurationError(
+      'funding.sign: uiConfig.theme must be "light" or "dark"'
+    );
+  }
+  const fetcher = args.fetchImpl ?? globalThis.fetch;
+  const url = `${args.baseUrl.replace(/\/$/, "")}/v0/sdk/onramps/public/moonpay/sign`;
+  const config = {};
+  if (args.currencyCode !== void 0) config.currency_code = args.currencyCode;
+  if (args.quoteCurrencyAmount !== void 0) {
+    config.quote_currency_amount = args.quoteCurrencyAmount;
+  }
+  if (args.paymentMethod !== void 0) {
+    config.payment_method = args.paymentMethod;
+  }
+  if (args.uiConfig) {
+    const uiConfig = {};
+    if (args.uiConfig.theme !== void 0) uiConfig.theme = args.uiConfig.theme;
+    if (args.uiConfig.accentColor !== void 0) {
+      uiConfig.accent_color = args.uiConfig.accentColor;
+    }
+    if (Object.keys(uiConfig).length > 0) config.ui_config = uiConfig;
+  }
+  const body = {
+    public_address: args.publicAddress,
+    use_sandbox: args.useSandbox ?? false
+  };
+  if (Object.keys(config).length > 0) body.config = config;
+  let res;
+  try {
+    res = await fetcher(url, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        Authorization: `PublicToken ${args.publishableKey}`,
+        "X-MoonX-Access-Token": args.accessToken
+      },
+      body: JSON.stringify(body),
+      signal: AbortSignal.timeout(1e4)
+    });
+  } catch (err) {
+    throw new RequestFailedError(
+      0,
+      `moonpay sign request failed: ${err instanceof Error ? err.message : String(err)}`
+    );
+  }
+  if (!res.ok) {
+    const message = await errorMessage(res);
+    switch (res.status) {
+      case 400:
+        throw new IntegrationNotConfiguredError(message || void 0);
+      case 401:
+        throw new UnauthorizedError(message || void 0);
+      case 403:
+        throw new WalletOwnershipError(message || void 0);
+      case 429:
+        throw new RateLimitedError(message || void 0);
+      default:
+        throw new RequestFailedError(
+          res.status,
+          `moonpay sign failed: HTTP ${res.status}${message ? `: ${message}` : ""}`
+        );
+    }
+  }
+  return await res.json();
+}
+async function errorMessage(res) {
+  try {
+    const body = await res.json();
+    return body.error ?? body.message ?? "";
+  } catch {
+    return "";
+  }
+}
+
+// src/funding/index.ts
+var Funding = class {
+  constructor(cfg) {
+    this.cfg = cfg;
+  }
+  /**
+   * Request a signed MoonPay Buy-widget URL for the user's wallet. Returns the
+   * `signed_url` to open (plus the transaction id and provider publishable key
+   * used to track the purchase). Throws a typed {@link MoonXError} subclass on
+   * failure: IntegrationNotConfiguredError (400), UnauthorizedError (401),
+   * WalletOwnershipError (403), RateLimitedError (429).
+   */
+  async sign(params) {
+    return signMoonPay({
+      ...params,
+      baseUrl: this.cfg.baseUrl,
+      publishableKey: this.cfg.publishableKey,
+      fetchImpl: this.cfg.fetchImpl
+    });
+  }
+};
+
 // src/client.ts
 var MoonXClient = class {
   constructor(input) {
@@ -546,6 +693,11 @@ var MoonXClient = class {
       secretKey: cfg.secretKey,
       fetchImpl: cfg.fetch
     });
+    this.funding = new Funding({
+      baseUrl: cfg.baseUrl,
+      publishableKey: cfg.publishableKey,
+      fetchImpl: cfg.fetch
+    });
   }
 };
 
@@ -559,6 +711,8 @@ var import_sdk3 = require("@moon-x/core/sdk");
   EphemeralSignerSignError,
   EphemeralSigners,
   ExpiredTokenError,
+  Funding,
+  IntegrationNotConfiguredError,
   InvalidTokenError,
   IssuerMismatchError,
   JwksFetchError,
@@ -566,6 +720,10 @@ var import_sdk3 = require("@moon-x/core/sdk");
   MalformedTokenError,
   MoonXClient,
   MoonXError,
+  RateLimitedError,
+  RequestFailedError,
   SubjectMismatchError,
-  UnsupportedAlgorithmError
+  UnauthorizedError,
+  UnsupportedAlgorithmError,
+  WalletOwnershipError
 });

package/dist/index.mjs

@@ -87,6 +87,42 @@ var ConfigurationError = class extends MoonXError {
     Object.setPrototypeOf(this, new.target.prototype);
   }
 };
+var IntegrationNotConfiguredError = class extends MoonXError {
+  constructor(message = "MoonPay funding is not configured or is disabled for this app") {
+    super("integration_not_configured", message);
+    this.name = "IntegrationNotConfiguredError";
+    Object.setPrototypeOf(this, new.target.prototype);
+  }
+};
+var WalletOwnershipError = class extends MoonXError {
+  constructor(message = "wallet address does not belong to this user") {
+    super("wallet_ownership", message);
+    this.name = "WalletOwnershipError";
+    Object.setPrototypeOf(this, new.target.prototype);
+  }
+};
+var RateLimitedError = class extends MoonXError {
+  constructor(message = "request was rate limited") {
+    super("rate_limited", message);
+    this.name = "RateLimitedError";
+    Object.setPrototypeOf(this, new.target.prototype);
+  }
+};
+var UnauthorizedError = class extends MoonXError {
+  constructor(message = "missing or invalid credentials") {
+    super("unauthorized", message);
+    this.name = "UnauthorizedError";
+    Object.setPrototypeOf(this, new.target.prototype);
+  }
+};
+var RequestFailedError = class extends MoonXError {
+  constructor(status, message) {
+    super("request_failed", message);
+    this.name = "RequestFailedError";
+    this.status = status;
+    Object.setPrototypeOf(this, new.target.prototype);
+  }
+};
 
 // src/auth/app-resolver.ts
 var AppResolver = class {
@@ -491,6 +527,111 @@ var EphemeralSigners = class {
   }
 };
 
+// src/funding/sign.ts
+async function signMoonPay(args) {
+  if (!args.accessToken || !args.accessToken.trim()) {
+    throw new ConfigurationError("funding.sign: accessToken is required");
+  }
+  if (!args.publicAddress || !args.publicAddress.trim()) {
+    throw new ConfigurationError("funding.sign: publicAddress is required");
+  }
+  if (args.uiConfig?.theme !== void 0 && args.uiConfig.theme !== "light" && args.uiConfig.theme !== "dark") {
+    throw new ConfigurationError(
+      'funding.sign: uiConfig.theme must be "light" or "dark"'
+    );
+  }
+  const fetcher = args.fetchImpl ?? globalThis.fetch;
+  const url = `${args.baseUrl.replace(/\/$/, "")}/v0/sdk/onramps/public/moonpay/sign`;
+  const config = {};
+  if (args.currencyCode !== void 0) config.currency_code = args.currencyCode;
+  if (args.quoteCurrencyAmount !== void 0) {
+    config.quote_currency_amount = args.quoteCurrencyAmount;
+  }
+  if (args.paymentMethod !== void 0) {
+    config.payment_method = args.paymentMethod;
+  }
+  if (args.uiConfig) {
+    const uiConfig = {};
+    if (args.uiConfig.theme !== void 0) uiConfig.theme = args.uiConfig.theme;
+    if (args.uiConfig.accentColor !== void 0) {
+      uiConfig.accent_color = args.uiConfig.accentColor;
+    }
+    if (Object.keys(uiConfig).length > 0) config.ui_config = uiConfig;
+  }
+  const body = {
+    public_address: args.publicAddress,
+    use_sandbox: args.useSandbox ?? false
+  };
+  if (Object.keys(config).length > 0) body.config = config;
+  let res;
+  try {
+    res = await fetcher(url, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        Authorization: `PublicToken ${args.publishableKey}`,
+        "X-MoonX-Access-Token": args.accessToken
+      },
+      body: JSON.stringify(body),
+      signal: AbortSignal.timeout(1e4)
+    });
+  } catch (err) {
+    throw new RequestFailedError(
+      0,
+      `moonpay sign request failed: ${err instanceof Error ? err.message : String(err)}`
+    );
+  }
+  if (!res.ok) {
+    const message = await errorMessage(res);
+    switch (res.status) {
+      case 400:
+        throw new IntegrationNotConfiguredError(message || void 0);
+      case 401:
+        throw new UnauthorizedError(message || void 0);
+      case 403:
+        throw new WalletOwnershipError(message || void 0);
+      case 429:
+        throw new RateLimitedError(message || void 0);
+      default:
+        throw new RequestFailedError(
+          res.status,
+          `moonpay sign failed: HTTP ${res.status}${message ? `: ${message}` : ""}`
+        );
+    }
+  }
+  return await res.json();
+}
+async function errorMessage(res) {
+  try {
+    const body = await res.json();
+    return body.error ?? body.message ?? "";
+  } catch {
+    return "";
+  }
+}
+
+// src/funding/index.ts
+var Funding = class {
+  constructor(cfg) {
+    this.cfg = cfg;
+  }
+  /**
+   * Request a signed MoonPay Buy-widget URL for the user's wallet. Returns the
+   * `signed_url` to open (plus the transaction id and provider publishable key
+   * used to track the purchase). Throws a typed {@link MoonXError} subclass on
+   * failure: IntegrationNotConfiguredError (400), UnauthorizedError (401),
+   * WalletOwnershipError (403), RateLimitedError (429).
+   */
+  async sign(params) {
+    return signMoonPay({
+      ...params,
+      baseUrl: this.cfg.baseUrl,
+      publishableKey: this.cfg.publishableKey,
+      fetchImpl: this.cfg.fetchImpl
+    });
+  }
+};
+
 // src/client.ts
 var MoonXClient = class {
   constructor(input) {
@@ -508,6 +649,11 @@ var MoonXClient = class {
       secretKey: cfg.secretKey,
       fetchImpl: cfg.fetch
     });
+    this.funding = new Funding({
+      baseUrl: cfg.baseUrl,
+      publishableKey: cfg.publishableKey,
+      fetchImpl: cfg.fetch
+    });
   }
 };
 
@@ -522,6 +668,8 @@ export {
   EphemeralSignerSignError,
   EphemeralSigners,
   ExpiredTokenError,
+  Funding,
+  IntegrationNotConfiguredError,
   InvalidTokenError,
   IssuerMismatchError,
   JwksFetchError,
@@ -529,6 +677,10 @@ export {
   MalformedTokenError,
   MoonXClient,
   MoonXError,
+  RateLimitedError,
+  RequestFailedError,
   SubjectMismatchError,
-  UnsupportedAlgorithmError
+  UnauthorizedError,
+  UnsupportedAlgorithmError,
+  WalletOwnershipError
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@moon-x/node-sdk",
-  "version": "0.7.1",
+  "version": "0.8.0",
   "description": "MoonX server-side SDK for Node.js. Verify MoonX-issued access + identity tokens with zero runtime dependencies.",
   "main": "dist/index.js",
   "module": "dist/index.mjs",
@@ -30,7 +30,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@moon-x/core": "0.11.0"
+    "@moon-x/core": "0.14.0"
   },
   "devDependencies": {
     "tsup": "8.5.1",