@rift-finance/wallet 1.4.33 → 3.0.0

package/dist/services/notifications.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"notifications.d.ts","sourceRoot":"","sources":["../../src/services/notifications.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EACL,WAAW,EACX,+BAA+B,EAC/B,wBAAwB,EACxB,uBAAuB,EACvB,uBAAuB,EACvB,wBAAwB,EACxB,4BAA4B,EAC7B,MAAM,UAAU,CAAC;AAElB,qBAAa,mBAAoB,SAAQ,WAAW;IAClD;;OAEG;IACG,oBAAoB,CACxB,OAAO,EAAE,+BAA+B,GACvC,OAAO,CAAC,WAAW,CAAC;QAAE,YAAY,EAAE,wBAAwB,CAAA;KAAE,CAAC,CAAC;IAcnE;;OAEG;IACG,WAAW,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;IAQnE;;OAEG;IACG,oBAAoB,IAAI,OAAO,CACnC,WAAW,CAAC;QACV,aAAa,EAAE,4BAA4B,EAAE,CAAC;QAC9C,WAAW,EAAE,MAAM,CAAC;QACpB,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC,CACH;IAaD;;OAEG;IACG,oBAAoB,CACxB,OAAO,EAAE,uBAAuB,GAC/B,OAAO,CAAC,WAAW,CAAC;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAa9C;;OAEG;IACG,wBAAwB,CAC5B,OAAO,EAAE,uBAAuB,GAC/B,OAAO,CAAC,WAAW,CAAC,wBAAwB,CAAC,CAAC;IAYjD;;OAEG;IACG,sBAAsB,IAAI,OAAO,CACrC,WAAW,CAAC;QAAE,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC,CACtC;CAMF"}
+{"version":3,"file":"notifications.d.ts","sourceRoot":"","sources":["../../src/services/notifications.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EACL,WAAW,EACX,+BAA+B,EAC/B,wBAAwB,EACxB,uBAAuB,EACvB,uBAAuB,EACvB,wBAAwB,EACxB,4BAA4B,EAC7B,MAAM,UAAU,CAAC;AAElB;;;;;;;;;GASG;AACH,qBAAa,mBAAoB,SAAQ,WAAW;IAClD,wEAAwE;IAClE,oBAAoB,CACxB,QAAQ,EAAE,+BAA+B,GACxC,OAAO,CAAC,WAAW,CAAC;QAAE,YAAY,EAAE,wBAAwB,CAAA;KAAE,CAAC,CAAC;IAMnE,wEAAwE;IAClE,WAAW,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;IAIpE,wEAAwE;IAClE,oBAAoB,IAAI,OAAO,CACnC,WAAW,CAAC;QACV,aAAa,EAAE,4BAA4B,EAAE,CAAC;QAC9C,WAAW,EAAE,MAAM,CAAC;QACpB,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC,CACH;IAID,wEAAwE;IAClE,sBAAsB,IAAI,OAAO,CAAC,WAAW,CAAC;QAAE,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAI9E;;;;OAIG;IACG,oBAAoB,CACxB,OAAO,EAAE,uBAAuB,GAC/B,OAAO,CAAC,WAAW,CAAC;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAY9C;;OAEG;IACG,wBAAwB,CAC5B,OAAO,EAAE,uBAAuB,GAC/B,OAAO,CAAC,WAAW,CAAC,wBAAwB,CAAC,CAAC;CAWlD"}

package/dist/services/notifications.js

@@ -2,49 +2,43 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.NotificationService = void 0;
 const base_service_1 = require("../base-service");
+/**
+ * NotificationService — email-only in v1.
+ *
+ * The backend dropped push notifications (Pusher Beams, Webpushr, Firebase)
+ * and the per-device subscription registry. The remaining surface is
+ * email delivery via Resend, branded per project. We keep the class
+ * signatures of the push methods for backwards compatibility but they
+ * now throw a clear error so callers can find them quickly. Use
+ * `sendTestNotification` and `sendToAllUserSubscribers` to deliver email.
+ */
 class NotificationService extends base_service_1.BaseService {
-    /**
-     * Register or update a notification subscription for the current user
-     */
-    async registerSubscription(request) {
-        return this.authenticatedRequest({
-            method: "POST",
-            url: "/notifications/register",
-            data: {
-                subscriberId: request.subscriberId,
-                deviceInfo: request.deviceInfo,
-                platform: request.platform,
-            },
-        });
+    /** @deprecated Push notifications are removed in v1. No-op (throws). */
+    async registerSubscription(_request) {
+        throw new Error("registerSubscription was removed in v1 — push notifications are no longer supported. Email is delivered automatically to the user's recorded email.");
     }
-    /**
-     * Unsubscribe from notifications
-     */
-    async unsubscribe(subscriberId) {
-        return this.authenticatedRequest({
-            method: "POST",
-            url: "/notifications/unsubscribe",
-            data: { subscriberId },
-        });
+    /** @deprecated Push notifications are removed in v1. No-op (throws). */
+    async unsubscribe(_subscriberId) {
+        throw new Error("unsubscribe was removed in v1 — there are no per-device push subscriptions to remove.");
     }
-    /**
-     * Get all notification subscriptions for the current user
-     */
+    /** @deprecated Push notifications are removed in v1. No-op (throws). */
     async getUserSubscriptions() {
-        return this.authenticatedRequest({
-            method: "GET",
-            url: "/notifications/subscriptions",
-        });
+        throw new Error("getUserSubscriptions was removed in v1 — there are no per-device push subscriptions to list.");
+    }
+    /** @deprecated Push notifications are removed in v1. No-op (throws). */
+    async deleteAllSubscriptions() {
+        throw new Error("deleteAllSubscriptions was removed in v1 — there are no per-device push subscriptions to delete.");
     }
     /**
-     * Send a test notification to a specific subscriber
+     * Send a test email notification to the authenticated user. The legacy
+     * `subscriberId` field is ignored (kept on the request shape for source
+     * compatibility); delivery is to the user's recorded email.
      */
     async sendTestNotification(request) {
         return this.authenticatedRequest({
             method: "POST",
-            url: "/notifications/test",
+            url: "/v1/notifications/test",
             data: {
-                subscriberId: request.subscriberId,
                 message: request.message,
                 targetUrl: request.targetUrl,
                 title: request.title,
@@ -52,12 +46,12 @@ class NotificationService extends base_service_1.BaseService {
         });
     }
     /**
-     * Send notification to all subscribers of the current user
+     * Send a notification email to the authenticated user.
      */
     async sendToAllUserSubscribers(request) {
         return this.authenticatedRequest({
             method: "POST",
-            url: "/notifications/send",
+            url: "/v1/notifications/messages",
             data: {
                 message: request.message,
                 targetUrl: request.targetUrl,
@@ -65,15 +59,6 @@ class NotificationService extends base_service_1.BaseService {
             },
         });
     }
-    /**
-     * Delete all notification subscriptions for the current user
-     */
-    async deleteAllSubscriptions() {
-        return this.authenticatedRequest({
-            method: "DELETE",
-            url: "/notifications/subscriptions",
-        });
-    }
 }
 exports.NotificationService = NotificationService;
 //# sourceMappingURL=notifications.js.map

package/dist/services/notifications.js.map

@@ -1 +1 @@
-{"version":3,"file":"notifications.js","sourceRoot":"","sources":["../../src/services/notifications.ts"],"names":[],"mappings":";;;AAAA,kDAA8C;AAW9C,MAAa,mBAAoB,SAAQ,0BAAW;IAClD;;OAEG;IACH,KAAK,CAAC,oBAAoB,CACxB,OAAwC;QAExC,OAAO,IAAI,CAAC,oBAAoB,CAE9B;YACA,MAAM,EAAE,MAAM;YACd,GAAG,EAAE,yBAAyB;YAC9B,IAAI,EAAE;gBACJ,YAAY,EAAE,OAAO,CAAC,YAAY;gBAClC,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,QAAQ,EAAE,OAAO,CAAC,QAAQ;aAC3B;SACF,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,WAAW,CAAC,YAAoB;QACpC,OAAO,IAAI,CAAC,oBAAoB,CAAoB;YAClD,MAAM,EAAE,MAAM;YACd,GAAG,EAAE,4BAA4B;YACjC,IAAI,EAAE,EAAE,YAAY,EAAE;SACvB,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,oBAAoB;QAOxB,OAAO,IAAI,CAAC,oBAAoB,CAM9B;YACA,MAAM,EAAE,KAAK;YACb,GAAG,EAAE,8BAA8B;SACpC,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,oBAAoB,CACxB,OAAgC;QAEhC,OAAO,IAAI,CAAC,oBAAoB,CAAqC;YACnE,MAAM,EAAE,MAAM;YACd,GAAG,EAAE,qBAAqB;YAC1B,IAAI,EAAE;gBACJ,YAAY,EAAE,OAAO,CAAC,YAAY;gBAClC,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,KAAK,EAAE,OAAO,CAAC,KAAK;aACrB;SACF,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,wBAAwB,CAC5B,OAAgC;QAEhC,OAAO,IAAI,CAAC,oBAAoB,CAAwC;YACtE,MAAM,EAAE,MAAM;YACd,GAAG,EAAE,qBAAqB;YAC1B,IAAI,EAAE;gBACJ,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,KAAK,EAAE,OAAO,CAAC,KAAK;aACrB;SACF,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,sBAAsB;QAG1B,OAAO,IAAI,CAAC,oBAAoB,CAAwC;YACtE,MAAM,EAAE,QAAQ;YAChB,GAAG,EAAE,8BAA8B;SACpC,CAAC,CAAC;IACL,CAAC;CACF;AAnGD,kDAmGC"}
+{"version":3,"file":"notifications.js","sourceRoot":"","sources":["../../src/services/notifications.ts"],"names":[],"mappings":";;;AAAA,kDAA8C;AAW9C;;;;;;;;;GASG;AACH,MAAa,mBAAoB,SAAQ,0BAAW;IAClD,wEAAwE;IACxE,KAAK,CAAC,oBAAoB,CACxB,QAAyC;QAEzC,MAAM,IAAI,KAAK,CACb,qJAAqJ,CACtJ,CAAC;IACJ,CAAC;IAED,wEAAwE;IACxE,KAAK,CAAC,WAAW,CAAC,aAAqB;QACrC,MAAM,IAAI,KAAK,CAAC,uFAAuF,CAAC,CAAC;IAC3G,CAAC;IAED,wEAAwE;IACxE,KAAK,CAAC,oBAAoB;QAOxB,MAAM,IAAI,KAAK,CAAC,8FAA8F,CAAC,CAAC;IAClH,CAAC;IAED,wEAAwE;IACxE,KAAK,CAAC,sBAAsB;QAC1B,MAAM,IAAI,KAAK,CAAC,kGAAkG,CAAC,CAAC;IACtH,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,oBAAoB,CACxB,OAAgC;QAEhC,OAAO,IAAI,CAAC,oBAAoB,CAAqC;YACnE,MAAM,EAAE,MAAM;YACd,GAAG,EAAE,wBAAwB;YAC7B,IAAI,EAAE;gBACJ,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,KAAK,EAAE,OAAO,CAAC,KAAK;aACrB;SACF,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,wBAAwB,CAC5B,OAAgC;QAEhC,OAAO,IAAI,CAAC,oBAAoB,CAAwC;YACtE,MAAM,EAAE,MAAM;YACd,GAAG,EAAE,4BAA4B;YACjC,IAAI,EAAE;gBACJ,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,KAAK,EAAE,OAAO,CAAC,KAAK;aACrB;SACF,CAAC,CAAC;IACL,CAAC;CACF;AAlED,kDAkEC"}

package/dist/services/offramp.js

@@ -14,27 +14,27 @@ class OfframpService extends base_service_1.BaseService {
     async previewExchangeRate(request) {
         return this.authenticatedRequest({
             method: "POST",
-            url: "/offramp/preview_exchange_rate",
+            url: "/v1/rates/quote",
             data: request,
         });
     }
     async getSupportedInstitutions(currency) {
         return this.authenticatedRequest({
             method: "GET",
-            url: `/offramp/payment_methods/${currency}`,
+            url: `/v1/rails/${currency}/payment-methods`,
         });
     }
     async sendPaymentLink(request) {
         return this.authenticatedRequest({
             method: "POST",
-            url: "/offramp/send-payment-link",
+            url: "/v1/invoices/notifications",
             data: request,
         });
     }
     async pay(request) {
         return this.authenticatedRequest({
             method: "POST",
-            url: "/offramp/pay",
+            url: "/v1/offramps",
             data: request,
         });
     }
@@ -46,14 +46,14 @@ class OfframpService extends base_service_1.BaseService {
     async createOrder(request) {
         return this.authenticatedRequest({
             method: "POST",
-            url: "/offramp/offramp",
+            url: "/v1/offramps",
             data: request,
         });
     }
     async getWithdrawalFee(amount) {
         return this.authenticatedRequest({
             method: "POST",
-            url: "/offramp/get-withdrawal-fee",
+            url: "/v1/rates/withdrawal-fee",
             data: { amount }
         });
     }
@@ -65,7 +65,7 @@ class OfframpService extends base_service_1.BaseService {
     async pollOrderStatus(request) {
         return this.authenticatedRequest({
             method: "GET",
-            url: "/offramp/poll_order_status",
+            url: "/v1/offramps/by-code",
             params: request
         });
     }
@@ -76,7 +76,7 @@ class OfframpService extends base_service_1.BaseService {
     async getOrders() {
         return this.authenticatedRequest({
             method: "GET",
-            url: "/offramp/get_orders",
+            url: "/v1/offramps",
         });
     }
 }

package/dist/services/offramp.js.map

@@ -1 +1 @@
-{"version":3,"file":"offramp.js","sourceRoot":"","sources":["../../src/services/offramp.ts"],"names":[],"mappings":";;;AAAA,kDAA8C;AAoB9C,MAAa,cAAe,SAAQ,0BAAW;IAC7C,YAAY,UAA0B;QACpC,KAAK,CAAC,UAAU,CAAC,CAAC;IACpB,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,mBAAmB,CACvB,OAAmC;QAEnC,OAAO,IAAI,CAAC,oBAAoB,CAA8B;YAC5D,MAAM,EAAE,MAAM;YACd,GAAG,EAAE,gCAAgC;YACrC,IAAI,EAAE,OAAO;SACd,CAAC,CAAC;IACL,CAAC;IAGD,KAAK,CAAC,wBAAwB,CAAC,QAAyB;QACtD,OAAO,IAAI,CAAC,oBAAoB,CAAmC;YACjE,MAAM,EAAE,KAAK;YACb,GAAG,EAAE,4BAA4B,QAAQ,EAAE;SAC5C,CAAC,CAAC;IACL,CAAC;IAGD,KAAK,CAAC,eAAe,CAAC,OAA+B;QACnD,OAAO,IAAI,CAAC,oBAAoB,CAA0B;YACxD,MAAM,EAAE,MAAM;YACd,GAAG,EAAE,4BAA4B;YACjC,IAAI,EAAE,OAAO;SACd,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,GAAG,CAAE,OAAmB;QAC5B,OAAO,IAAI,CAAC,oBAAoB,CAAc;YAC5C,MAAM,EAAE,MAAM;YACd,GAAG,EAAE,cAAc;YACnB,IAAI,EAAE,OAAO;SACd,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,WAAW,CACf,OAAkC;QAElC,OAAO,IAAI,CAAC,oBAAoB,CAA6B;YAC3D,MAAM,EAAE,MAAM;YACd,GAAG,EAAE,kBAAkB;YACvB,IAAI,EAAE,OAAO;SACd,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,MAAc;QACnC,OAAO,IAAI,CAAC,oBAAoB,CAA2B;YACzD,MAAM,EAAE,MAAM;YACd,GAAG,EAAE,6BAA6B;YAClC,IAAI,EAAC,EAAC,MAAM,EAAC;SACd,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,eAAe,CACnB,OAAgC;QAEhC,OAAO,IAAI,CAAC,oBAAoB,CAA2B;YACzD,MAAM,EAAE,KAAK;YACb,GAAG,EAAE,4BAA4B;YACjC,MAAM,EAAE,OAAO;SAEhB,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,SAAS;QACb,OAAO,IAAI,CAAC,oBAAoB,CAA2B;YACzD,MAAM,EAAE,KAAK;YACb,GAAG,EAAE,qBAAqB;SAC3B,CAAC,CAAC;IACL,CAAC;CACF;AA9FD,wCA8FC"}
+{"version":3,"file":"offramp.js","sourceRoot":"","sources":["../../src/services/offramp.ts"],"names":[],"mappings":";;;AAAA,kDAA8C;AAoB9C,MAAa,cAAe,SAAQ,0BAAW;IAC7C,YAAY,UAA0B;QACpC,KAAK,CAAC,UAAU,CAAC,CAAC;IACpB,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,mBAAmB,CACvB,OAAmC;QAEnC,OAAO,IAAI,CAAC,oBAAoB,CAA8B;YAC5D,MAAM,EAAE,MAAM;YACd,GAAG,EAAE,iBAAiB;YACtB,IAAI,EAAE,OAAO;SACd,CAAC,CAAC;IACL,CAAC;IAGD,KAAK,CAAC,wBAAwB,CAAC,QAAyB;QACtD,OAAO,IAAI,CAAC,oBAAoB,CAAmC;YACjE,MAAM,EAAE,KAAK;YACb,GAAG,EAAE,aAAa,QAAQ,kBAAkB;SAC7C,CAAC,CAAC;IACL,CAAC;IAGD,KAAK,CAAC,eAAe,CAAC,OAA+B;QACnD,OAAO,IAAI,CAAC,oBAAoB,CAA0B;YACxD,MAAM,EAAE,MAAM;YACd,GAAG,EAAE,4BAA4B;YACjC,IAAI,EAAE,OAAO;SACd,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,GAAG,CAAE,OAAmB;QAC5B,OAAO,IAAI,CAAC,oBAAoB,CAAc;YAC5C,MAAM,EAAE,MAAM;YACd,GAAG,EAAE,cAAc;YACnB,IAAI,EAAE,OAAO;SACd,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,WAAW,CACf,OAAkC;QAElC,OAAO,IAAI,CAAC,oBAAoB,CAA6B;YAC3D,MAAM,EAAE,MAAM;YACd,GAAG,EAAE,cAAc;YACnB,IAAI,EAAE,OAAO;SACd,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,MAAc;QACnC,OAAO,IAAI,CAAC,oBAAoB,CAA2B;YACzD,MAAM,EAAE,MAAM;YACd,GAAG,EAAE,0BAA0B;YAC/B,IAAI,EAAC,EAAC,MAAM,EAAC;SACd,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,eAAe,CACnB,OAAgC;QAEhC,OAAO,IAAI,CAAC,oBAAoB,CAA2B;YACzD,MAAM,EAAE,KAAK;YACb,GAAG,EAAE,sBAAsB;YAC3B,MAAM,EAAE,OAAO;SAEhB,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,SAAS;QACb,OAAO,IAAI,CAAC,oBAAoB,CAA2B;YACzD,MAAM,EAAE,KAAK;YACb,GAAG,EAAE,cAAc;SACpB,CAAC,CAAC;IACL,CAAC;CACF;AA9FD,wCA8FC"}

package/dist/services/oidc-helper.d.ts

@@ -0,0 +1,101 @@
+/**
+ * OIDC helper — browser-only.
+ *
+ * Wraps the Google Identity Services (GIS) flow to produce id_tokens
+ * with a `nonce` claim bound to a specific user-op hash. The enclave
+ * verifies that nonce matches the prehash it's about to sign, so a
+ * stolen token can only authorise the exact transaction it was minted
+ * for.
+ *
+ * Typical usage:
+ *
+ *   // 1. Once, when the user clicks "Sign in with Google":
+ *   const enrolment = await OidcHelper.fetchEnrolment({ clientId, nonce: enrolNonce });
+ *   await sdk.auth.migrateToV3({ enrolledMethods: [enrolment.method] });
+ *
+ *   // 2. Per transaction, when the user clicks "Send":
+ *   const userOpHashHex = await sdk.transactions.previewUserOpHash({ ... });
+ *   const proof = await OidcHelper.sign({ clientId, userOpHashHex });
+ *   await sdk.transactions.send({ ..., authProof: proof });
+ *
+ * Requires the Google Sign-In script to be reachable from the page —
+ * we load it dynamically on first use, no <script> tag needed.
+ *
+ * Apple support: SAME shape, different IdP. Add `OidcHelper.signWithApple`
+ * later — the spec is identical, only the script URL + payload differ.
+ */
+import type { AuthProof, EnrolledMethod } from "../types";
+interface GisAccountsId {
+    initialize: (config: {
+        client_id: string;
+        nonce?: string;
+        callback: (resp: {
+            credential: string;
+        }) => void;
+        auto_select?: boolean;
+        cancel_on_tap_outside?: boolean;
+        use_fedcm_for_prompt?: boolean;
+    }) => void;
+    prompt: (listener?: (n: unknown) => void) => void;
+    renderButton: (el: HTMLElement, options: Record<string, unknown>) => void;
+    disableAutoSelect: () => void;
+}
+declare global {
+    interface Window {
+        google?: {
+            accounts?: {
+                id?: GisAccountsId;
+            };
+        };
+    }
+}
+export interface OidcEnrolmentResult {
+    /** Pass this directly to signup / login / migrateToV3 as enrolledMethods[i]. */
+    method: EnrolledMethod;
+    /** The raw id_token — useful if you also want to send it as a one-shot authProof. */
+    idToken: string;
+}
+export declare class OidcHelper {
+    /**
+     * Fetch a Google id_token for enrolment. The user picks a Google
+     * account in the consent flow. The returned `method` is what you
+     * pass to `auth.migrateToV3()` or as `enrolledMethods` at signup.
+     *
+     * The `nonce` here is anti-replay for enrolment only — you can use
+     * any opaque value (a random UUID is fine). For per-transaction
+     * signing, use `sign()` instead, which binds nonce=user_op_hash.
+     */
+    static fetchEnrolment(opts: {
+        clientId: string;
+        /** Random opaque value. Defaults to a fresh crypto.randomUUID(). */
+        nonce?: string;
+        /** Where to render the Google button. Required. */
+        buttonContainer: HTMLElement;
+        /** Optional button visual config — see GIS docs. */
+        buttonOptions?: Record<string, unknown>;
+    }): Promise<OidcEnrolmentResult>;
+    /**
+     * Sign a specific user-op hash via Google. The id_token's `nonce`
+     * claim will equal `userOpHashHex` (no 0x prefix), which the enclave
+     * uses to bind this proof to this specific transaction.
+     *
+     * `clientId` MUST be the same one you used at enrolment (it ends up
+     * in the JWT's `aud` claim, which the enclave checks against its
+     * pinned accept list).
+     */
+    static sign(opts: {
+        clientId: string;
+        /** 32-byte hash, hex, with or without 0x prefix. */
+        userOpHashHex: string;
+        buttonContainer: HTMLElement;
+        buttonOptions?: Record<string, unknown>;
+    }): Promise<AuthProof>;
+    /**
+     * Lower-level: render a Google Sign-In button and wait for the user
+     * to click it. Returns the raw id_token. Used internally by both
+     * fetchEnrolment and sign.
+     */
+    private static requestIdToken;
+}
+export {};
+//# sourceMappingURL=oidc-helper.d.ts.map

package/dist/services/oidc-helper.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc-helper.d.ts","sourceRoot":"","sources":["../../src/services/oidc-helper.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAI1D,UAAU,aAAa;IACrB,UAAU,EAAE,CAAC,MAAM,EAAE;QACnB,SAAS,EAAE,MAAM,CAAC;QAClB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,QAAQ,EAAE,CAAC,IAAI,EAAE;YAAE,UAAU,EAAE,MAAM,CAAA;SAAE,KAAK,IAAI,CAAC;QACjD,WAAW,CAAC,EAAE,OAAO,CAAC;QACtB,qBAAqB,CAAC,EAAE,OAAO,CAAC;QAChC,oBAAoB,CAAC,EAAE,OAAO,CAAC;KAChC,KAAK,IAAI,CAAC;IACX,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,OAAO,KAAK,IAAI,KAAK,IAAI,CAAC;IAClD,YAAY,EAAE,CACZ,EAAE,EAAE,WAAW,EACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC7B,IAAI,CAAC;IACV,iBAAiB,EAAE,MAAM,IAAI,CAAC;CAC/B;AAED,OAAO,CAAC,MAAM,CAAC;IACb,UAAU,MAAM;QACd,MAAM,CAAC,EAAE;YAAE,QAAQ,CAAC,EAAE;gBAAE,EAAE,CAAC,EAAE,aAAa,CAAA;aAAE,CAAA;SAAE,CAAC;KAChD;CACF;AA6DD,MAAM,WAAW,mBAAmB;IAClC,gFAAgF;IAChF,MAAM,EAAE,cAAc,CAAC;IACvB,qFAAqF;IACrF,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,qBAAa,UAAU;IACrB;;;;;;;;OAQG;WACU,cAAc,CAAC,IAAI,EAAE;QAChC,QAAQ,EAAE,MAAM,CAAC;QACjB,oEAAoE;QACpE,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,mDAAmD;QACnD,eAAe,EAAE,WAAW,CAAC;QAC7B,oDAAoD;QACpD,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACzC,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAchC;;;;;;;;OAQG;WACU,IAAI,CAAC,IAAI,EAAE;QACtB,QAAQ,EAAE,MAAM,CAAC;QACjB,oDAAoD;QACpD,aAAa,EAAE,MAAM,CAAC;QACtB,eAAe,EAAE,WAAW,CAAC;QAC7B,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACzC,GAAG,OAAO,CAAC,SAAS,CAAC;IActB;;;;OAIG;mBACkB,cAAc;CAuCpC"}

package/dist/services/oidc-helper.js

@@ -0,0 +1,171 @@
+"use strict";
+/**
+ * OIDC helper — browser-only.
+ *
+ * Wraps the Google Identity Services (GIS) flow to produce id_tokens
+ * with a `nonce` claim bound to a specific user-op hash. The enclave
+ * verifies that nonce matches the prehash it's about to sign, so a
+ * stolen token can only authorise the exact transaction it was minted
+ * for.
+ *
+ * Typical usage:
+ *
+ *   // 1. Once, when the user clicks "Sign in with Google":
+ *   const enrolment = await OidcHelper.fetchEnrolment({ clientId, nonce: enrolNonce });
+ *   await sdk.auth.migrateToV3({ enrolledMethods: [enrolment.method] });
+ *
+ *   // 2. Per transaction, when the user clicks "Send":
+ *   const userOpHashHex = await sdk.transactions.previewUserOpHash({ ... });
+ *   const proof = await OidcHelper.sign({ clientId, userOpHashHex });
+ *   await sdk.transactions.send({ ..., authProof: proof });
+ *
+ * Requires the Google Sign-In script to be reachable from the page —
+ * we load it dynamically on first use, no <script> tag needed.
+ *
+ * Apple support: SAME shape, different IdP. Add `OidcHelper.signWithApple`
+ * later — the spec is identical, only the script URL + payload differ.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OidcHelper = void 0;
+const GIS_SRC = "https://accounts.google.com/gsi/client";
+function assertBrowser() {
+    if (typeof window === "undefined" || typeof document === "undefined") {
+        throw new Error("OidcHelper can only be used in a browser — it depends on Google Identity Services. On the server, call your backend's OAuth-handling endpoint instead.");
+    }
+}
+async function loadGis() {
+    assertBrowser();
+    if (window.google?.accounts?.id)
+        return window.google.accounts.id;
+    await new Promise((resolve, reject) => {
+        const existing = document.querySelector(`script[src="${GIS_SRC}"]`);
+        if (existing) {
+            // Wait for it to load.
+            existing.addEventListener("load", () => resolve(), { once: true });
+            existing.addEventListener("error", () => reject(new Error("GIS script failed")), { once: true });
+            // If it's already loaded, the event has fired and we'll hang.
+            // Resolve immediately if google.accounts.id already exists.
+            if (window.google?.accounts?.id)
+                resolve();
+            return;
+        }
+        const s = document.createElement("script");
+        s.src = GIS_SRC;
+        s.async = true;
+        s.defer = true;
+        s.onload = () => resolve();
+        s.onerror = () => reject(new Error("failed to load Google Identity Services script"));
+        document.head.appendChild(s);
+    });
+    if (!window.google?.accounts?.id) {
+        throw new Error("Google Identity Services loaded but accounts.id is not available");
+    }
+    return window.google.accounts.id;
+}
+/**
+ * Decoded subset of the id_token claims we need to construct an
+ * `EnrolledMethod`. Decoded client-side; the enclave does the real
+ * verification — this is just to populate (iss, sub) for the user.
+ */
+function decodeJwtUnverified(jwt) {
+    const parts = jwt.split(".");
+    if (parts.length !== 3)
+        throw new Error("not a JWT");
+    // base64url-decode the payload
+    const payloadB64 = parts[1].replace(/-/g, "+").replace(/_/g, "/");
+    const padded = payloadB64 + "===".slice(0, (4 - (payloadB64.length % 4)) % 4);
+    const json = atob(padded);
+    const obj = JSON.parse(json);
+    if (!obj.iss || !obj.sub) {
+        throw new Error("id_token missing iss or sub");
+    }
+    return { iss: obj.iss, sub: obj.sub };
+}
+class OidcHelper {
+    /**
+     * Fetch a Google id_token for enrolment. The user picks a Google
+     * account in the consent flow. The returned `method` is what you
+     * pass to `auth.migrateToV3()` or as `enrolledMethods` at signup.
+     *
+     * The `nonce` here is anti-replay for enrolment only — you can use
+     * any opaque value (a random UUID is fine). For per-transaction
+     * signing, use `sign()` instead, which binds nonce=user_op_hash.
+     */
+    static async fetchEnrolment(opts) {
+        const idToken = await OidcHelper.requestIdToken({
+            clientId: opts.clientId,
+            nonce: opts.nonce ?? crypto.randomUUID(),
+            buttonContainer: opts.buttonContainer,
+            buttonOptions: opts.buttonOptions,
+        });
+        const { iss, sub } = decodeJwtUnverified(idToken);
+        return {
+            method: { kind: "oidc", iss, sub },
+            idToken,
+        };
+    }
+    /**
+     * Sign a specific user-op hash via Google. The id_token's `nonce`
+     * claim will equal `userOpHashHex` (no 0x prefix), which the enclave
+     * uses to bind this proof to this specific transaction.
+     *
+     * `clientId` MUST be the same one you used at enrolment (it ends up
+     * in the JWT's `aud` claim, which the enclave checks against its
+     * pinned accept list).
+     */
+    static async sign(opts) {
+        const nonce = opts.userOpHashHex.replace(/^0x/i, "").toLowerCase();
+        if (!/^[0-9a-f]{64}$/.test(nonce)) {
+            throw new Error("userOpHashHex must be 32 bytes hex");
+        }
+        const idToken = await OidcHelper.requestIdToken({
+            clientId: opts.clientId,
+            nonce,
+            buttonContainer: opts.buttonContainer,
+            buttonOptions: opts.buttonOptions,
+        });
+        return { kind: "oidc", id_token: idToken };
+    }
+    /**
+     * Lower-level: render a Google Sign-In button and wait for the user
+     * to click it. Returns the raw id_token. Used internally by both
+     * fetchEnrolment and sign.
+     */
+    static async requestIdToken(opts) {
+        const gis = await loadGis();
+        return new Promise((resolve, reject) => {
+            let resolved = false;
+            try {
+                gis.initialize({
+                    client_id: opts.clientId,
+                    nonce: opts.nonce,
+                    callback: (resp) => {
+                        if (resolved)
+                            return;
+                        resolved = true;
+                        if (!resp.credential) {
+                            reject(new Error("Google returned no credential"));
+                            return;
+                        }
+                        resolve(resp.credential);
+                    },
+                    auto_select: false,
+                    cancel_on_tap_outside: false,
+                });
+                // Clear and render fresh button so the latest nonce sticks.
+                opts.buttonContainer.innerHTML = "";
+                gis.renderButton(opts.buttonContainer, {
+                    theme: "outline",
+                    size: "large",
+                    text: "signin_with",
+                    ...opts.buttonOptions,
+                });
+            }
+            catch (e) {
+                reject(e);
+            }
+        });
+    }
+}
+exports.OidcHelper = OidcHelper;
+//# sourceMappingURL=oidc-helper.js.map

package/dist/services/oidc-helper.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc-helper.js","sourceRoot":"","sources":["../../src/services/oidc-helper.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;;;AAIH,MAAM,OAAO,GAAG,wCAAwC,CAAC;AAyBzD,SAAS,aAAa;IACpB,IAAI,OAAO,MAAM,KAAK,WAAW,IAAI,OAAO,QAAQ,KAAK,WAAW,EAAE,CAAC;QACrE,MAAM,IAAI,KAAK,CACb,wJAAwJ,CACzJ,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,OAAO;IACpB,aAAa,EAAE,CAAC;IAChB,IAAI,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,EAAE;QAAE,OAAO,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;IAElE,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1C,MAAM,QAAQ,GAAG,QAAQ,CAAC,aAAa,CACrC,eAAe,OAAO,IAAI,CAC3B,CAAC;QACF,IAAI,QAAQ,EAAE,CAAC;YACb,uBAAuB;YACvB,QAAQ,CAAC,gBAAgB,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YACnE,QAAQ,CAAC,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YACjG,8DAA8D;YAC9D,4DAA4D;YAC5D,IAAI,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,EAAE;gBAAE,OAAO,EAAE,CAAC;YAC3C,OAAO;QACT,CAAC;QACD,MAAM,CAAC,GAAG,QAAQ,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;QAC3C,CAAC,CAAC,GAAG,GAAG,OAAO,CAAC;QAChB,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC;QACf,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC;QACf,CAAC,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;QAC3B,CAAC,CAAC,OAAO,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC,CAAC;QACtF,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;IACtF,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;AACnC,CAAC;AAED;;;;GAIG;AACH,SAAS,mBAAmB,CAAC,GAAW;IACtC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,WAAW,CAAC,CAAC;IACrD,+BAA+B;IAC/B,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAClE,MAAM,MAAM,GAAG,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9E,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAmC,CAAC;IAC/D,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC;AACxC,CAAC;AASD,MAAa,UAAU;IACrB;;;;;;;;OAQG;IACH,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,IAQ3B;QACC,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,cAAc,CAAC;YAC9C,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,UAAU,EAAE;YACxC,eAAe,EAAE,IAAI,CAAC,eAAe;YACrC,aAAa,EAAE,IAAI,CAAC,aAAa;SAClC,CAAC,CAAC;QACH,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;QAClD,OAAO;YACL,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE;YAClC,OAAO;SACR,CAAC;IACJ,CAAC;IAED;;;;;;;;OAQG;IACH,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAMjB;QACC,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QACnE,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QACxD,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,cAAc,CAAC;YAC9C,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,KAAK;YACL,eAAe,EAAE,IAAI,CAAC,eAAe;YACrC,aAAa,EAAE,IAAI,CAAC,aAAa;SAClC,CAAC,CAAC;QACH,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;IAC7C,CAAC;IAED;;;;OAIG;IACK,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,IAKnC;QACC,MAAM,GAAG,GAAG,MAAM,OAAO,EAAE,CAAC;QAE5B,OAAO,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC7C,IAAI,QAAQ,GAAG,KAAK,CAAC;YACrB,IAAI,CAAC;gBACH,GAAG,CAAC,UAAU,CAAC;oBACb,SAAS,EAAE,IAAI,CAAC,QAAQ;oBACxB,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE;wBACjB,IAAI,QAAQ;4BAAE,OAAO;wBACrB,QAAQ,GAAG,IAAI,CAAC;wBAChB,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;4BACrB,MAAM,CAAC,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC,CAAC;4BACnD,OAAO;wBACT,CAAC;wBACD,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;oBAC3B,CAAC;oBACD,WAAW,EAAE,KAAK;oBAClB,qBAAqB,EAAE,KAAK;iBAC7B,CAAC,CAAC;gBACH,4DAA4D;gBAC5D,IAAI,CAAC,eAAe,CAAC,SAAS,GAAG,EAAE,CAAC;gBACpC,GAAG,CAAC,YAAY,CAAC,IAAI,CAAC,eAAe,EAAE;oBACrC,KAAK,EAAE,SAAS;oBAChB,IAAI,EAAE,OAAO;oBACb,IAAI,EAAE,aAAa;oBACnB,GAAG,IAAI,CAAC,aAAa;iBACtB,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,MAAM,CAAC,CAAC,CAAC,CAAC;YACZ,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;CACF;AAzGD,gCAyGC"}

package/dist/services/onramp_v2.js

@@ -9,14 +9,14 @@ class OnrampServiceV2 extends base_service_1.BaseService {
     async buy(request) {
         return this.authenticatedRequest({
             method: "POST",
-            url: "/offramp/onramp",
+            url: "/v1/onramps",
             data: request,
         });
     }
     async getOnrampStatus(transactionCode) {
         return this.authenticatedRequest({
             method: "POST",
-            url: `/offramp/onramp/status`,
+            url: `/v1/onramps/by-code`,
             data: {
                 transaction_code: transactionCode,
             },
@@ -25,7 +25,7 @@ class OnrampServiceV2 extends base_service_1.BaseService {
     async getOnrampOrders(userId) {
         return this.authenticatedRequest({
             method: "GET",
-            url: `/offramp/onramp/orders`,
+            url: `/v1/onramps`,
             params: {
                 userId,
             },

package/dist/services/onramp_v2.js.map

@@ -1 +1 @@
-{"version":3,"file":"onramp_v2.js","sourceRoot":"","sources":["../../src/services/onramp_v2.ts"],"names":[],"mappings":";;;AAAA,kDAA8C;AAU9C,MAAa,eAAgB,SAAQ,0BAAW;IAC9C,YAAY,UAA0B;QACpC,KAAK,CAAC,UAAU,CAAC,CAAC;IACpB,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,OAAmB;QAC3B,OAAO,IAAI,CAAC,oBAAoB,CAAc;YAC5C,MAAM,EAAE,MAAM;YACd,GAAG,EAAE,iBAAiB;YACtB,IAAI,EAAE,OAAO;SACd,CAAC,CAAC;IACL,CAAC;IAGD,KAAK,CAAC,eAAe,CAAC,eAAuB;QAC3C,OAAO,IAAI,CAAC,oBAAoB,CAAuB;YACrD,MAAM,EAAE,MAAM;YACd,GAAG,EAAE,wBAAwB;YAC7B,IAAI,EAAE;gBACJ,gBAAgB,EAAE,eAAe;aAClC;SACF,CAAC,CAAC;IACL,CAAC;IAGD,KAAK,CAAC,eAAe,CAAC,MAAc;QAClC,OAAO,IAAI,CAAC,oBAAoB,CAAyB;YACvD,MAAM,EAAE,KAAK;YACb,GAAG,EAAE,wBAAwB;YAC7B,MAAM,EAAE;gBACN,MAAM;aACP;SACF,CAAC,CAAC;IACL,CAAC;CACF;AAlCD,0CAkCC"}
+{"version":3,"file":"onramp_v2.js","sourceRoot":"","sources":["../../src/services/onramp_v2.ts"],"names":[],"mappings":";;;AAAA,kDAA8C;AAU9C,MAAa,eAAgB,SAAQ,0BAAW;IAC9C,YAAY,UAA0B;QACpC,KAAK,CAAC,UAAU,CAAC,CAAC;IACpB,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,OAAmB;QAC3B,OAAO,IAAI,CAAC,oBAAoB,CAAc;YAC5C,MAAM,EAAE,MAAM;YACd,GAAG,EAAE,aAAa;YAClB,IAAI,EAAE,OAAO;SACd,CAAC,CAAC;IACL,CAAC;IAGD,KAAK,CAAC,eAAe,CAAC,eAAuB;QAC3C,OAAO,IAAI,CAAC,oBAAoB,CAAuB;YACrD,MAAM,EAAE,MAAM;YACd,GAAG,EAAE,qBAAqB;YAC1B,IAAI,EAAE;gBACJ,gBAAgB,EAAE,eAAe;aAClC;SACF,CAAC,CAAC;IACL,CAAC;IAGD,KAAK,CAAC,eAAe,CAAC,MAAc;QAClC,OAAO,IAAI,CAAC,oBAAoB,CAAyB;YACvD,MAAM,EAAE,KAAK;YACb,GAAG,EAAE,aAAa;YAClB,MAAM,EAAE;gBACN,MAAM;aACP;SACF,CAAC,CAAC;IACL,CAAC;CACF;AAlCD,0CAkCC"}

package/dist/services/passkey-helper.d.ts

@@ -0,0 +1,82 @@
+/**
+ * Passkey helper — browser-only.
+ *
+ * Wraps `navigator.credentials.create()` and `navigator.credentials.get()`
+ * with all the small encoding ceremonies the enclave expects:
+ *
+ *   - Extracts X / Y coordinates from the SPKI-encoded public key the
+ *     browser hands us and re-packs them as a COSE_Key CBOR blob (which
+ *     is what the enclave's `webauthn_verification` module parses).
+ *   - Binds the assertion's challenge to a specific user-op hash so the
+ *     proof is non-replayable across transactions.
+ *   - Returns ready-to-send `EnrolledMethod` / `AuthProof` objects.
+ *
+ * Algorithm: ES256 / P-256 (COSE alg -7). Covers virtually all modern
+ * platform authenticators (iOS Secure Enclave, Android Keystore, Windows
+ * Hello on TPM, most YubiKey models).
+ *
+ * Note about RP-ID: the enclave's pinned policy accepts a list of RP-IDs
+ * (typically your top-level domain + "localhost" for dev). You must pass
+ * the SAME `rpId` to enrol() and sign() — passkeys are bound to one RP.
+ */
+import type { AuthProof, EnrolledMethod } from "../types";
+/** Quick capability check for "should I offer a passkey UI?". */
+export declare function isPasskeySupported(): boolean;
+/**
+ * Async capability check that also asks "does this device have a built-in
+ * authenticator (Touch ID, Face ID, Windows Hello)?". Returns false on
+ * desktops without biometric hardware unless a roaming key is connected.
+ */
+export declare function isPlatformPasskeySupported(): Promise<boolean>;
+export interface PasskeyEnrolmentResult {
+    /** Pass to signup / login / migrateToV3 as enrolledMethods[i]. */
+    method: EnrolledMethod;
+    /** Raw credential ID (base64-padded). Same value as method.cred_id_b64. */
+    credentialIdB64: string;
+    /** Raw COSE_Key bytes (base64-padded). Same as method.cose_pubkey_b64. */
+    cosePublicKeyB64: string;
+}
+export declare class PasskeyHelper {
+    /**
+     * Run a WebAuthn enrolment ceremony. Prompts the user for biometric /
+     * device PIN. Returns an `EnrolledMethod` ready to pass to the SDK.
+     *
+     * `rpId` should be your eTLD+1 (e.g. "riftfi.xyz") or "localhost" for
+     * dev. The SAME rpId must appear in the enclave's pinned policy
+     * (see WebAuthnPolicy.accepted_rp_ids).
+     */
+    static enrol(opts: {
+        rpId: string;
+        rpName: string;
+        /** User identifier — any opaque 16-32 byte value. Defaults to randomUUID bytes. */
+        userId?: Uint8Array;
+        /** Display string for the user — usually email or username. */
+        userName: string;
+        userDisplayName?: string;
+        /**
+         * If true (default), requires biometric / PIN verification at enrolment.
+         * Set to false for "device PIN only" or roaming-key-only flows.
+         */
+        requireUserVerification?: boolean;
+    }): Promise<PasskeyEnrolmentResult>;
+    /**
+     * Produce an `AuthProof` for a specific user-op hash. Prompts the
+     * user for biometric / PIN. The assertion's challenge is the raw
+     * 32-byte hash, so the resulting proof is bound to this exact
+     * transaction.
+     *
+     * Pass the SAME `rpId` you used at enrolment.
+     *
+     * `allowedCredentialIdB64` — restrict to a specific credential. Pass
+     * the one you stored at enrolment. If omitted, the browser picks
+     * among all credentials for this RP (discoverable credentials).
+     */
+    static sign(opts: {
+        rpId: string;
+        /** 32-byte hash, hex, with or without 0x prefix. */
+        userOpHashHex: string;
+        allowedCredentialIdB64?: string;
+        requireUserVerification?: boolean;
+    }): Promise<AuthProof>;
+}
+//# sourceMappingURL=passkey-helper.d.ts.map

package/dist/services/passkey-helper.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"passkey-helper.d.ts","sourceRoot":"","sources":["../../src/services/passkey-helper.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAc1D,iEAAiE;AACjE,wBAAgB,kBAAkB,IAAI,OAAO,CAO5C;AAED;;;;GAIG;AACH,wBAAsB,0BAA0B,IAAI,OAAO,CAAC,OAAO,CAAC,CAOnE;AAuED,MAAM,WAAW,sBAAsB;IACrC,kEAAkE;IAClE,MAAM,EAAE,cAAc,CAAC;IACvB,2EAA2E;IAC3E,eAAe,EAAE,MAAM,CAAC;IACxB,0EAA0E;IAC1E,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED,qBAAa,aAAa;IACxB;;;;;;;OAOG;WACU,KAAK,CAAC,IAAI,EAAE;QACvB,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,MAAM,CAAC;QACf,mFAAmF;QACnF,MAAM,CAAC,EAAE,UAAU,CAAC;QACpB,+DAA+D;QAC/D,QAAQ,EAAE,MAAM,CAAC;QACjB,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB;;;WAGG;QACH,uBAAuB,CAAC,EAAE,OAAO,CAAC;KACnC,GAAG,OAAO,CAAC,sBAAsB,CAAC;IA8CnC;;;;;;;;;;;OAWG;WACU,IAAI,CAAC,IAAI,EAAE;QACtB,IAAI,EAAE,MAAM,CAAC;QACb,oDAAoD;QACpD,aAAa,EAAE,MAAM,CAAC;QACtB,sBAAsB,CAAC,EAAE,MAAM,CAAC;QAChC,uBAAuB,CAAC,EAAE,OAAO,CAAC;KACnC,GAAG,OAAO,CAAC,SAAS,CAAC;CAmCvB"}