@tesser-payments/sdk-ts 0.0.4 → 0.2.0

package/README.md

@@ -1,9 +1,8 @@
 # @tesser-payments/sdk-ts
 
-Signer-only TypeScript SDK for Tesser API: locally stamp `signCreateWallet` and
-`signStep` activities using Turnkey API keys. The SDK does not own HTTP or
-OAuth — Tesser API supplies the unsigned transaction; this library only stamps
-it. Bring your own client.
+TypeScript SDK for the Tesser API: sign `signCreateWallet` and `signStep`
+requests locally with your signing key. The SDK does not handle OAuth or submit
+requests for you; bring your own client.
 
 ## Install
 
@@ -12,9 +11,7 @@ bun add @tesser-payments/sdk-ts @tesser-payments/types
 ```
 
 `@tesser-payments/types` is a peer dependency — install it alongside the SDK.
-`@turnkey/api-key-stamper` is a runtime dependency (used to locally stamp
-`signCreateWallet` and `signStep` activities) and is installed automatically;
-its Apache-2.0 license aligns with the SDK's. Apache 2.0 licensed.
+Apache 2.0 licensed.
 
 ## Quick start
 
@@ -25,7 +22,7 @@ const signer = new LocalSigner({
   signing: {
     publicKey: process.env.SIGNING_PUBLIC_KEY!,   // 33-byte compressed P-256
     privateKey: process.env.SIGNING_PRIVATE_KEY!,
-    enclaveId: process.env.SIGNING_ENCLAVE_ID!,   // Turnkey suborg ID
+    enclaveId: process.env.SIGNING_ENCLAVE_ID!,
   },
 });
 
@@ -52,6 +49,22 @@ const res = await fetch(`${API_BASE_URL}/v1/accounts/wallets`, {
 `signature` is `base64(JSON.stringify({ body, stamp }))` — drop it into the
 Tesser API request body as the documented `signature` field.
 
+`apiBaseUrl` is optional; pass it to use only that URL (`https://api.tesser.xyz`
+or `https://api-sandbox.tesser.xyz`; a trailing `/` or `/v1` is removed). Pass an
+optional `fetch` implementation to configure a proxy.
+
+`signCreateWallet` signs a wallet-creation request. For `stablecoin_ethereum`,
+it first fetches the request to sign from the Tesser API and checks that it
+matches your parameters. The private key never leaves your process. Tesser
+currently supports managed wallets for `stablecoin_ethereum` only.
+
+`LocalSigner({ signing })` works with production and sandbox signing keys.
+Without `apiBaseUrl`, the first `stablecoin_ethereum` `signCreateWallet` tries
+production and, if production does not accept your signing key, sandbox, and
+remembers it for later calls. Set `apiBaseUrl` if your network allows only one
+Tesser host, or if you create a new signer per request (each new signer detects
+again). Send your own API requests to the environment of your signing key.
+
 **Private-key handling.** `signer.signing` exposes only `{ publicKey, enclaveId }`.
 The private key lives on the instance as an ECMA private field and is not
 reachable via property access, `console.log`, or `JSON.stringify`. The SDK still
@@ -59,8 +72,7 @@ uses it internally to stamp activities — you just can't pull it back out.
 
 ## `signStep`
 
-`signStep` stamps a Turnkey `ACTIVITY_TYPE_SIGN_TRANSACTION_V2` body for a
-single rebalance step. Pass the unsigned transaction Tesser returned, the
+`signStep` signs a single rebalance step. Pass the unsigned transaction Tesser returned, the
 on-chain `signWith` address, and the network — that's all the SDK needs to
 produce a signature:
 
@@ -71,9 +83,7 @@ const step: StepForSigning = {
   unsignedTransaction: '0x02...',      // hex-encoded raw tx Tesser returned
   signWith: '0xabc...',                // account.crypto_wallet_address from
                                        //   GET /v1/accounts/{from_account_id}
-  network: 'BASE_SEPOLIA',             // BASE | BASE_SEPOLIA | ETHEREUM |
-                                       //   ETHEREUM_SEPOLIA | POLYGON |
-                                       //   POLYGON_AMOY | SOLANA
+  network: 'BASE_SEPOLIA',
 };
 
 const signed = await signer.signStep(step);
@@ -92,29 +102,55 @@ await fetch(
 ```
 
 `signStep` returns `{ signature, metadata }`. The `signature` field is what
-the Tesser API needs; `metadata` carries the underlying Turnkey activity body
-and stamp header value for debugging.
+the Tesser API needs; `metadata` carries the signed body and stamp header value
+for debugging.
 
 The `network` field is typed as `SupportedNetwork`, derived from the SDK's
-network-to-Turnkey-type table — so a typo like `'BASE-SEPOLIA'` (hyphen) is a
+supported-network table — so a typo like `'BASE-SEPOLIA'` (hyphen) is a
 compile-time error. If you're pulling the value out of a webhook payload or
 env var, cast it at that boundary.
 
+Supported networks are `BASE`, `BASE_SEPOLIA`, `ETHEREUM`, `ETHEREUM_SEPOLIA`,
+`POLYGON`, `POLYGON_AMOY`, `SOLANA`, `TEMPO`, and `TEMPO_MODERATO`.
+
+### Tempo transfers
+
+1. Pass the Tempo transaction Tesser provides (`0x76...`), your wallet
+   address, and `TEMPO` or `TEMPO_MODERATO` to `signStep`.
+2. The SDK authorizes the transaction with your API key, without changing
+   it. Submit the returned `signature` to the Tesser signing endpoint.
+3. Tesser completes the transfer, broadcasts it, and pays the network fee.
+
+Unknown networks raise `TesserConfigError` before anything is signed.
+
 ## Error handling
 
 The SDK mirrors Tesser's documented error envelope
 (<https://docs.tesser.xyz/overviews/errors>) rather than inventing a custom
-HTTP-status taxonomy. v0.0.1 only signs locally, so only the signing-side
-errors are exported:
+HTTP-status taxonomy:
 
 ```
 TesserError                       (base; .cause set on all)
 ├── TesserConfigError             bad input at construction or call site
-└── TesserSigningError            local signing failure
-    └── StampError                Turnkey ApiKeyStamper failed
+├── TesserAPIError                Tesser answered with an error status or
+│                                 an invalid response
+├── TesserConnectionError         the request to Tesser failed at the network level
+├── TesserTimeoutError            the request to Tesser timed out
+└── TesserSigningError            signing failure, or a fetched request that
+    │                             does not match your parameters
+    └── StampError                the signing key could not sign
 ```
 
-All three carry the original failure as `.cause` and can be discriminated via
+`TesserAPIError`, `TesserConnectionError`, and `TesserTimeoutError` come from
+the request `signCreateWallet` makes to Tesser for `stablecoin_ethereum`.
+`TesserAPIError` carries `status`, `headers`, `requestId`, and the parsed
+`errors[]` (with `errorCode` for the first one). `TesserConnectionError`,
+`TesserTimeoutError`, and a `TesserAPIError` with status 429 or 5xx are safe to
+retry; a `TesserAPIError` with any other 4xx status fails the same way on
+retry. Without `apiBaseUrl`, if neither production nor sandbox accepts your
+signing key, the `TesserAPIError` from production is thrown.
+
+Each error carries the original failure as `.cause` and can be discriminated via
 `instanceof` or the static `.is()` guard:
 
 ```typescript
@@ -124,7 +160,7 @@ try {
   await signer.signStep(step);
 } catch (err) {
   if (StampError.is(err)) {
-    // Turnkey rejected the stamp — usually a key-format problem.
+    // The key could not sign — usually a key-format problem.
   }
   if (TesserError.is(err)) {
     console.error('Signing failed', { name: err.name, cause: err.cause });
@@ -133,29 +169,19 @@ try {
 }
 ```
 
-HTTP-side errors (`TesserAPIError`, `TesserConnectionError`,
-`TesserTimeoutError`) will return when the optional bundled client lands in a
-future version. Until then, model HTTP failures with whatever your `fetch`
-wrapper produces.
-
 ## Setup notes
 
-`signing.publicKey` must be the **33-byte compressed** form Turnkey uses for
+`signing.publicKey` must be the **33-byte compressed** form Tesser uses for
 API-key auth lookups (66 hex chars, prefix `02` or `03`). Dashboards that
 display the 65-byte uncompressed form need to be compressed before use:
 
 ```sh
-bunx -p @turnkey/crypto node -e \
-  'const c = require("@turnkey/crypto"); \
-   const u = process.argv[1].replace(/^0x/i,""); \
-   const b = Buffer.from(u, "hex"); \
-   console.log(Buffer.from(c.compressRawPublicKey(b)).toString("hex"))' \
+node -e 'const u = process.argv[1].replace(/^0x/i, ""); console.log(require("node:crypto").ECDH.convertKey(u, "prime256v1", "hex", "hex", "compressed"))' \
   04...your-uncompressed-key...
 ```
 
-If a key is registered on Turnkey in uncompressed form, Turnkey rejects
-auth with `PUBLIC_KEY_NOT_FOUND` even when the keypair is logically
-correct — re-register the key in compressed form to fix.
+If a key is registered in uncompressed form, signing is rejected even when the
+keypair is logically correct — re-register the key in compressed form to fix.
 
 ## Examples
 
@@ -173,9 +199,7 @@ copy [`.env.example`](./.env.example) and fill in the values first.
 ## Out of scope
 
 - **`TesserClient`** — the previous bundled HTTP client (`getAccountAddress`,
-  retry/timeout/logger plumbing) is intentionally not in v0.0.1. We expect to
-  re-add it later as an opt-in `LocalSignerOptions.client` field; that change
-  is purely additive and will not break v0.0.1 call sites.
+  retry/timeout/logger plumbing) is intentionally not included.
 - **Webhook signature verification** — the header name and HMAC algorithm
   aren't currently documented in public Tesser docs.
 - **Solana / Stellar `signCreateWallet`** — exported as `@experimental` types;

package/dist/index.d.ts

@@ -2,5 +2,5 @@ export { LocalSigner } from './signer.js';
 export type { PublicSigningInfo } from './signer.js';
 export type { CreateWalletParams, LocalSignerOptions, SignedResult, SignedResultMetadata, SignedStepResult, SignedStepResultMetadata, SigningConfig, StepForSigning, WalletType, } from './internal/types.js';
 export type { SupportedNetwork } from './signing/network-type.js';
-export { StampError, TesserConfigError, TesserError, TesserSigningError, } from './internal/errors.js';
+export { StampError, TesserAPIError, TesserConfigError, TesserConnectionError, TesserError, TesserSigningError, TesserTimeoutError, } from './internal/errors.js';
 export type { TesserErrorDetail } from './internal/errors.js';

package/dist/index.js

@@ -18273,6 +18273,47 @@ class TesserConfigError extends TesserError {
     return err instanceof TesserConfigError;
   }
 }
+
+class TesserAPIError extends TesserError {
+  name = "TesserAPIError";
+  status;
+  headers;
+  requestId;
+  errors;
+  constructor(message, options) {
+    super(message, { cause: options.cause });
+    this.status = options.status;
+    if (options.headers !== undefined)
+      this.headers = options.headers;
+    if (options.requestId !== undefined)
+      this.requestId = options.requestId;
+    this.errors = options.errors ?? [];
+  }
+  get errorCode() {
+    return this.errors[0]?.errorCode;
+  }
+  hasCode(...codes) {
+    return this.errors.some((e) => codes.includes(e.errorCode));
+  }
+  static is(err) {
+    return err instanceof TesserAPIError;
+  }
+}
+
+class TesserConnectionError extends TesserError {
+  name = "TesserConnectionError";
+  static is(err) {
+    return err instanceof TesserConnectionError;
+  }
+}
+
+class TesserTimeoutError extends TesserError {
+  name = "TesserTimeoutError";
+  static is(err) {
+    return err instanceof TesserTimeoutError;
+  }
+}
+
 class TesserSigningError extends TesserError {
   name = "TesserSigningError";
   static is(err) {
@@ -19814,7 +19855,7 @@ var DNS = "dns";
 var DN = "dn";
 var EMAIL = "email";
 var IP = "ip";
-var URL = "url";
+var URL2 = "url";
 var GUID = "guid";
 var UPN = "upn";
 var REGISTERED_ID = "id";
@@ -19870,7 +19911,7 @@ class GeneralName extends AsnData {
           });
           break;
         }
-        case URL:
+        case URL2:
           name = new asn1X509__namespace.GeneralName({ uniformResourceIdentifier: args[1] });
           break;
         default:
@@ -19894,7 +19935,7 @@ class GeneralName extends AsnData {
       this.type = IP;
       this.value = asn.iPAddress;
     } else if (asn.uniformResourceIdentifier != null) {
-      this.type = URL;
+      this.type = URL2;
       this.value = asn.uniformResourceIdentifier;
     } else if (asn.registeredID != null) {
       this.type = REGISTERED_ID;
@@ -19941,7 +19982,7 @@ class GeneralName extends AsnData {
       case IP:
       case REGISTERED_ID:
       case UPN:
-      case URL:
+      case URL2:
         type = this.type.toUpperCase();
         break;
       case EMAIL:
@@ -21431,16 +21472,313 @@ async function stamp(keys, body) {
   }
 }
 
+// src/internal/version.ts
+var SDK_VERSION = "0.2.0";
+
+// src/signing/unsigned-payload.ts
+var UNSIGNED_PAYLOAD_PATH = "/v1/accounts/wallets/unsigned-payload";
+var CREATE_WALLET_ACCOUNTS_ACTIVITY_TYPE = "ACTIVITY_TYPE_CREATE_WALLET_ACCOUNTS";
+var ETHEREUM_ADDRESS_FORMAT = "ADDRESS_FORMAT_ETHEREUM";
+var UNSIGNED_PAYLOAD_TIMEOUT_MS = 1e4;
+var LOOPBACK_HOSTS = new Set(["localhost", "127.0.0.1", "[::1]"]);
+var MAX_FAILURE_CHAIN_DEPTH = 10;
+var PRODUCTION_API_BASE_URL = "https://api.tesser.xyz";
+var SANDBOX_API_BASE_URL = "https://api-sandbox.tesser.xyz";
+var DEFAULT_API_BASE_URLS = [PRODUCTION_API_BASE_URL, SANDBOX_API_BASE_URL];
+var STAMP_REJECTED_ERROR_CODE = "signing-4010";
+function createTesserApiConnection({
+  apiBaseUrl,
+  fetch: injectedFetch,
+  defaultBaseUrls = DEFAULT_API_BASE_URLS
+}) {
+  return {
+    fetch: resolveFetchImplementation(injectedFetch),
+    defaultBaseUrls,
+    resolvedBaseUrl: resolveExplicitApiBaseUrl(apiBaseUrl)
+  };
+}
+function resolveExplicitApiBaseUrl(apiBaseUrl) {
+  if (apiBaseUrl === undefined) {
+    return;
+  }
+  return normalizeApiBaseUrl(apiBaseUrl);
+}
+function resolveFetchImplementation(injectedFetch) {
+  if (injectedFetch !== undefined) {
+    return injectedFetch;
+  }
+  return globalThis.fetch;
+}
+function normalizeApiBaseUrl(apiBaseUrl) {
+  if (typeof apiBaseUrl !== "string") {
+    throw invalidApiBaseUrlError();
+  }
+  const withoutTrailingSlash = removeSuffix(apiBaseUrl.trim(), "/");
+  const normalized = removeSuffix(removeSuffix(withoutTrailingSlash, "/v1"), "/");
+  if (!isHttpsOrLoopbackHttpUrl(normalized)) {
+    throw invalidApiBaseUrlError();
+  }
+  return normalized;
+}
+function invalidApiBaseUrlError() {
+  return new TesserConfigError("LocalSigner: apiBaseUrl must be an https URL, for example https://api.tesser.xyz");
+}
+function removeSuffix(value, suffix) {
+  if (value.endsWith(suffix)) {
+    return value.slice(0, value.length - suffix.length);
+  }
+  return value;
+}
+function isHttpsOrLoopbackHttpUrl(value) {
+  const url = parseUrl(value);
+  if (url === undefined || url.hostname === "") {
+    return false;
+  }
+  if (url.protocol === "https:") {
+    return true;
+  }
+  return url.protocol === "http:" && LOOPBACK_HOSTS.has(url.hostname.toLowerCase());
+}
+function parseUrl(value) {
+  try {
+    return new URL(value);
+  } catch {
+    return;
+  }
+}
+async function fetchCheckedCreateWalletAccountsBody(options) {
+  const { api, signing, params } = options;
+  if (api.resolvedBaseUrl !== undefined) {
+    return fetchCheckedBodyFrom(api.resolvedBaseUrl, api.fetch, signing, params);
+  }
+  return detectEnvironmentAndFetchCheckedBody({ api, signing, params });
+}
+async function detectEnvironmentAndFetchCheckedBody(options) {
+  const { api, signing, params } = options;
+  let firstStampRejection;
+  for (const baseUrl of api.defaultBaseUrls) {
+    try {
+      const body = await fetchCheckedBodyFrom(baseUrl, api.fetch, signing, params);
+      api.resolvedBaseUrl = baseUrl;
+      return body;
+    } catch (error) {
+      if (!isStampRejected(error)) {
+        throw error;
+      }
+      firstStampRejection ??= error;
+    }
+  }
+  throw firstStampRejection;
+}
+function isStampRejected(error) {
+  return error instanceof TesserAPIError && error.status === 401 && error.errorCode === STAMP_REJECTED_ERROR_CODE;
+}
+async function fetchCheckedBodyFrom(baseUrl, fetchImplementation, signing, params) {
+  const query = buildUnsignedPayloadQuery(signing, params);
+  const stamped = await stamp({ publicKey: signing.publicKey, privateKey: signing.privateKey }, buildCanonicalUnsignedPayloadMessage(query));
+  const response = await sendUnsignedPayloadRequest(fetchImplementation, buildUnsignedPayloadUrl(baseUrl, query), stamped);
+  const body = parseUnsignedPayloadBody(response);
+  assertUnsignedPayloadMatchesRequest(body, signing, params);
+  return body;
+}
+function buildUnsignedPayloadQuery(signing, params) {
+  return {
+    organizationId: signing.enclaveId,
+    name: params.name,
+    type: params.type,
+    timestampMs: String(Date.now())
+  };
+}
+function buildCanonicalUnsignedPayloadMessage(query) {
+  return JSON.stringify({
+    organizationId: query.organizationId,
+    name: query.name,
+    type: query.type,
+    timestampMs: query.timestampMs
+  });
+}
+function buildUnsignedPayloadUrl(baseUrl, query) {
+  const queryEntries = [
+    ["organizationId", query.organizationId],
+    ["name", query.name],
+    ["type", query.type],
+    ["timestampMs", query.timestampMs]
+  ];
+  const queryString = queryEntries.map(([key, value]) => `${key}=${encodeURIComponent(value)}`).join("&");
+  return `${baseUrl}${UNSIGNED_PAYLOAD_PATH}?${queryString}`;
+}
+async function sendUnsignedPayloadRequest(fetchImplementation, url, stamped) {
+  try {
+    const response = await fetchImplementation(url, {
+      method: "GET",
+      headers: {
+        Accept: "application/json",
+        [stamped.stampHeaderName]: stamped.stampHeaderValue,
+        "User-Agent": `tesser-sdk-ts/${SDK_VERSION}`
+      },
+      signal: AbortSignal.timeout(UNSIGNED_PAYLOAD_TIMEOUT_MS)
+    });
+    const text = await response.text();
+    return { status: response.status, headers: response.headers, text };
+  } catch (cause) {
+    throw toTransportError(cause);
+  }
+}
+function toTransportError(cause) {
+  if (isTimeoutFailure(cause)) {
+    return new TesserTimeoutError(`Unsigned payload request timed out after ${UNSIGNED_PAYLOAD_TIMEOUT_MS} ms`, { cause });
+  }
+  return new TesserConnectionError(`Unsigned payload request failed: ${describeTransportFailure(cause)}`, { cause });
+}
+function isTimeoutFailure(cause) {
+  return readErrorName(cause) === "TimeoutError";
+}
+function describeTransportFailure(cause) {
+  const failureChain = collectFailureChain(cause);
+  const messages = failureChain.map(readErrorMessage).filter(isNonBlank);
+  if (messages.length > 0) {
+    return [...new Set(messages)].join(": ");
+  }
+  const names2 = failureChain.map(readErrorName).filter(isNonBlank);
+  return names2[names2.length - 1] ?? "Unknown transport failure";
+}
+function collectFailureChain(cause) {
+  const failureChain = [];
+  let current = cause;
+  while (isObject(current) && failureChain.length < MAX_FAILURE_CHAIN_DEPTH) {
+    if (failureChain.includes(current)) {
+      break;
+    }
+    failureChain.push(current);
+    current = current.cause;
+  }
+  return failureChain;
+}
+function readErrorMessage(failure) {
+  return readStringField(failure, "message");
+}
+function readErrorName(failure) {
+  return readStringField(failure, "name");
+}
+function readStringField(source, key) {
+  if (!isObject(source)) {
+    return;
+  }
+  const value = source[key];
+  if (typeof value !== "string") {
+    return;
+  }
+  return value;
+}
+function isNonBlank(value) {
+  return value !== undefined && value.trim() !== "";
+}
+function isObject(value) {
+  return typeof value === "object" && value !== null;
+}
+function readGatewayRequestId(headers) {
+  return headers.get("zp-rid") ?? headers.get("x-request-id") ?? undefined;
+}
+function parseUnsignedPayloadBody(response) {
+  if (response.status < 200 || response.status > 299) {
+    throw buildUnsignedPayloadApiError(response);
+  }
+  const body = readResponseDataBody(response.text);
+  if (body === undefined) {
+    throw new TesserAPIError("Unsigned payload response is not valid: data.body is missing", buildApiErrorOptions(response, []));
+  }
+  return body;
+}
+function readResponseDataBody(text) {
+  const envelope = parseJsonObject(text);
+  if (envelope === undefined || !isObject(envelope.data)) {
+    return;
+  }
+  return readStringField(envelope.data, "body");
+}
+function buildUnsignedPayloadApiError(response) {
+  return new TesserAPIError(`Unsigned payload request returned HTTP ${response.status}: ${response.text}`, buildApiErrorOptions(response, parseErrorDetails(response.text)));
+}
+function buildApiErrorOptions(response, errors) {
+  const requestId = readGatewayRequestId(response.headers);
+  if (requestId === undefined) {
+    return { status: response.status, headers: response.headers, errors };
+  }
+  return { status: response.status, headers: response.headers, requestId, errors };
+}
+function parseErrorDetails(text) {
+  const envelope = parseJsonObject(text);
+  if (envelope === undefined || !Array.isArray(envelope.errors)) {
+    return [];
+  }
+  return envelope.errors.flatMap(toErrorDetail);
+}
+function toErrorDetail(entry) {
+  const errorCode = readStringField(entry, "error_code");
+  const errorMessage = readStringField(entry, "error_message");
+  if (errorCode === undefined || errorMessage === undefined) {
+    return [];
+  }
+  const uiMessage = readStringField(entry, "ui_message");
+  if (uiMessage === undefined) {
+    return [{ errorCode, errorMessage }];
+  }
+  return [{ errorCode, errorMessage, uiMessage }];
+}
+function parseJsonObject(text) {
+  try {
+    const parsed = JSON.parse(text);
+    if (isObject(parsed) && !Array.isArray(parsed)) {
+      return parsed;
+    }
+    return;
+  } catch {
+    return;
+  }
+}
+function assertUnsignedPayloadMatchesRequest(body, signing, params) {
+  const payload = parseJsonObject(body);
+  if (payload === undefined) {
+    throw rejectUnsignedPayload("body is not a JSON object");
+  }
+  if (readStringField(payload, "type") !== CREATE_WALLET_ACCOUNTS_ACTIVITY_TYPE) {
+    throw rejectUnsignedPayload(`type is not ${CREATE_WALLET_ACCOUNTS_ACTIVITY_TYPE}`);
+  }
+  if (readStringField(payload, "organizationId") !== signing.enclaveId) {
+    throw rejectUnsignedPayload("organizationId does not match the signing enclaveId");
+  }
+  const account = readSingleAccount(payload);
+  if (readStringField(account, "name") !== params.name) {
+    throw rejectUnsignedPayload("account name does not match the requested wallet name");
+  }
+  if (readStringField(account, "addressFormat") !== ETHEREUM_ADDRESS_FORMAT) {
+    throw rejectUnsignedPayload(`account addressFormat is not ${ETHEREUM_ADDRESS_FORMAT}`);
+  }
+}
+function readSingleAccount(payload) {
+  const parameters = payload.parameters;
+  if (!isObject(parameters)) {
+    throw rejectUnsignedPayload("parameters is missing");
+  }
+  const accounts = parameters.accounts;
+  if (!Array.isArray(accounts)) {
+    throw rejectUnsignedPayload("parameters.accounts is missing");
+  }
+  if (accounts.length !== 1) {
+    throw rejectUnsignedPayload(`expected exactly one account, got ${accounts.length}`);
+  }
+  const account = accounts[0];
+  if (!isObject(account) || Array.isArray(account)) {
+    throw rejectUnsignedPayload("account is not a JSON object");
+  }
+  return account;
+}
+function rejectUnsignedPayload(reason) {
+  return new TesserSigningError(`Unsigned payload rejected: ${reason}`);
+}
+
 // src/signing/create-wallet.ts
 var WALLET_TYPE_ACCOUNTS = {
-  stablecoin_ethereum: [
-    {
-      curve: "CURVE_SECP256K1",
-      pathFormat: "PATH_FORMAT_BIP32",
-      path: "m/44'/60'/0'/0/0",
-      addressFormat: "ADDRESS_FORMAT_ETHEREUM"
-    }
-  ],
   stablecoin_solana: [
     {
       curve: "CURVE_ED25519",
@@ -21458,21 +21796,16 @@ var WALLET_TYPE_ACCOUNTS = {
     }
   ]
 };
-var VALID_WALLET_TYPES = Object.keys(WALLET_TYPE_ACCOUNTS);
-async function signCreateWallet(signing, params) {
+var VALID_WALLET_TYPES = [
+  "stablecoin_ethereum",
+  "stablecoin_solana",
+  "stablecoin_stellar"
+];
+async function signCreateWallet(signing, params, api) {
   if (!VALID_WALLET_TYPES.includes(params.type)) {
     throw new TesserConfigError(`signCreateWallet: type '${String(params.type)}' is not a valid WalletType. ` + `Valid values: ${VALID_WALLET_TYPES.join(", ")}.`);
   }
-  const accounts = WALLET_TYPE_ACCOUNTS[params.type];
-  const body = JSON.stringify({
-    type: "ACTIVITY_TYPE_CREATE_WALLET",
-    timestampMs: String(Date.now()),
-    organizationId: signing.enclaveId,
-    parameters: {
-      walletName: params.name,
-      accounts
-    }
-  });
+  const body = await resolveCreateWalletBody({ signing, params, api });
   const result = await stamp({ publicKey: signing.publicKey, privateKey: signing.privateKey }, body);
   const signature = Buffer.from(JSON.stringify({ body, stamp: result.stampHeaderValue })).toString("base64");
   return {
@@ -21484,6 +21817,28 @@ async function signCreateWallet(signing, params) {
     }
   };
 }
+async function resolveCreateWalletBody(options) {
+  const { signing, params, api } = options;
+  if (params.type === "stablecoin_ethereum") {
+    return fetchCheckedCreateWalletAccountsBody({ api, signing, params });
+  }
+  return buildCreateWalletBody({
+    enclaveId: signing.enclaveId,
+    name: params.name,
+    type: params.type
+  });
+}
+function buildCreateWalletBody(options) {
+  return JSON.stringify({
+    type: "ACTIVITY_TYPE_CREATE_WALLET",
+    timestampMs: String(Date.now()),
+    organizationId: options.enclaveId,
+    parameters: {
+      walletName: options.name,
+      accounts: WALLET_TYPE_ACCOUNTS[options.type]
+    }
+  });
+}
 
 // src/signing/network-type.ts
 var NETWORK_TO_TURNKEY_TYPE = {
@@ -21493,7 +21848,9 @@ var NETWORK_TO_TURNKEY_TYPE = {
   ETHEREUM_SEPOLIA: "TRANSACTION_TYPE_ETHEREUM",
   POLYGON: "TRANSACTION_TYPE_ETHEREUM",
   POLYGON_AMOY: "TRANSACTION_TYPE_ETHEREUM",
-  SOLANA: "TRANSACTION_TYPE_SOLANA"
+  SOLANA: "TRANSACTION_TYPE_SOLANA",
+  TEMPO: "TRANSACTION_TYPE_TEMPO",
+  TEMPO_MODERATO: "TRANSACTION_TYPE_TEMPO"
 };
 function networkToTurnkeyType(network) {
   const turnkeyType = NETWORK_TO_TURNKEY_TYPE[network];
@@ -21534,11 +21891,13 @@ async function signStep(signing, step) {
 class LocalSigner {
   signing;
   #privateKey;
+  #api;
   constructor(options) {
     const s = options.signing;
     if (!s || !s.publicKey || !s.privateKey || !s.enclaveId) {
       throw new TesserConfigError("LocalSigner: signing.publicKey, signing.privateKey, and signing.enclaveId are required");
     }
+    this.#api = createTesserApiConnection({ apiBaseUrl: options.apiBaseUrl, fetch: options.fetch });
     this.signing = { publicKey: s.publicKey, enclaveId: s.enclaveId };
     this.#privateKey = s.privateKey;
   }
@@ -21547,7 +21906,7 @@ class LocalSigner {
       publicKey: this.signing.publicKey,
       privateKey: this.#privateKey,
       enclaveId: this.signing.enclaveId
-    }, params);
+    }, params, this.#api);
   }
   signStep(step) {
     return signStep({
@@ -21558,9 +21917,12 @@ class LocalSigner {
   }
 }
 export {
+  TesserTimeoutError,
   TesserSigningError,
   TesserError,
+  TesserConnectionError,
   TesserConfigError,
+  TesserAPIError,
   StampError,
   LocalSigner
 };

package/dist/internal/errors.d.ts

@@ -28,11 +28,11 @@ export interface TesserAPIErrorOptions {
     errors?: readonly TesserErrorDetail[];
 }
 /**
- * Thrown for any non-2xx HTTP response from Tesser. Carries the parsed
- * `errors[]` envelope so consumers can branch on Tesser's documented error
- * codes (e.g. `accounts-3005`, `idempotency-1001`) rather than HTTP status
- * alone. For responses that are not Tesser-shaped (e.g., a Cloudflare 502
- * page), `errors` is the empty array.
+ * Thrown when Tesser answers with an error status or an invalid response.
+ * Carries the parsed `errors[]` envelope so consumers can branch on Tesser's
+ * documented error codes (e.g. `accounts-3005`, `idempotency-1001`) rather
+ * than HTTP status alone. For responses that are not Tesser-shaped (e.g., a
+ * Cloudflare 502 page), `errors` is the empty array.
  */
 export declare class TesserAPIError extends TesserError {
     readonly name: string;

package/dist/internal/types.d.ts

@@ -34,7 +34,7 @@ export interface StepForSigning {
     unsignedTransaction: string;
     /** On-chain address from GET /v1/accounts/{id} → crypto_wallet_address */
     signWith: string;
-    /** Network identifier; one of the supported chains in `NETWORK_TO_TURNKEY_TYPE`. */
+    /** Network identifier; one of the supported networks. */
     network: SupportedNetwork;
 }
 export interface SignedStepResultMetadata {
@@ -49,4 +49,16 @@ export interface SignedStepResult {
 }
 export interface LocalSignerOptions {
     signing: SigningConfig;
+    /**
+     * Optional Tesser API base URL. Leave it unset and the signer finds the environment
+     * your signing key belongs to, production or sandbox. When set, only this URL is used:
+     * `https://api.tesser.xyz` in production, `https://api-sandbox.tesser.xyz` in sandbox.
+     * A trailing `/` or `/v1` is removed.
+     */
+    apiBaseUrl?: string | undefined;
+    /**
+     * `fetch` implementation used for requests to Tesser. Inject one to configure a
+     * proxy. Defaults to the global `fetch`.
+     */
+    fetch?: typeof fetch;
 }

package/dist/internal/version.d.ts

@@ -0,0 +1 @@
+export declare const SDK_VERSION = "0.2.0";

package/dist/signer.d.ts

@@ -11,24 +11,41 @@ export interface PublicSigningInfo {
 /**
  * Produces locally-signed activity payloads for Tesser API operations.
  *
- * v0.0.1 supports `signCreateWallet` and `signStep`. A future version will
- * add an optional `client` field to `LocalSignerOptions` for HTTP integration;
- * the addition is purely additive and does not break existing call sites.
+ * Supports `signCreateWallet` and `signStep`. Construction validates that the
+ * signing keys are non-blank and that `apiBaseUrl`, if set, is an https URL.
  *
  * Key handling: the private key is stored in an ECMA private field (`#privateKey`)
  * and is not reachable via `signer.signing.privateKey` or any other public
  * surface. `signer.signing` exposes only `{ publicKey, enclaveId }`, so logging
  * `signer` or its `signing` property will not leak the private key.
  *
- * Thread-safety: stateless and reentrant. A single LocalSigner instance may
- * be shared across concurrent calls; the SDK never mutates internal state.
+ * Thread-safety: the only state is the environment remembered after the first
+ * Ethereum wallet request; a single LocalSigner may be shared across concurrent calls.
  */
 export declare class LocalSigner {
     #private;
     readonly signing: PublicSigningInfo;
     constructor(options: LocalSignerOptions);
-    /** Stamps an `ACTIVITY_TYPE_CREATE_WALLET` Turnkey activity. */
+    /**
+     * Signs a wallet-creation request.
+     *
+     * For `stablecoin_ethereum` the SDK first fetches the request to sign from the
+     * Tesser API and checks that it matches your parameters. Other wallet types are
+     * signed locally without a request to Tesser. The private key never leaves the
+     * process.
+     *
+     * @throws {TesserConfigError} if the wallet type is not valid.
+     * @throws {TesserSigningError} if signing fails or the request fetched from
+     *   Tesser does not match your parameters.
+     * @throws {TesserAPIError} if Tesser answers with an error status or an
+     *   invalid response. Safe to retry for status 429 or 5xx; other 4xx statuses
+     *   fail the same way on retry. Without `apiBaseUrl`, if neither production nor
+     *   sandbox accepts your signing key, the error from production is thrown.
+     * @throws {TesserConnectionError} if the request to Tesser fails at the
+     *   network level. Safe to retry.
+     * @throws {TesserTimeoutError} if the request to Tesser times out. Safe to retry.
+     */
     signCreateWallet(params: CreateWalletParams): Promise<SignedResult>;
-    /** Stamps an `ACTIVITY_TYPE_SIGN_TRANSACTION_V2` Turnkey activity. */
+    /** Signs a single transfer step. The private key never leaves the process. */
     signStep(step: StepForSigning): Promise<SignedStepResult>;
 }

package/dist/signing/create-wallet.d.ts

@@ -1,2 +1,3 @@
 import type { CreateWalletParams, SignedResult, SigningConfig } from '../internal/types.js';
-export declare function signCreateWallet(signing: SigningConfig, params: CreateWalletParams): Promise<SignedResult>;
+import { type TesserApiConnection } from './unsigned-payload.js';
+export declare function signCreateWallet(signing: SigningConfig, params: CreateWalletParams, api: TesserApiConnection): Promise<SignedResult>;

package/dist/signing/network-type.d.ts

@@ -6,6 +6,8 @@ declare const NETWORK_TO_TURNKEY_TYPE: {
     readonly POLYGON: "TRANSACTION_TYPE_ETHEREUM";
     readonly POLYGON_AMOY: "TRANSACTION_TYPE_ETHEREUM";
     readonly SOLANA: "TRANSACTION_TYPE_SOLANA";
+    readonly TEMPO: "TRANSACTION_TYPE_TEMPO";
+    readonly TEMPO_MODERATO: "TRANSACTION_TYPE_TEMPO";
 };
 export type SupportedNetwork = keyof typeof NETWORK_TO_TURNKEY_TYPE;
 export declare function networkToTurnkeyType(network: string): string;

package/dist/signing/unsigned-payload.d.ts

@@ -0,0 +1,17 @@
+import type { CreateWalletParams, SigningConfig } from '../internal/types.js';
+export interface TesserApiConnection {
+    fetch: typeof fetch;
+    defaultBaseUrls: readonly string[];
+    resolvedBaseUrl: string | undefined;
+}
+export declare function createTesserApiConnection({ apiBaseUrl, fetch: injectedFetch, defaultBaseUrls, }: {
+    apiBaseUrl: unknown;
+    fetch: typeof fetch | undefined;
+    defaultBaseUrls?: readonly string[];
+}): TesserApiConnection;
+export declare function normalizeApiBaseUrl(apiBaseUrl: unknown): string;
+export declare function fetchCheckedCreateWalletAccountsBody(options: {
+    api: TesserApiConnection;
+    signing: SigningConfig;
+    params: CreateWalletParams;
+}): Promise<string>;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@tesser-payments/sdk-ts",
-  "version": "0.0.4",
-  "description": "Signer-only TypeScript SDK for Tesser API: locally stamp signCreateWallet and signStep activities. No HTTP, no OAuth — bring your own client.",
+  "version": "0.2.0",
+  "description": "TypeScript SDK for Tesser API: sign signCreateWallet and signStep requests locally. No OAuth — bring your own client.",
   "type": "module",
   "exports": {
     ".": {
@@ -41,14 +41,17 @@
   },
   "overrides": {
     "ws": "^8.21.0",
-    "vite": "^6.4.3"
+    "vite": "^6.4.5",
+    "postcss": "^8.5.18",
+    "source-map-js": "^1.2.2",
+    "zod": "^4.6.6"
   },
   "devDependencies": {
     "@biomejs/biome": "^1.9",
     "@tesser-payments/types": "*",
     "@types/node": "^20",
     "typescript": "^5.4",
-    "vitest": "^3.2.6"
+    "vitest": "^4.1.12"
   },
   "trustedDependencies": []
 }