@turnkey/core 1.0.0-beta.5 → 1.0.0

package/dist/__clients__/core.mjs

@@ -1,7 +1,7 @@
 import { TurnkeySDKClientBase } from '../__generated__/sdk-client-base.mjs';
-import { TurnkeyErrorCodes, TurnkeyError, TurnkeyNetworkError } from '@turnkey/sdk-types';
+import { TurnkeyErrorCodes, TurnkeyError, TurnkeyNetworkError, AuthAction } from '@turnkey/sdk-types';
 import { SessionKey, DEFAULT_SESSION_EXPIRATION_IN_SECONDS, StamperType, WalletSource, Chain, FilterType, OtpTypeToFilterTypeMap, OtpType, Curve, SignIntent } from '../__types__/base.mjs';
-import { withTurnkeyErrorHandling, isWeb, isReactNative, buildSignUpBody, findWalletProviderFromAddress, isEthereumProvider, getPublicKeyFromStampHeader, toExternalTimestamp, isSolanaProvider, getHashFunction, getEncodingType, getEncodedMessage, splitSignature, broadcastTransaction, googleISS, isWalletAccountArray, generateWalletAccountsFromAddressFormat } from '../utils.mjs';
+import { withTurnkeyErrorHandling, isValidPasskeyName, isWeb, isReactNative, buildSignUpBody, findWalletProviderFromAddress, addressFromPublicKey, getCurveTypeFromProvider, getPublicKeyFromStampHeader, toExternalTimestamp, getAuthenticatorAddresses, isEthereumProvider, isSolanaProvider, getHashFunction, getEncodingType, getEncodedMessage, splitSignature, broadcastTransaction, getPolicySignature, googleISS, isWalletAccountArray, generateWalletAccountsFromAddressFormat } from '../utils.mjs';
 import { createStorageManager } from '../__storage__/base.mjs';
 import { CrossPlatformApiKeyStamper } from '../__stampers__/api/base.mjs';
 import { CrossPlatformPasskeyStamper } from '../__stampers__/passkey/base.mjs';
@@ -21,9 +21,9 @@ class TurnkeyClient {
          * - Handles both web and React Native environments, automatically selecting the appropriate passkey creation flow.
          * - The resulting attestation and challenge can be used to register the passkey with Turnkey.
          *
-         * @param params.name - name of the passkey. If not provided, defaults to "A Passkey".
-         * @param params.displayName - display name for the passkey. If not provided, defaults to "A Passkey".
+         * @param params.name - display name for the passkey (defaults to a generated name based on the current timestamp).
          * @param params.stampWith - parameter to stamp the request with a specific stamper (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet).
+         * @param params.challenge - challenge string to use for passkey registration. If not provided, a new challenge will be generated.
          * @returns A promise that resolves to an object containing:
          *   - attestation: attestation object returned from the passkey creation process.
          *   - encodedChallenge: encoded challenge string used for passkey registration.
@@ -31,16 +31,16 @@ class TurnkeyClient {
          */
         this.createPasskey = async (params) => {
             return withTurnkeyErrorHandling(async () => {
-                const name = params?.name || "A Passkey";
-                const displayName = params?.displayName || "A Passkey";
+                const name = isValidPasskeyName(params?.name || `passkey-${Date.now()}`);
                 let passkey;
                 if (isWeb()) {
                     const res = await this.passkeyStamper?.createWebPasskey({
                         publicKey: {
                             user: {
                                 name,
-                                displayName,
+                                displayName: name,
                             },
+                            ...(params?.challenge && { challenge: params.challenge }),
                         },
                     });
                     if (!res) {
@@ -54,7 +54,7 @@ class TurnkeyClient {
                 else if (isReactNative()) {
                     const res = await this.passkeyStamper?.createReactNativePasskey({
                         name,
-                        displayName,
+                        displayName: name,
                     });
                     if (!res) {
                         throw new TurnkeyError("Failed to create React Native passkey", TurnkeyErrorCodes.INTERNAL_ERROR);
@@ -71,7 +71,7 @@ class TurnkeyClient {
             }, {
                 errorMessage: "Failed to create passkey",
                 errorCode: TurnkeyErrorCodes.CREATE_PASSKEY_ERROR,
-                customMessageByMessages: {
+                customErrorsByMessages: {
                     "timed out or was not allowed": {
                         message: "Passkey creation was cancelled by the user.",
                         code: TurnkeyErrorCodes.SELECT_PASSKEY_CANCELLED,
@@ -125,21 +125,23 @@ class TurnkeyClient {
          * @param params.publicKey - public key to use for authentication. If not provided, a new key pair will be generated.
          * @param params.sessionKey - session key to use for session creation (defaults to the default session key).
          * @param params.expirationSeconds - session expiration time in seconds (defaults to the configured default).
-         * @returns A promise that resolves to a signed JWT session token.
+         * @returns A promise that resolves to a {@link PasskeyAuthResult}, which includes:
+         *          - `sessionToken`: the signed JWT session token.
+         *          - `credentialId`: an empty string.
          * @throws {TurnkeyError} If there is an error during the passkey login process or if the user cancels the passkey prompt.
          */
         this.loginWithPasskey = async (params) => {
-            let generatedKeyPair = undefined;
+            let generatedPublicKey = undefined;
             return await withTurnkeyErrorHandling(async () => {
-                generatedKeyPair =
+                generatedPublicKey =
                     params?.publicKey || (await this.apiKeyStamper?.createKeyPair());
                 const sessionKey = params?.sessionKey || SessionKey.DefaultSessionkey;
                 const expirationSeconds = params?.expirationSeconds || DEFAULT_SESSION_EXPIRATION_IN_SECONDS;
-                if (!generatedKeyPair) {
+                if (!generatedPublicKey) {
                     throw new TurnkeyError("A publickey could not be found or generated.", TurnkeyErrorCodes.INTERNAL_ERROR);
                 }
                 const sessionResponse = await this.httpClient.stampLogin({
-                    publicKey: generatedKeyPair,
+                    publicKey: generatedPublicKey,
                     organizationId: this.config.organizationId,
                     expirationSeconds,
                 }, StamperType.Passkey);
@@ -147,12 +149,18 @@ class TurnkeyClient {
                     sessionToken: sessionResponse.session,
                     sessionKey,
                 });
-                generatedKeyPair = undefined; // Key pair was successfully used, set to null to prevent cleanup
-                return sessionResponse.session;
+                generatedPublicKey = undefined; // Key pair was successfully used, set to null to prevent cleanup
+                return {
+                    sessionToken: sessionResponse.session,
+                    // TODO: can we return the credentialId here?
+                    // from a quick glance this is going to be difficult
+                    // for now we return an empty string
+                    credentialId: "",
+                };
             }, {
                 errorMessage: "Unable to log in with the provided passkey",
                 errorCode: TurnkeyErrorCodes.PASSKEY_LOGIN_AUTH_ERROR,
-                customMessageByMessages: {
+                customErrorsByMessages: {
                     "timed out or was not allowed": {
                         message: "Passkey login was cancelled by the user.",
                         code: TurnkeyErrorCodes.SELECT_PASSKEY_CANCELLED,
@@ -160,9 +168,9 @@ class TurnkeyClient {
                 },
             }, {
                 finallyFn: async () => {
-                    if (generatedKeyPair) {
+                    if (generatedPublicKey) {
                         try {
-                            await this.apiKeyStamper?.deleteKeyPair(generatedKeyPair);
+                            await this.apiKeyStamper?.deleteKeyPair(generatedPublicKey);
                         }
                         catch (cleanupError) {
                             throw new TurnkeyError(`Failed to clean up generated key pair`, TurnkeyErrorCodes.KEY_PAIR_CLEANUP_ERROR, cleanupError);
@@ -180,23 +188,26 @@ class TurnkeyClient {
          * - Automatically generates a new API key pair for authentication and session management.
          * - Stores the resulting session token and manages cleanup of unused key pairs.
          *
+         * @param params.passkeyDisplayName - display name for the passkey (defaults to a generated name based on the current timestamp).
          * @param params.createSubOrgParams - parameters for creating a sub-organization (e.g., authenticators, user metadata).
          * @param params.sessionKey - session key to use for storing the session (defaults to the default session key).
-         * @param params.passkeyDisplayName - display name for the passkey (defaults to a generated name based on the current timestamp).
          * @param params.expirationSeconds - session expiration time in seconds (defaults to the configured default).
-         * @returns A promise that resolves to a signed JWT session token for the new sub-organization.
+         * @param params.challenge - challenge string to use for passkey registration. If not provided, a new challenge will be generated.
+         * @returns A promise that resolves to a {@link PasskeyAuthResult}, which includes:
+         *          - `sessionToken`: the signed JWT session token.
+         *          - `credentialId`: the credential ID associated with the passkey created.
          * @throws {TurnkeyError} If there is an error during passkey creation, sub-organization creation, or session storage.
          */
         this.signUpWithPasskey = async (params) => {
             const { createSubOrgParams, passkeyDisplayName, sessionKey = SessionKey.DefaultSessionkey, expirationSeconds = DEFAULT_SESSION_EXPIRATION_IN_SECONDS, } = params || {};
-            let generatedKeyPair = undefined;
+            let generatedPublicKey = undefined;
             return withTurnkeyErrorHandling(async () => {
-                generatedKeyPair = await this.apiKeyStamper?.createKeyPair();
+                generatedPublicKey = await this.apiKeyStamper?.createKeyPair();
                 const passkeyName = passkeyDisplayName || `passkey-${Date.now()}`;
                 // A passkey will be created automatically when you call this function. The name is passed in
                 const passkey = await this.createPasskey({
                     name: passkeyName,
-                    displayName: passkeyName,
+                    ...(params?.challenge && { challenge: params.challenge }),
                 });
                 if (!passkey) {
                     throw new TurnkeyError("Failed to create passkey: encoded challenge or attestation is missing", TurnkeyErrorCodes.INTERNAL_ERROR);
@@ -215,8 +226,8 @@ class TurnkeyClient {
                         ],
                         apiKeys: [
                             {
-                                apiKeyName: `passkey-auth-${generatedKeyPair}`,
-                                publicKey: generatedKeyPair,
+                                apiKeyName: `passkey-auth-${generatedPublicKey}`,
+                                publicKey: generatedPublicKey,
                                 curveType: "API_KEY_CURVE_P256",
                                 expirationSeconds: "60",
                             },
@@ -228,28 +239,31 @@ class TurnkeyClient {
                     throw new TurnkeyError(`Sign up failed`, TurnkeyErrorCodes.PASSKEY_SIGNUP_AUTH_ERROR);
                 }
                 const newGeneratedKeyPair = await this.apiKeyStamper?.createKeyPair();
-                this.apiKeyStamper?.setPublicKeyOverride(generatedKeyPair);
+                this.apiKeyStamper?.setTemporaryPublicKey(generatedPublicKey);
                 const sessionResponse = await this.httpClient.stampLogin({
                     publicKey: newGeneratedKeyPair,
                     organizationId: this.config.organizationId,
                     expirationSeconds,
                 });
-                await this.apiKeyStamper?.deleteKeyPair(generatedKeyPair);
+                await this.apiKeyStamper?.deleteKeyPair(generatedPublicKey);
                 await this.storeSession({
                     sessionToken: sessionResponse.session,
                     sessionKey,
                 });
-                generatedKeyPair = undefined; // Key pair was successfully used, set to null to prevent cleanup
-                return sessionResponse.session;
+                generatedPublicKey = undefined; // Key pair was successfully used, set to null to prevent cleanup
+                return {
+                    sessionToken: sessionResponse.session,
+                    credentialId: passkey.attestation.credentialId,
+                };
             }, {
                 errorCode: TurnkeyErrorCodes.PASSKEY_SIGNUP_AUTH_ERROR,
                 errorMessage: "Failed to sign up with passkey",
             }, {
                 finallyFn: async () => {
-                    this.apiKeyStamper?.clearPublicKeyOverride();
-                    if (generatedKeyPair) {
+                    this.apiKeyStamper?.clearTemporaryPublicKey();
+                    if (generatedPublicKey) {
                         try {
-                            await this.apiKeyStamper?.deleteKeyPair(generatedKeyPair);
+                            await this.apiKeyStamper?.deleteKeyPair(generatedPublicKey);
                         }
                         catch (cleanupError) {
                             throw new TurnkeyError(`Failed to clean up generated key pair`, TurnkeyErrorCodes.KEY_PAIR_CLEANUP_ERROR, cleanupError);
@@ -268,7 +282,7 @@ class TurnkeyClient {
          * @returns A promise that resolves to an array of wallet providers.
          * @throws {TurnkeyError} If the wallet manager is uninitialized or provider retrieval fails.
          */
-        this.getWalletProviders = async (chain) => {
+        this.fetchWalletProviders = async (chain) => {
             return withTurnkeyErrorHandling(async () => {
                 if (!this.walletManager) {
                     throw new TurnkeyError("Wallet manager is not initialized", TurnkeyErrorCodes.WALLET_MANAGER_COMPONENT_NOT_INITIALIZED);
@@ -330,7 +344,7 @@ class TurnkeyClient {
          *
          * @param params.walletAccount - The wallet account whose provider should be switched.
          * @param params.chainOrId - The target chain, specified as a chain ID string or a SwitchableChain object.
-         * @param params.walletProviders - Optional list of wallet providers to search; falls back to `getWalletProviders()` if omitted.
+         * @param params.walletProviders - Optional list of wallet providers to search; falls back to `fetchWalletProviders()` if omitted.
          * @returns A promise that resolves once the chain switch is complete.
          *
          * @throws {TurnkeyError} If the wallet manager is uninitialized, the provider is not connected, or the switch fails.
@@ -344,7 +358,7 @@ class TurnkeyClient {
                 if (walletAccount.source === WalletSource.Embedded) {
                     throw new TurnkeyError("You can only switch chains for connected wallet accounts", TurnkeyErrorCodes.NOT_FOUND);
                 }
-                const providers = walletProviders ?? (await this.getWalletProviders());
+                const providers = walletProviders ?? (await this.fetchWalletProviders());
                 const walletProvider = findWalletProviderFromAddress(walletAccount.address, providers);
                 if (!walletProvider) {
                     throw new TurnkeyError("Wallet provider not found", TurnkeyErrorCodes.SWITCH_WALLET_CHAIN_ERROR);
@@ -372,7 +386,9 @@ class TurnkeyClient {
          * @param params.publicKey - optional public key to associate with the session (generated if not provided).
          * @param params.sessionKey - optional key to store the session under (defaults to the default session key).
          * @param params.expirationSeconds - optional session expiration time in seconds (defaults to the configured default).
-         * @returns A promise that resolves to the created session token.
+         * @returns A promise that resolves to a {@link WalletAuthResult}, which includes:
+         *          - `sessionToken`: the signed JWT session token.
+         *          - `address`: the authenticated wallet address.
          * @throws {TurnkeyError} If the wallet stamper is uninitialized, a public key cannot be found or generated, or login fails.
          */
         this.loginWithWallet = async (params) => {
@@ -397,14 +413,19 @@ class TurnkeyClient {
                     sessionToken: sessionResponse.session,
                     sessionKey,
                 });
-                return sessionResponse.session;
+                // TODO (Moe): What happens if a user connects to MetaMask on Ethereum,
+                // then switches to a Solana account within MetaMask? Will this flow break?
+                return {
+                    sessionToken: sessionResponse.session,
+                    address: addressFromPublicKey(walletProvider.chainInfo.namespace, publicKey),
+                };
             }, {
                 errorMessage: "Unable to log in with the provided wallet",
                 errorCode: TurnkeyErrorCodes.WALLET_LOGIN_AUTH_ERROR,
             }, {
                 finallyFn: async () => {
                     // Clean up the generated key pair if it wasn't successfully used
-                    this.apiKeyStamper?.clearPublicKeyOverride();
+                    this.apiKeyStamper?.clearTemporaryPublicKey();
                     if (publicKey) {
                         try {
                             await this.apiKeyStamper?.deleteKeyPair(publicKey);
@@ -429,17 +450,19 @@ class TurnkeyClient {
          * @param params.createSubOrgParams - parameters for creating a sub-organization (e.g., authenticators, user metadata).
          * @param params.sessionKey - session key to use for storing the session (defaults to the default session key).
          * @param params.expirationSeconds - session expiration time in seconds (defaults to the configured default).
-         * @returns A promise that resolves to a signed JWT session token for the new sub-organization.
+         * @returns A promise that resolves to a {@link WalletAuthResult}, which includes:
+         *          - `sessionToken`: the signed JWT session token.
+         *          - `address`: the authenticated wallet address.
          * @throws {TurnkeyError} If there is an error during wallet authentication, sub-organization creation, session storage, or cleanup.
          */
         this.signUpWithWallet = async (params) => {
             const { walletProvider, createSubOrgParams, sessionKey = SessionKey.DefaultSessionkey, expirationSeconds = DEFAULT_SESSION_EXPIRATION_IN_SECONDS, } = params;
-            let generatedKeyPair = undefined;
+            let generatedPublicKey = undefined;
             return withTurnkeyErrorHandling(async () => {
                 if (!this.walletManager?.stamper) {
                     throw new TurnkeyError("Wallet stamper is not initialized", TurnkeyErrorCodes.WALLET_MANAGER_COMPONENT_NOT_INITIALIZED);
                 }
-                generatedKeyPair = await this.apiKeyStamper?.createKeyPair();
+                generatedPublicKey = await this.apiKeyStamper?.createKeyPair();
                 this.walletManager.stamper.setProvider(walletProvider.interfaceType, walletProvider);
                 const publicKey = await this.walletManager.stamper.getPublicKey(walletProvider.interfaceType, walletProvider);
                 if (!publicKey) {
@@ -452,13 +475,11 @@ class TurnkeyClient {
                             {
                                 apiKeyName: `wallet-auth:${publicKey}`,
                                 publicKey: publicKey,
-                                curveType: isEthereumProvider(walletProvider)
-                                    ? "API_KEY_CURVE_SECP256K1"
-                                    : "API_KEY_CURVE_ED25519",
+                                curveType: getCurveTypeFromProvider(walletProvider),
                             },
                             {
-                                apiKeyName: `wallet-auth-${generatedKeyPair}`,
-                                publicKey: generatedKeyPair,
+                                apiKeyName: `wallet-auth-${generatedPublicKey}`,
+                                publicKey: generatedPublicKey,
                                 curveType: "API_KEY_CURVE_P256",
                                 expirationSeconds: "60",
                             },
@@ -470,29 +491,34 @@ class TurnkeyClient {
                     throw new TurnkeyError(`Sign up failed`, TurnkeyErrorCodes.WALLET_SIGNUP_AUTH_ERROR);
                 }
                 const newGeneratedKeyPair = await this.apiKeyStamper?.createKeyPair();
-                this.apiKeyStamper?.setPublicKeyOverride(generatedKeyPair);
+                this.apiKeyStamper?.setTemporaryPublicKey(generatedPublicKey);
                 const sessionResponse = await this.httpClient.stampLogin({
                     publicKey: newGeneratedKeyPair,
                     organizationId: this.config.organizationId,
                     expirationSeconds,
                 });
-                await this.apiKeyStamper?.deleteKeyPair(generatedKeyPair);
+                await this.apiKeyStamper?.deleteKeyPair(generatedPublicKey);
                 await this.storeSession({
                     sessionToken: sessionResponse.session,
                     sessionKey,
                 });
-                generatedKeyPair = undefined; // Key pair was successfully used, set to null to prevent cleanup
-                return sessionResponse.session;
+                generatedPublicKey = undefined; // Key pair was successfully used, set to null to prevent cleanup
+                // TODO (Moe): What happens if a user connects to MetaMask on Ethereum,
+                // then switches to a Solana account within MetaMask? Will this flow break?
+                return {
+                    sessionToken: sessionResponse.session,
+                    address: addressFromPublicKey(walletProvider.chainInfo.namespace, publicKey),
+                };
             }, {
                 errorMessage: "Failed to sign up with wallet",
                 errorCode: TurnkeyErrorCodes.WALLET_SIGNUP_AUTH_ERROR,
             }, {
                 finallyFn: async () => {
                     // Clean up the generated key pair if it wasn't successfully used
-                    this.apiKeyStamper?.clearPublicKeyOverride();
-                    if (generatedKeyPair) {
+                    this.apiKeyStamper?.clearTemporaryPublicKey();
+                    if (generatedPublicKey) {
                         try {
-                            await this.apiKeyStamper?.deleteKeyPair(generatedKeyPair);
+                            await this.apiKeyStamper?.deleteKeyPair(generatedPublicKey);
                         }
                         catch (cleanupError) {
                             throw new TurnkeyError("Failed to clean up generated key pair", TurnkeyErrorCodes.KEY_PAIR_CLEANUP_ERROR, cleanupError);
@@ -515,7 +541,10 @@ class TurnkeyClient {
          * @param params.createSubOrgParams - optional parameters for creating a sub-organization (e.g., authenticators, user metadata).
          * @param params.sessionKey - session key to use for storing the session (defaults to the default session key).
          * @param params.expirationSeconds - session expiration time in seconds (defaults to the configured default).
-         * @returns A promise that resolves to a signed JWT session token for the sub-organization (new or existing).
+         * @returns A promise that resolves to an object containing:
+         *          - `sessionToken`: the signed JWT session token.
+         *          - `address`: the authenticated wallet address.
+         *          - `action`: whether the flow resulted in a login or signup ({@link AuthAction}).
          * @throws {TurnkeyError} If there is an error during wallet authentication, sub-organization creation, or session storage.
          */
         this.loginOrSignupWithWallet = async (params) => {
@@ -523,26 +552,26 @@ class TurnkeyClient {
             const sessionKey = params.sessionKey || SessionKey.DefaultSessionkey;
             const walletProvider = params.walletProvider;
             const expirationSeconds = params.expirationSeconds || DEFAULT_SESSION_EXPIRATION_IN_SECONDS;
-            let generatedKeyPair = undefined;
+            let generatedPublicKey = undefined;
             return withTurnkeyErrorHandling(async () => {
                 if (!this.walletManager?.stamper) {
                     throw new TurnkeyError("Wallet stamper is not initialized", TurnkeyErrorCodes.WALLET_MANAGER_COMPONENT_NOT_INITIALIZED);
                 }
-                generatedKeyPair = await this.apiKeyStamper?.createKeyPair();
+                generatedPublicKey = await this.apiKeyStamper?.createKeyPair();
                 this.walletManager.stamper.setProvider(walletProvider.interfaceType, walletProvider);
-                // here we sign the request with the wallet, but we don't send it to the Turnkey yet
+                // here we sign the request with the wallet, but we don't send it to Turnkey yet
                 // this is because we need to check if the subOrg exists first, and create one if it doesn't
-                // once we have the subOrg for the publicKey, we then can send the request to the Turnkey
+                // once we have the subOrg for the publicKey, we then can send the request to Turnkey
                 const signedRequest = await withTurnkeyErrorHandling(async () => {
                     return this.httpClient.stampStampLogin({
-                        publicKey: generatedKeyPair,
+                        publicKey: generatedPublicKey,
                         organizationId: this.config.organizationId,
                         expirationSeconds,
                     }, StamperType.Wallet);
                 }, {
                     errorMessage: "Failed to create stamped request for wallet login",
                     errorCode: TurnkeyErrorCodes.WALLET_LOGIN_OR_SIGNUP_ERROR,
-                    customMessageByMessages: {
+                    customErrorsByMessages: {
                         "Failed to sign the message": {
                             message: "Wallet auth was cancelled by the user.",
                             code: TurnkeyErrorCodes.CONNECT_WALLET_CANCELLED,
@@ -572,7 +601,7 @@ class TurnkeyClient {
                         throw new TurnkeyError(`Unsupported interface type: ${walletProvider.interfaceType}`, TurnkeyErrorCodes.INVALID_REQUEST);
                 }
                 // here we check if the subOrg exists and create one
-                // then we send off the stamped request to the Turnkey
+                // then we send off the stamped request to Turnkey
                 const accountRes = await this.httpClient.proxyGetAccount({
                     filterType: FilterType.PublicKey,
                     filterValue: publicKey,
@@ -590,9 +619,7 @@ class TurnkeyClient {
                                 {
                                     apiKeyName: `wallet-auth:${publicKey}`,
                                     publicKey: publicKey,
-                                    curveType: isEthereumProvider(walletProvider)
-                                        ? "API_KEY_CURVE_SECP256K1"
-                                        : "API_KEY_CURVE_ED25519",
+                                    curveType: getCurveTypeFromProvider(walletProvider),
                                 },
                             ],
                         },
@@ -602,7 +629,7 @@ class TurnkeyClient {
                         throw new TurnkeyError(`Sign up failed`, TurnkeyErrorCodes.WALLET_SIGNUP_AUTH_ERROR);
                     }
                 }
-                // now we can send the stamped request to the Turnkey
+                // now we can send the stamped request to Turnkey
                 const headers = {
                     "Content-Type": "application/json",
                     [signedRequest.stamp.stampHeaderName]: signedRequest.stamp.stampHeaderValue,
@@ -625,14 +652,19 @@ class TurnkeyClient {
                     sessionToken: sessionToken,
                     sessionKey,
                 });
-                return sessionToken;
+                return {
+                    sessionToken: sessionToken,
+                    address: addressFromPublicKey(walletProvider.chainInfo.namespace, publicKey),
+                    // if the subOrganizationId exists, it means the user is logging in
+                    action: subOrganizationId ? AuthAction.LOGIN : AuthAction.SIGNUP,
+                };
             }, {
                 errorCode: TurnkeyErrorCodes.WALLET_LOGIN_OR_SIGNUP_ERROR,
                 errorMessage: "Failed to log in or sign up with wallet",
                 catchFn: async () => {
-                    if (generatedKeyPair) {
+                    if (generatedPublicKey) {
                         try {
-                            await this.apiKeyStamper?.deleteKeyPair(generatedKeyPair);
+                            await this.apiKeyStamper?.deleteKeyPair(generatedPublicKey);
                         }
                         catch (cleanupError) {
                             throw new TurnkeyError(`Failed to clean up generated key pair`, TurnkeyErrorCodes.KEY_PAIR_CLEANUP_ERROR, cleanupError);
@@ -663,7 +695,7 @@ class TurnkeyClient {
             }, {
                 errorMessage: "Failed to initialize OTP",
                 errorCode: TurnkeyErrorCodes.INIT_OTP_ERROR,
-                customMessageByMessages: {
+                customErrorsByMessages: {
                     "Max number of OTPs have been initiated": {
                         message: "Maximum number of OTPs has been reached for this contact.",
                         code: TurnkeyErrorCodes.MAX_OTP_INITIATED_ERROR,
@@ -713,7 +745,7 @@ class TurnkeyClient {
             }, {
                 errorMessage: "Failed to verify OTP",
                 errorCode: TurnkeyErrorCodes.VERIFY_OTP_ERROR,
-                customMessageByMessages: {
+                customErrorsByMessages: {
                     "Invalid OTP code": {
                         message: "The provided OTP code is invalid.",
                         code: TurnkeyErrorCodes.INVALID_OTP_CODE,
@@ -734,7 +766,8 @@ class TurnkeyClient {
          * @param params.publicKey - public key to use for authentication. If not provided, a new key pair will be generated.
          * @param params.invalidateExisting - flag to invalidate existing session for the user.
          * @param params.sessionKey - session key to use for session creation (defaults to the default session key).
-         * @returns A promise that resolves to a signed JWT session token.
+         * @returns A promise that resolves to a {@link BaseAuthResult}, which includes:
+         *          - `sessionToken`: the signed JWT session token.
          * @throws {TurnkeyError} If there is an error during the OTP login process or if key pair cleanup fails.
          */
         this.loginWithOtp = async (params) => {
@@ -756,7 +789,9 @@ class TurnkeyClient {
                     sessionToken: loginRes.session,
                     sessionKey,
                 });
-                return loginRes.session;
+                return {
+                    sessionToken: loginRes.session,
+                };
             }, {
                 errorMessage: "Failed to log in with OTP",
                 errorCode: TurnkeyErrorCodes.OTP_LOGIN_ERROR,
@@ -788,7 +823,8 @@ class TurnkeyClient {
          * @param params.createSubOrgParams - parameters for creating a sub-organization (e.g., authenticators, user metadata).
          * @param params.invalidateExisting - flag to invalidate existing session for the user.
          * @param params.sessionKey - session key to use for session creation (defaults to the default session key).
-         * @returns A promise that resolves to a signed JWT session token for the new sub-organization.
+         * @returns A promise that resolves to a {@link BaseAuthResult}, which includes:
+         *          - `sessionToken`: the signed JWT session token.
          * @throws {TurnkeyError} If there is an error during the OTP sign-up process or session storage.
          */
         this.signUpWithOtp = async (params) => {
@@ -803,14 +839,14 @@ class TurnkeyClient {
                 },
             });
             return withTurnkeyErrorHandling(async () => {
-                const generatedKeyPair = await this.apiKeyStamper?.createKeyPair();
+                const generatedPublicKey = await this.apiKeyStamper?.createKeyPair();
                 const res = await this.httpClient.proxySignup(signUpBody);
                 if (!res) {
                     throw new TurnkeyError(`Auth proxy OTP sign up failed`, TurnkeyErrorCodes.OTP_SIGNUP_ERROR);
                 }
                 return await this.loginWithOtp({
                     verificationToken,
-                    publicKey: generatedKeyPair,
+                    publicKey: generatedPublicKey,
                     ...(invalidateExisting && { invalidateExisting }),
                     ...(sessionKey && { sessionKey }),
                 });
@@ -836,7 +872,10 @@ class TurnkeyClient {
          * @param params.invalidateExisting - flag to invalidate existing sessions for the user.
          * @param params.sessionKey - session key to use for session creation (defaults to the default session key).
          * @param params.createSubOrgParams - parameters for sub-organization creation (e.g., authenticators, user metadata).
-         * @returns A promise that resolves to a signed JWT session token for the user.
+         * @returns A promise that resolves to an object containing:
+         *          - `sessionToken`: the signed JWT session token.
+         *          - `verificationToken`: the OTP verification token.
+         *          - `action`: whether the flow resulted in a login or signup ({@link AuthAction}).
          * @throws {TurnkeyError} If there is an error during OTP verification, sign-up, or login.
          */
         this.completeOtp = async (params) => {
@@ -852,24 +891,32 @@ class TurnkeyClient {
                     throw new TurnkeyError("No verification token returned from OTP verification", TurnkeyErrorCodes.VERIFY_OTP_ERROR);
                 }
                 if (!subOrganizationId) {
-                    return await this.signUpWithOtp({
+                    const signUpRes = await this.signUpWithOtp({
                         verificationToken,
-                        contact: contact,
-                        otpType: otpType,
-                        ...(createSubOrgParams && {
-                            createSubOrgParams,
-                        }),
+                        contact,
+                        otpType,
+                        ...(createSubOrgParams && { createSubOrgParams }),
                         ...(invalidateExisting && { invalidateExisting }),
                         ...(sessionKey && { sessionKey }),
                     });
+                    return {
+                        ...signUpRes,
+                        verificationToken,
+                        action: AuthAction.SIGNUP,
+                    };
                 }
                 else {
-                    return await this.loginWithOtp({
+                    const loginRes = await this.loginWithOtp({
                         verificationToken,
                         ...(publicKey && { publicKey }),
                         ...(invalidateExisting && { invalidateExisting }),
                         ...(sessionKey && { sessionKey }),
                     });
+                    return {
+                        ...loginRes,
+                        verificationToken,
+                        action: AuthAction.LOGIN,
+                    };
                 }
             }, {
                 errorMessage: "Failed to complete OTP process",
@@ -886,16 +933,18 @@ class TurnkeyClient {
          * - Handles session storage and management, and supports invalidating existing sessions if specified.
          *
          * @param params.oidcToken - OIDC token received after successful authentication with the OAuth provider.
-         * @param params.publicKey - public key to use for authentication. Must be generated prior to calling this function.
+         * @param params.publicKey - public key to use for authentication. Must be generated prior to calling this function, this is because the OIDC nonce has to be set to `sha256(publicKey)`.
          * @param params.providerName - name of the OAuth provider (defaults to a generated name with a timestamp).
          * @param params.sessionKey - session key to use for session creation (defaults to the default session key).
          * @param params.invalidateExisting - flag to invalidate existing sessions for the user.
          * @param params.createSubOrgParams - parameters for sub-organization creation (e.g., authenticators, user metadata).
-         * @returns A promise that resolves to a signed JWT session token for the user.
+         * @returns A promise that resolves to an object containing:
+         *          - `sessionToken`: the signed JWT session token.
+         *          - `action`: whether the flow resulted in a login or signup ({@link AuthAction}).
          * @throws {TurnkeyError} If there is an error during the OAuth completion process, such as account lookup, sign-up, or login.
          */
         this.completeOauth = async (params) => {
-            const { oidcToken, publicKey, createSubOrgParams, providerName = "OpenID Connect Provider" + Date.now(), sessionKey = SessionKey.DefaultSessionkey, invalidateExisting = false, } = params;
+            const { oidcToken, publicKey, createSubOrgParams, providerName = "OpenID Connect Provider" + " " + Date.now(), sessionKey = SessionKey.DefaultSessionkey, invalidateExisting = false, } = params;
             return withTurnkeyErrorHandling(async () => {
                 const accountRes = await this.httpClient.proxyGetAccount({
                     filterType: "OIDC_TOKEN",
@@ -906,22 +955,31 @@ class TurnkeyClient {
                 }
                 const subOrganizationId = accountRes.organizationId;
                 if (subOrganizationId) {
-                    return this.loginWithOauth({
+                    const loginRes = await this.loginWithOauth({
                         oidcToken,
                         publicKey,
                         invalidateExisting,
                         sessionKey,
                     });
+                    return {
+                        ...loginRes,
+                        action: AuthAction.LOGIN,
+                    };
                 }
                 else {
-                    return this.signUpWithOauth({
+                    const signUpRes = await this.signUpWithOauth({
                         oidcToken,
                         publicKey,
                         providerName,
+                        sessionKey,
                         ...(createSubOrgParams && {
                             createSubOrgParams,
                         }),
                     });
+                    return {
+                        ...signUpRes,
+                        action: AuthAction.SIGNUP,
+                    };
                 }
             }, {
                 errorMessage: "Failed to complete OAuth process",
@@ -940,7 +998,8 @@ class TurnkeyClient {
          * @param params.publicKey - public key to use for authentication. Must be generated prior to calling this function.
          * @param params.invalidateExisting - flag to invalidate existing sessions for the user.
          * @param params.sessionKey - session key to use for session creation (defaults to the default session key).
-         * @returns A promise that resolves to a signed JWT session token.
+         * @returns A promise that resolves to a {@link BaseAuthResult}, which includes:
+         *          - `sessionToken`: the signed JWT session token.
          * @throws {TurnkeyError} If there is an error during the OAuth login process or if key pair cleanup fails.
          */
         this.loginWithOauth = async (params) => {
@@ -964,11 +1023,11 @@ class TurnkeyClient {
                     sessionToken: loginRes.session,
                     sessionKey,
                 });
-                return loginRes.session;
+                return { sessionToken: loginRes.session };
             }, {
                 errorMessage: "Failed to complete OAuth login",
                 errorCode: TurnkeyErrorCodes.OAUTH_LOGIN_ERROR,
-                customMessageByMessages: {
+                customErrorsByMessages: {
                     "OAUTH disallowed": {
                         message: "OAuth is disabled on the dashboard for this organization.",
                         code: TurnkeyErrorCodes.AUTH_METHOD_NOT_ENABLED,
@@ -1000,11 +1059,12 @@ class TurnkeyClient {
          * @param params.providerName - name of the OAuth provider (e.g., "Google", "Apple").
          * @param params.createSubOrgParams - parameters for sub-organization creation (e.g., authenticators, user metadata).
          * @param params.sessionKey - session key to use for session creation (defaults to the default session key).
-         * @returns A promise that resolves to a signed JWT session token for the new sub-organization.
+         * @returns A promise that resolves to a {@link BaseAuthResult}, which includes:
+         *          - `sessionToken`: the signed JWT session token.
          * @throws {TurnkeyError} If there is an error during the OAuth sign-up or login process.
          */
         this.signUpWithOauth = async (params) => {
-            const { oidcToken, publicKey, providerName, createSubOrgParams } = params;
+            const { oidcToken, publicKey, providerName, createSubOrgParams, sessionKey, } = params;
             return withTurnkeyErrorHandling(async () => {
                 const signUpBody = buildSignUpBody({
                     createSubOrgParams: {
@@ -1024,6 +1084,7 @@ class TurnkeyClient {
                 return await this.loginWithOauth({
                     oidcToken,
                     publicKey: publicKey,
+                    ...(sessionKey && { sessionKey }),
                 });
             }, {
                 errorMessage: "Failed to sign up with OAuth",
@@ -1040,6 +1101,7 @@ class TurnkeyClient {
          * - Optionally allows stamping the request with a specific stamper (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet).
          *
          * @param params.stampWith - parameter to stamp the request with a specific stamper (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet).
+         * @param params.walletProviders - array of wallet providers to use for fetching wallets.
          * @returns A promise that resolves to an array of `Wallet` objects.
          * @throws {TurnkeyError} If no active session is found or if there is an error fetching wallets.
          */
@@ -1070,9 +1132,11 @@ class TurnkeyClient {
                 // if wallet connecting is disabled we return only embedded wallets
                 if (!this.walletManager?.connector)
                     return embedded;
-                const providers = walletProviders ?? (await this.getWalletProviders());
+                const providers = walletProviders ?? (await this.fetchWalletProviders());
                 const groupedProviders = new Map();
                 for (const provider of providers) {
+                    // connected wallets don't all have some uuid we can use for the walletId
+                    // so what we do is we use a normalized version of the name for the wallet, like "metamask" or "phantom-wallet"
                     const walletId = provider.info?.name?.toLowerCase().replace(/\s+/g, "-") ||
                         "unknown";
                     const group = groupedProviders.get(walletId) || [];
@@ -1153,10 +1217,21 @@ class TurnkeyClient {
                 if (!this.walletManager?.connector)
                     return [];
                 const connected = [];
-                const providers = walletProviders ?? (await this.getWalletProviders());
+                const providers = walletProviders ?? (await this.fetchWalletProviders());
+                // Context: connected wallets don't all have some uuid we can use for the walletId so what
+                //          we do is we use a normalized version of the name for the wallet, like "metamask"
+                //          or "phantom-wallet"
+                //
+                // when fetching accounts, we select all providers with this normalized walletId.
+                // A single wallet can map to multiple providers if it supports multiple chains
+                // (e.g. MetaMask for Ethereum and MetaMask for Solana)
                 const matching = providers.filter((p) => p.info?.name?.toLowerCase().replace(/\s+/g, "-") ===
                     wallet.walletId && p.connectedAddresses.length > 0);
                 const sign = this.walletManager.connector.sign.bind(this.walletManager.connector);
+                const user = await this.fetchUser({
+                    stampWith,
+                });
+                const { ethereum: ethereumAddresses, solana: solanaAddresses } = getAuthenticatorAddresses(user);
                 for (const provider of matching) {
                     const timestamp = toExternalTimestamp();
                     for (const address of provider.connectedAddresses) {
@@ -1175,6 +1250,7 @@ class TurnkeyClient {
                                 curve: Curve.SECP256K1,
                                 addressFormat: "ADDRESS_FORMAT_ETHEREUM",
                                 chainInfo: provider.chainInfo,
+                                isAuthenticator: ethereumAddresses.includes(address.toLowerCase()),
                                 signMessage: (msg) => sign(msg, provider, SignIntent.SignMessage),
                                 signAndSendTransaction: (tx) => sign(tx, provider, SignIntent.SignAndSendTransaction),
                             };
@@ -1197,6 +1273,7 @@ class TurnkeyClient {
                                 curve: Curve.ED25519,
                                 addressFormat: "ADDRESS_FORMAT_SOLANA",
                                 chainInfo: provider.chainInfo,
+                                isAuthenticator: solanaAddresses.includes(address),
                                 signMessage: (msg) => sign(msg, provider, SignIntent.SignMessage),
                                 signTransaction: (tx) => sign(tx, provider, SignIntent.SignTransaction),
                             };
@@ -1212,6 +1289,33 @@ class TurnkeyClient {
                 errorCode: TurnkeyErrorCodes.FETCH_WALLET_ACCOUNTS_ERROR,
             });
         };
+        /**
+         * Fetches all private keys for the current user.
+         *
+         * - Retrieves private keys from the Turnkey API.
+         * - Supports stamping the request with a specific stamper (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet).
+         *
+         * @param params.stampWith - parameter to stamp the request with a specific stamper (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet).
+         * @returns A promise that resolves to an array of `v1PrivateKey` objects.
+         * @throws {TurnkeyError} If no active session is found or if there is an error fetching private keys.
+         */
+        this.fetchPrivateKeys = async (params) => {
+            const { stampWith } = params || {};
+            const session = await this.storageManager.getActiveSession();
+            if (!session) {
+                throw new TurnkeyError("No active session found. Please log in first.", TurnkeyErrorCodes.NO_SESSION_FOUND);
+            }
+            return withTurnkeyErrorHandling(async () => {
+                const res = await this.httpClient.getPrivateKeys({ organizationId: session.organizationId }, stampWith);
+                if (!res) {
+                    throw new TurnkeyError("Failed to fetch private keys", TurnkeyErrorCodes.BAD_RESPONSE);
+                }
+                return res.privateKeys;
+            }, {
+                errorMessage: "Failed to fetch private keys",
+                errorCode: TurnkeyErrorCodes.FETCH_PRIVATE_KEYS_ERROR,
+            });
+        };
         /**
          * Signs a message using the specified wallet account.
          *
@@ -1430,6 +1534,165 @@ class TurnkeyClient {
                 errorCode: TurnkeyErrorCodes.FETCH_USER_ERROR,
             });
         };
+        /**
+         * Fetches an existing user by P-256 API key public key, or creates a new one if none exists.
+         *
+         * - This function is idempotent: multiple calls with the same `publicKey` will always return the same user.
+         * - Attempts to find a user whose API keys include the given P-256 public key.
+         * - If a matching user is found, it is returned as-is.
+         * - If no matching user is found, a new user is created with the given public key as a P-256 API key.
+         *
+         * @param params.publicKey - the P-256 public key to use for lookup and creation.
+         * @param params.createParams.userName - optional username to assign if creating a new user (defaults to `"Public Key User"`).
+         * @param params.createParams.apiKeyName - optional API key name to assign if creating a new API key (defaults to `public-key-user-${publicKey}`).
+         * @returns A promise that resolves to the existing or newly created {@link v1User}.
+         * @throws {TurnkeyError} If there is no active session, if the input is invalid, if user retrieval fails, or if user creation fails.
+         */
+        this.fetchOrCreateP256ApiKeyUser = async (params) => {
+            const { publicKey, createParams } = params;
+            return withTurnkeyErrorHandling(async () => {
+                const session = await this.storageManager.getActiveSession();
+                if (!session) {
+                    throw new TurnkeyError("No active session found. Please log in first.", TurnkeyErrorCodes.NO_SESSION_FOUND);
+                }
+                const organizationId = session.organizationId;
+                // we validate their input
+                if (!publicKey?.trim()) {
+                    throw new TurnkeyError("'publicKey' is required and cannot be empty.", TurnkeyErrorCodes.INVALID_REQUEST);
+                }
+                const usersResponse = await this.httpClient.getUsers({
+                    organizationId,
+                });
+                if (!usersResponse || !usersResponse.users) {
+                    throw new TurnkeyError("No users found in the response", TurnkeyErrorCodes.BAD_RESPONSE);
+                }
+                const userWithPublicKey = usersResponse.users.find((user) => user.apiKeys.some((apiKey) => apiKey.credential.publicKey === publicKey &&
+                    apiKey.credential.type === "CREDENTIAL_TYPE_API_KEY_P256"));
+                // the user already exists, so we return it
+                if (userWithPublicKey) {
+                    return userWithPublicKey;
+                }
+                // at this point we know the user doesn't exist, so we create it
+                const userName = createParams?.userName?.trim() || "Public Key User";
+                const apiKeyName = createParams?.apiKeyName?.trim() || `public-key-user-${publicKey}`;
+                const createUserResp = await this.httpClient.createUsers({
+                    organizationId,
+                    users: [
+                        {
+                            userName: userName,
+                            userTags: [],
+                            apiKeys: [
+                                {
+                                    apiKeyName: apiKeyName,
+                                    curveType: "API_KEY_CURVE_P256",
+                                    publicKey,
+                                },
+                            ],
+                            authenticators: [],
+                            oauthProviders: [],
+                        },
+                    ],
+                });
+                if (!createUserResp?.userIds ||
+                    createUserResp.userIds.length === 0 ||
+                    !createUserResp.userIds[0]) {
+                    throw new TurnkeyError("Failed to create P-256 API key user", TurnkeyErrorCodes.CREATE_USERS_ERROR);
+                }
+                const newUserId = createUserResp.userIds[0];
+                return await this.fetchUser({
+                    organizationId,
+                    userId: newUserId,
+                });
+            }, {
+                errorMessage: "Failed to get or create P-256 API key user",
+                errorCode: TurnkeyErrorCodes.CREATE_USERS_ERROR,
+            });
+        };
+        /**
+         * Fetches each requested policy if it exists, or creates it if it does not.
+         *
+         * - This function is idempotent: multiple calls with the same policies will not create duplicates.
+         * - For every policy in the request:
+         *   - If it already exists, it is returned with its `policyId`.
+         *   - If it does not exist, it is created and returned with its new `policyId`.
+         *
+         * @param params.policies - the list of policies to fetch or create.
+         * @returns A promise that resolves to an array of objects, each containing:
+         *          - `policyId`: the unique identifier of the policy.
+         *          - `policyName`: human-readable name of the policy.
+         *          - `effect`: the instruction to DENY or ALLOW an activity.
+         *          - `condition`: (optional) the condition expression that triggers the effect.
+         *          - `consensus`: (optional) the consensus expression that triggers the effect.
+         *          - `notes`: (optional) developer notes or description for the policy.
+         * @throws {TurnkeyError} If there is no active session, if the input is invalid,
+         *                        if fetching policies fails, or if creating policies fails.
+         */
+        this.fetchOrCreatePolicies = async (params) => {
+            const { policies } = params;
+            return await withTurnkeyErrorHandling(async () => {
+                const session = await this.storageManager.getActiveSession();
+                if (!session) {
+                    throw new TurnkeyError("No active session found. Please log in first.", TurnkeyErrorCodes.NO_SESSION_FOUND);
+                }
+                if (!Array.isArray(policies) || policies.length === 0) {
+                    throw new TurnkeyError("'policies' must be a non-empty array of policy definitions.", TurnkeyErrorCodes.INVALID_REQUEST);
+                }
+                const organizationId = session.organizationId;
+                // we first fetch existing policies
+                const existingPoliciesResponse = await this.httpClient.getPolicies({
+                    organizationId,
+                });
+                const existingPolicies = existingPoliciesResponse.policies || [];
+                // we create a map of existing policies by their signature
+                // where the policySignature maps to its policyId
+                const existingPoliciesSignatureMap = {};
+                for (const existingPolicy of existingPolicies) {
+                    const signature = getPolicySignature(existingPolicy);
+                    existingPoliciesSignatureMap[signature] = existingPolicy.policyId;
+                }
+                // we go through each requested policy and check if it already exists
+                // if it exists, we add it to the alreadyExistingPolicies list
+                // if it doesn't exist, we add it to the missingPolicies list
+                const alreadyExistingPolicies = [];
+                const missingPolicies = [];
+                for (const policy of policies) {
+                    const existingId = existingPoliciesSignatureMap[getPolicySignature(policy)];
+                    if (existingId) {
+                        alreadyExistingPolicies.push({ ...policy, policyId: existingId });
+                    }
+                    else {
+                        missingPolicies.push(policy);
+                    }
+                }
+                // if there are no missing policies, that means we're done
+                // so we return them with their respective IDs
+                if (missingPolicies.length === 0) {
+                    return alreadyExistingPolicies;
+                }
+                // at this point we know there is at least one missing policy.
+                // so we create the missing policies and then return the full list
+                const createPoliciesResponse = await this.httpClient.createPolicies({
+                    organizationId,
+                    policies: missingPolicies,
+                });
+                // assign returned IDs back to the missing ones in order
+                if (!createPoliciesResponse || !createPoliciesResponse.policyIds) {
+                    throw new TurnkeyError("Failed to create missing delegated access policies", TurnkeyErrorCodes.CREATE_POLICY_ERROR);
+                }
+                const newlyCreatedPolicies = missingPolicies.map((p, idx) => ({
+                    ...p,
+                    // we can safely assert the ID exists because we know Turnkey's api
+                    // will return one ID for each created policy or throw an error
+                    policyId: createPoliciesResponse.policyIds[idx],
+                }));
+                // we return the full list of policies, both existing and the newly created
+                // which includes each of their respective IDs
+                return [...alreadyExistingPolicies, ...newlyCreatedPolicies];
+            }, {
+                errorMessage: "Failed to get or create delegated access policies",
+                errorCode: TurnkeyErrorCodes.CREATE_USERS_ERROR,
+            });
+        };
         /**
          * Updates the user's email address.
          *
@@ -1744,7 +2007,6 @@ class TurnkeyClient {
         this.addPasskey = async (params) => {
             const { stampWith } = params || {};
             const name = params?.name || `Turnkey Passkey-${Date.now()}`;
-            const displayName = params?.displayName || name;
             return withTurnkeyErrorHandling(async () => {
                 const session = await this.storageManager.getActiveSession();
                 if (!session) {
@@ -1753,7 +2015,6 @@ class TurnkeyClient {
                 const userId = params?.userId || session.userId;
                 const { encodedChallenge, attestation } = await this.createPasskey({
                     name,
-                    displayName,
                     ...(stampWith && { stampWith }),
                 });
                 if (!attestation || !encodedChallenge) {
@@ -2073,7 +2334,7 @@ class TurnkeyClient {
             }, {
                 errorMessage: "Failed to import wallet",
                 errorCode: TurnkeyErrorCodes.IMPORT_WALLET_ERROR,
-                customMessageByMessages: {
+                customErrorsByMessages: {
                     "invalid mnemonic": {
                         message: "Invalid mnemonic input",
                         code: TurnkeyErrorCodes.BAD_REQUEST,
@@ -2123,7 +2384,7 @@ class TurnkeyClient {
             }, {
                 errorMessage: "Failed to import wallet",
                 errorCode: TurnkeyErrorCodes.IMPORT_WALLET_ERROR,
-                customMessageByMessages: {
+                customErrorsByMessages: {
                     "invalid mnemonic": {
                         message: "Invalid mnemonic input",
                         code: TurnkeyErrorCodes.BAD_REQUEST,
@@ -2227,9 +2488,8 @@ class TurnkeyClient {
         this.clearAllSessions = async () => {
             withTurnkeyErrorHandling(async () => {
                 const sessionKeys = await this.storageManager.listSessionKeys();
-                if (sessionKeys.length === 0) {
-                    throw new TurnkeyError("No sessions found to clear.", TurnkeyErrorCodes.NO_SESSION_FOUND);
-                }
+                if (sessionKeys.length === 0)
+                    return;
                 for (const sessionKey of sessionKeys) {
                     this.clearSession({ sessionKey });
                 }
@@ -2447,7 +2707,7 @@ class TurnkeyClient {
                 }
                 const publicKey = await this.apiKeyStamper.createKeyPair(externalKeyPair ? externalKeyPair : undefined);
                 if (storeOverride && publicKey) {
-                    await this.apiKeyStamper.setPublicKeyOverride(publicKey);
+                    await this.apiKeyStamper.setTemporaryPublicKey(publicKey);
                 }
                 return publicKey;
             }, {