@turnkey/core 2.5.0 → 2.7.0

package/dist/__clients__/core.d.ts

@@ -1,8 +1,9 @@
 import { TurnkeySDKClientBase } from "../__generated__/sdk-client-base";
 import { type TDeleteSubOrganizationResponse, type Session, type TStampLoginResponse, type v1SignRawPayloadResult, type v1User, type ProxyTGetWalletKitConfigResponse, type v1PrivateKey, type WalletAuthResult, type BaseAuthResult, type PasskeyAuthResult, type v1BootProof, type TGetSendTransactionStatusResponse, AuthAction } from "@turnkey/sdk-types";
-import { Chain, type ExportBundle, type TurnkeySDKClientConfig, type WalletAccount, type Wallet, type WalletManagerBase, type WalletProvider, type CreatePasskeyParams, type CreatePasskeyResult, type LogoutParams, type LoginWithPasskeyParams, type SignUpWithPasskeyParams, type SwitchWalletAccountChainParams, type LoginWithWalletParams, type SignUpWithWalletParams, type LoginOrSignupWithWalletParams, type InitOtpParams, type InitOtpResult, type VerifyOtpParams, type VerifyOtpResult, type LoginWithOtpParams, type SignUpWithOtpParams, type CompleteOtpParams, type CompleteOauthParams, type LoginWithOauthParams, type SignUpWithOauthParams, type FetchWalletsParams, type FetchWalletAccountsParams, type FetchPrivateKeysParams, type SignMessageParams, type SignTransactionParams, type SignAndSendTransactionParams, type EthSendErc20TransferParams, type EthSendTransactionParams, type SolSendTransactionParams, type FetchUserParams, type FetchOrCreateP256ApiKeyUserParams, type FetchOrCreatePoliciesParams, type FetchOrCreatePoliciesResult, type UpdateUserEmailParams, type RemoveUserEmailParams, type UpdateUserPhoneNumberParams, type RemoveUserPhoneNumberParams, type UpdateUserNameParams, type AddOauthProviderParams, type RemoveOauthProvidersParams, type AddPasskeyParams, type RemovePasskeyParams, type CreateWalletParams, type CreateWalletAccountsParams, type ExportWalletParams, type ExportPrivateKeyParams, type ExportWalletAccountParams, type ImportWalletParams, type ImportPrivateKeyParams, type DeleteSubOrganizationParams, type StoreSessionParams, type ClearSessionParams, type RefreshSessionParams, type GetSessionParams, type SetActiveSessionParams, type CreateApiKeyPairParams, type SignWithApiKeyParams, type FetchBootProofForAppProofParams, type CreateHttpClientParams, type BuildWalletLoginRequestResult, type BuildWalletLoginRequestParams, type VerifyAppProofsParams, type PollTransactionStatusParams, type OverrideApiKeyStamperParams, type OverridePasskeyStamperParams, type DeleteApiKeyPairParams } from "../__types__";
+import { Chain, type ExportBundle, type TurnkeySDKClientConfig, type WalletAccount, type Wallet, type WalletManagerBase, type WalletProvider, type CreatePasskeyParams, type CreatePasskeyResult, type LogoutParams, type LoginWithPasskeyParams, type SignUpWithPasskeyParams, type SwitchWalletAccountChainParams, type LoginWithWalletParams, type SignUpWithWalletParams, type LoginOrSignupWithWalletParams, type InitOtpParams, type InitOtpResult, type VerifyOtpParams, type VerifyOtpResult, type LoginWithOtpParams, type SignUpWithOtpParams, type CompleteOtpParams, type CompleteOauthParams, type LoginWithOauthParams, type SignUpWithOauthParams, type FetchWalletsParams, type FetchWalletAccountsParams, type FetchPrivateKeysParams, type SignMessageParams, type SignTransactionParams, type SignAndSendTransactionParams, type EthSendErc20TransferParams, type EthSendTransactionParams, type SolSendTransactionParams, type FetchUserParams, type FetchOrCreateP256ApiKeyUserParams, type FetchOrCreatePoliciesParams, type FetchOrCreatePoliciesResult, type UpdateUserEmailParams, type RemoveUserEmailParams, type UpdateUserPhoneNumberParams, type RemoveUserPhoneNumberParams, type UpdateUserNameParams, type AddOauthProviderParams, type RemoveOauthProvidersParams, type AddPasskeyParams, type RemovePasskeyParams, type CreateWalletParams, type CreateWalletAccountsParams, type ExportWalletParams, type ExportPrivateKeyParams, type ExportWalletAccountParams, type ImportWalletParams, type ImportPrivateKeyParams, type DeleteSubOrganizationParams, type StoreSessionParams, type ClearSessionParams, type RefreshSessionParams, type GetSessionParams, type SetActiveSessionParams, type CreateApiKeyPairParams, type SignWithApiKeyParams, type FetchBootProofForAppProofParams, type CreateHttpClientParams, type BuildWalletLoginRequestResult, type BuildWalletLoginRequestParams, type VerifyAppProofsParams, type PollTransactionStatusParams, type OverrideApiKeyStamperParams, type OverridePasskeyStamperParams, type OverrideAttestedStamperParams, type DeleteApiKeyPairParams } from "../__types__";
 import { CrossPlatformApiKeyStamper } from "../__stampers__/api/base";
 import { CrossPlatformPasskeyStamper } from "../__stampers__/passkey/base";
+import { AttestedStamper } from "../__stampers__/attested/base";
 /**
  * @internal
  * Gathers all public methods exposed in our core client and turns it into a type that
@@ -20,9 +21,10 @@ export declare class TurnkeyClient {
     httpClient: TurnkeySDKClientBase;
     private apiKeyStamper?;
     private passkeyStamper?;
+    private attestedStamper?;
     private walletManager?;
     private storageManager;
-    constructor(config: TurnkeySDKClientConfig, apiKeyStamper?: CrossPlatformApiKeyStamper, passkeyStamper?: CrossPlatformPasskeyStamper, walletManager?: WalletManagerBase);
+    constructor(config: TurnkeySDKClientConfig, apiKeyStamper?: CrossPlatformApiKeyStamper, passkeyStamper?: CrossPlatformPasskeyStamper, attestedStamper?: AttestedStamper, walletManager?: WalletManagerBase);
     init(): Promise<void>;
     /**
      * Overrides the API key stamper configuration.
@@ -49,6 +51,23 @@ export declare class TurnkeyClient {
      * @throws {TurnkeyError} If there is an error updating the stamper configuration or if the passkey stamper is not initialized.
      */
     overridePasskeyStamper: (params: OverridePasskeyStamperParams) => Promise<void>;
+    /**
+     * Overrides the attested stamper with a verification token or OIDC token.
+     *
+     * - This function updates the attested stamper's identity and automatically sets the correct scheme.
+     * - Pass `verificationToken` to set the attestation identity and scheme to STAMP_ATTESTED_SCHEME_P256_VERIFICATION_TOKEN.
+     * - Pass `oidcToken` to set the attestation identity and scheme to STAMP_ATTESTED_SCHEME_P256_OIDC.
+     * - Only one of `verificationToken` or `oidcToken` can be provided at a time.
+     * - If neither token is provided, the attestation identity is cleared.
+     * - Useful for dynamically changing the attested identity and scheme used for signing requests.
+     *
+     * @param params.verificationToken - verification token to use as the attested identity with STAMP_ATTESTED_SCHEME_P256_VERIFICATION_TOKEN scheme.
+     * @param params.oidcToken - OIDC token to use as the attested identity with STAMP_ATTESTED_SCHEME_P256_OIDC scheme.
+     * @param params.publicKey - public key that signs the attested stamp. Must match the key bound to the token.
+     * @returns A promise that resolves when the stamper has been updated.
+     * @throws {TurnkeyError} If the attested stamper is not initialized, if both tokens are provided, or if there is an error updating it.
+     */
+    overrideAttestedStamper: (params: OverrideAttestedStamperParams) => Promise<void>;
     /**
      * Creates a new TurnkeySDKClientBase instance with the provided configuration.
      * This method is used internally to create the HTTP client for making API requests,
@@ -1238,10 +1257,24 @@ export declare class TurnkeyClient {
      */
     fetchBootProofForAppProof: (params: FetchBootProofForAppProofParams) => Promise<v1BootProof>;
     /**
-     * Verifies a list of app proofs against their corresponding boot proofs.
+     * Verifies a list of app proofs against their corresponding boot proofs using
+     * the example/reference-grade check from `@turnkey/crypto`.
      *
      * - This function iterates through each provided app proof, fetches the corresponding boot proof, and verifies the app proof against the boot proof.
      * - If any app proof fails verification, an error is thrown.
+     *
+     * @remarks
+     * WARNING: This is not full verification of a Turnkey enclave. It verifies
+     * that the proof came from a genuine AWS Nitro enclave and that proof
+     * signatures chain correctly, but it does not verify enclave identity or image
+     * measurements. It does not inspect `attestationDoc.pcrs` (PCR0-3 image
+     * measurements), and it does not compare the QOS manifest content against a
+     * known-good or pinned Turnkey manifest. Any party with an AWS account can
+     * produce attestations from their own Nitro enclave that pass this check.
+     *
+     * For full verification, callers must additionally pin and verify expected
+     * PCR measurements and manifest content. See https://github.com/tkhq/qos.
+     *
      * @param params.appProofs - the app proofs to verify.
      * @param params.organizationId - organization ID to specify the sub-organization (defaults to the current session's organizationId).
      * @param params.stampWith - parameter to stamp the request with a specific stamper (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet).

package/dist/__clients__/core.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"core.d.ts","sourceRoot":"","sources":["../../src/__clients__/core.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAC;AACxE,OAAO,EACL,KAAK,8BAA8B,EACnC,KAAK,OAAO,EACZ,KAAK,mBAAmB,EAExB,KAAK,sBAAsB,EAC3B,KAAK,MAAM,EACX,KAAK,gCAAgC,EAErC,KAAK,YAAY,EACjB,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,iBAAiB,EAEtB,KAAK,WAAW,EAChB,KAAK,iCAAiC,EAQtC,UAAU,EACX,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAML,KAAK,EAKL,KAAK,YAAY,EACjB,KAAK,sBAAsB,EAC3B,KAAK,aAAa,EAClB,KAAK,MAAM,EAMX,KAAK,iBAAiB,EACtB,KAAK,cAAc,EAGnB,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACxB,KAAK,YAAY,EACjB,KAAK,sBAAsB,EAC3B,KAAK,uBAAuB,EAC5B,KAAK,8BAA8B,EACnC,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC3B,KAAK,6BAA6B,EAClC,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,KAAK,iBAAiB,EACtB,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAC1B,KAAK,kBAAkB,EACvB,KAAK,yBAAyB,EAC9B,KAAK,sBAAsB,EAC3B,KAAK,iBAAiB,EACtB,KAAK,qBAAqB,EAC1B,KAAK,4BAA4B,EACjC,KAAK,0BAA0B,EAC/B,KAAK,wBAAwB,EAC7B,KAAK,wBAAwB,EAC7B,KAAK,eAAe,EACpB,KAAK,iCAAiC,EACtC,KAAK,2BAA2B,EAChC,KAAK,2BAA2B,EAChC,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,EAC1B,KAAK,2BAA2B,EAChC,KAAK,2BAA2B,EAChC,KAAK,oBAAoB,EACzB,KAAK,sBAAsB,EAC3B,KAAK,0BAA0B,EAC/B,KAAK,gBAAgB,EACrB,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACvB,KAAK,0BAA0B,EAC/B,KAAK,kBAAkB,EACvB,KAAK,sBAAsB,EAC3B,KAAK,yBAAyB,EAC9B,KAAK,kBAAkB,EACvB,KAAK,sBAAsB,EAC3B,KAAK,2BAA2B,EAChC,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,EACzB,KAAK,gBAAgB,EACrB,KAAK,sBAAsB,EAC3B,KAAK,sBAAsB,EAC3B,KAAK,oBAAoB,EACzB,KAAK,+BAA+B,EACpC,KAAK,sBAAsB,EAC3B,KAAK,6BAA6B,EAClC,KAAK,6BAA6B,EAClC,KAAK,qBAAqB,EAC1B,KAAK,2BAA2B,EAChC,KAAK,2BAA2B,EAChC,KAAK,4BAA4B,EACjC,KAAK,sBAAsB,EAC5B,MAAM,cAAc,CAAC;AAiCtB,OAAO,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AACtE,OAAO,EAAE,2BAA2B,EAAE,MAAM,8BAA8B,CAAC;AAY3E;;;;;;;GAOG;AACH,KAAK,aAAa,CAAC,CAAC,IAAI;KACrB,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,QAAQ,GAAG,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;CAC1D,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG,IAAI,CACrC,aAAa,CAAC,aAAa,CAAC,EAC5B,MAAM,GAAG,QAAQ,GAAG,YAAY,GAAG,aAAa,CACjD,CAAC;AAEF,qBAAa,aAAa;IACxB,MAAM,EAAE,sBAAsB,CAAC;IAC/B,UAAU,EAAG,oBAAoB,CAAC;IAElC,OAAO,CAAC,aAAa,CAAC,CAAyC;IAC/D,OAAO,CAAC,cAAc,CAAC,CAA0C;IACjE,OAAO,CAAC,aAAa,CAAC,CAAgC;IACtD,OAAO,CAAC,cAAc,CAAe;gBAGnC,MAAM,EAAE,sBAAsB,EAG9B,aAAa,CAAC,EAAE,0BAA0B,EAC1C,cAAc,CAAC,EAAE,2BAA2B,EAC5C,aAAa,CAAC,EAAE,iBAAiB;IAY7B,IAAI;IA2CV;;;;;;;;;;;OAWG;IACH,qBAAqB,WACX,2BAA2B,KAClC,QAAQ,IAAI,CAAC,CA0Bd;IAEF;;;;;;;;;;OAUG;IACH,sBAAsB,WACZ,4BAA4B,KACnC,QAAQ,IAAI,CAAC,CAmBd;IAEF;;;;;;;;;;;;;;;OAeG;IACH,gBAAgB,YACL,sBAAsB,KAC9B,oBAAoB,CAuBrB;IAEF;;;;;;;;;;;OAWG;IACH,aAAa,WACH,mBAAmB,KAC1B,QAAQ,mBAAmB,CAAC,CAuE7B;IAEF;;;;;;;;;;OAUG;IACH,MAAM,YAAmB,YAAY,KAAG,QAAQ,IAAI,CAAC,CA4BnD;IAEF;;;;;;;;;;;;;;;;;;OAkBG;IACH,gBAAgB,YACL,sBAAsB,KAC9B,QAAQ,iBAAiB,CAAC,CAiH3B;IAEF;;;;;;;;;;;;;;;;;;;OAmBG;IACH,iBAAiB,YACN,uBAAuB,KAC/B,QAAQ,iBAAiB,CAAC,CAgH3B;IAEF;;;;;;;;;OASG;IACH,oBAAoB,WAAkB,KAAK,KAAG,QAAQ,cAAc,EAAE,CAAC,CAiBrE;IAEF;;;;;;;;OAQG;IACH,oBAAoB,mBACF,cAAc,KAC7B,QAAQ,MAAM,CAAC,CA8BhB;IAEF;;;;;;;;OAQG;IACH,uBAAuB,mBAA0B,cAAc,mBAmB7D;IAEF;;;;;;;;;;;;;;;OAeG;IACH,wBAAwB,WACd,8BAA8B,KACrC,QAAQ,IAAI,CAAC,CAgDd;IAEF;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,uBAAuB,WACb,6BAA6B,KACpC,QAAQ,6BAA6B,CAAC,CAoGvC;IAEF;;;;;;;;;;;;;;;;;;OAkBG;IACH,eAAe,WACL,qBAAqB,KAC5B,QAAQ,gBAAgB,CAAC,CAwC1B;IAEF;;;;;;;;;;;;;;;;;;OAkBG;IACH,gBAAgB,WACN,sBAAsB,KAC7B,QAAQ,gBAAgB,CAAC,CAkE1B;IAEF;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,uBAAuB,WACb,6BAA6B,KACpC,QAAQ,gBAAgB,GAAG;QAAE,MAAM,EAAE,UAAU,CAAA;KAAE,CAAC,CA8FnD;IAEF;;;;;;;;;;;;;;;;OAgBG;IACH,OAAO,WAAkB,aAAa,KAAG,QAAQ,aAAa,CAAC,CAyC7D;IAEF;;;;;;;;;;;;;;;OAeG;IACH,SAAS,WAAkB,eAAe,KAAG,QAAQ,eAAe,CAAC,CA+DnE;IAEF;;;;;;;;;;;;;;;;OAgBG;IACH,YAAY,WACF,kBAAkB,KACzB,QAAQ,cAAc,CAAC,CAuExB;IAEF;;;;;;;;;;;;;;;;;;;OAmBG;IACH,aAAa,WACH,mBAAmB,KAC1B,QAAQ,cAAc,CAAC,CAwFxB;IAEF;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,WAAW,WACD,iBAAiB,KACxB,QACD,cAAc,GAAG;QAAE,iBAAiB,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,UAAU,CAAA;KAAE,CACnE,CAqGC;IAEF;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,aAAa,WACH,mBAAmB,KAC1B,QAAQ,cAAc,GAAG;QAAE,MAAM,EAAE,UAAU,CAAA;KAAE,CAAC,CA+DjD;IAEF;;;;;;;;;;;;;;;;;;OAkBG;IACH,cAAc,WACJ,oBAAoB,KAC3B,QAAQ,cAAc,CAAC,CAwExB;IAEF;;;;;;;;;;;;;;;;;OAiBG;IACH,eAAe,WACL,qBAAqB,KAC5B,QAAQ,cAAc,CAAC,CAqDxB;IAEF;;;;;;;;;;;;;;;;OAgBG;IACH,YAAY,YAAmB,kBAAkB,KAAG,QAAQ,MAAM,EAAE,CAAC,CA0LnE;IAEF;;;;;;;;;;;;;;;;;;;OAmBG;IACH,mBAAmB,WACT,yBAAyB,KAChC,QAAQ,aAAa,EAAE,CAAC,CAmLzB;IAEF;;;;;;;;;;OAUG;IACH,gBAAgB,YACL,sBAAsB,KAC9B,QAAQ,YAAY,EAAE,CAAC,CAqCxB;IAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAqCG;IACH,WAAW,WACD,iBAAiB,KACxB,QAAQ,sBAAsB,CAAC,CAiFhC;IAEF;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,eAAe,WAAkB,qBAAqB,KAAG,QAAQ,MAAM,CAAC,CAsDtE;IAEF;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,sBAAsB,WACZ,4BAA4B,KACnC,QAAQ,MAAM,CAAC,CAuFhB;IAEF;;;;;;;;;;;;;;;;;;OAkBG;IACH,oBAAoB,WACV,0BAA0B,KACjC,QAAQ,MAAM,CAAC,CA2DhB;IAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA8BG;IACH,kBAAkB,WACR,wBAAwB,KAC/B,QAAQ,MAAM,CAAC,CAkDhB;IAEF;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,kBAAkB,WACR,wBAAwB,KAC/B,QAAQ,MAAM,CAAC,CAwDhB;IAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IAEG,qBAAqB,CACzB,MAAM,EAAE,2BAA2B,GAClC,OAAO,CAAC,iCAAiC,CAAC;IAuE7C;;;;;;;;;;;;;;OAcG;IACH,SAAS,YAAmB,eAAe,KAAG,QAAQ,MAAM,CAAC,CAgD3D;IAEF;;;;;;;;;;;;;;;OAeG;IACH,2BAA2B,WACjB,iCAAiC,KACxC,QAAQ,MAAM,CAAC,CA6GhB;IAEF;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,qBAAqB,WACX,2BAA2B,KAClC,QAAQ,2BAA2B,CAAC,CAuGrC;IAEF;;;;;;;;;;;;;;;;OAgBG;IACH,eAAe,WAAkB,qBAAqB,KAAG,QAAQ,MAAM,CAAC,CA6DtE;IAEF;;;;;;;;;;;;;OAaG;IACH,eAAe,YAAmB,qBAAqB,KAAG,QAAQ,MAAM,CAAC,CAuCvE;IAEF;;;;;;;;;;;;;;;;OAgBG;IACH,qBAAqB,WACX,2BAA2B,KAClC,QAAQ,MAAM,CAAC,CA6DhB;IAEF;;;;;;;;;;;;;OAaG;IACH,qBAAqB,YACV,2BAA2B,KACnC,QAAQ,MAAM,CAAC,CAuChB;IAEF;;;;;;;;;;;;;;;OAeG;IACH,cAAc,WAAkB,oBAAoB,KAAG,QAAQ,MAAM,CAAC,CA4CpE;IAEF;;;;;;;;;;;;;;;;;;OAkBG;IACH,gBAAgB,WACN,sBAAsB,KAC7B,QAAQ,MAAM,EAAE,CAAC,CA4KlB;IAEF;;;;;;;;;;;;;;;OAeG;IACH,oBAAoB,WACV,0BAA0B,KACjC,QAAQ,MAAM,EAAE,CAAC,CA0ClB;IAEF;;;;;;;;;;;;;;;;OAgBG;IACH,UAAU,YAAmB,gBAAgB,KAAG,QAAQ,MAAM,EAAE,CAAC,CAqD/D;IAEF;;;;;;;;;;;;;;;OAeG;IACH,cAAc,WAAkB,mBAAmB,KAAG,QAAQ,MAAM,EAAE,CAAC,CA2CrE;IAEF;;;;;;;;;;;;;;;;;;OAkBG;IACH,YAAY,WAAkB,kBAAkB,KAAG,QAAQ,MAAM,CAAC,CA0DhE;IAEF;;;;;;;;;;;;;;;;OAgBG;IACH,oBAAoB,WACV,0BAA0B,KACjC,QAAQ,MAAM,EAAE,CAAC,CAiElB;IAEF;;;;;;;;;;;;;;;;OAgBG;IACH,YAAY,WAAkB,kBAAkB,KAAG,QAAQ,YAAY,CAAC,CA6CtE;IAEF;;;;;;;;;;;;;;;OAeG;IACH,gBAAgB,WACN,sBAAsB,KAC7B,QAAQ,YAAY,CAAC,CA4CtB;IAEF;;;;;;;;;;;;;;;;OAgBG;IACH,mBAAmB,WACT,yBAAyB,KAChC,QAAQ,YAAY,CAAC,CA4CtB;IAEF;;;;;;;;;;;;;;;;;;OAkBG;IACH,YAAY,WAAkB,kBAAkB,KAAG,QAAQ,MAAM,CAAC,CAkEhE;IAEF;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,gBAAgB,WACN,sBAAsB,KAC7B,QAAQ,MAAM,CAAC,CAiEhB;IAEF;;;;;;;;;;;;;;OAcG;IACH,qBAAqB,YACV,2BAA2B,KACnC,QAAQ,8BAA8B,CAAC,CA0BxC;IAEF;;;;;;;;;;;;;OAaG;IACH,YAAY,WAAkB,kBAAkB,KAAG,QAAQ,IAAI,CAAC,CAgB9D;IAEF;;;;;;;;;;;OAWG;IACH,YAAY,YAAmB,kBAAkB,KAAG,QAAQ,IAAI,CAAC,CAsB/D;IAEF;;;;;;;;;;OAUG;IACH,gBAAgB,QAAa,QAAQ,IAAI,CAAC,CAcxC;IAEF;;;;;;;;;;;;;;;;;OAiBG;IACH,cAAc,YACH,oBAAoB,KAC5B,QAAQ,mBAAmB,GAAG,SAAS,CAAC,CAkFzC;IAEF;;;;;;;;;;OAUG;IACH,UAAU,YACC,gBAAgB,KACxB,QAAQ,OAAO,GAAG,SAAS,CAAC,CAY7B;IAEF;;;;;;;;;;OAUG;IACH,cAAc,QAAa,QAAQ,OAAO,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC,CAqBrE;IAEF;;;;;;;;;;;OAWG;IACH,gBAAgB,WAAkB,sBAAsB,KAAG,QAAQ,IAAI,CAAC,CAWtE;IAEF;;;;;;;;;;OAUG;IACH,mBAAmB,QAAa,QAAQ,MAAM,GAAG,SAAS,CAAC,CAUzD;IAEF;;;;;;;;;;OAUG;IACH,mBAAmB,QAAa,QAAQ,IAAI,CAAC,CAoC3C;IAEF;;;;;;;;;;;OAWG;IACH,gBAAgB,YACL,sBAAsB,KAC9B,QAAQ,MAAM,CAAC,CAsBhB;IAEF;;;;;;;;;;;OAWG;IACH,gBAAgB,WAAkB,sBAAsB,KAAG,QAAQ,IAAI,CAAC,CAkBtE;IAEF;;;;;;;;;;;;OAYG;IACH,cAAc,WAAkB,oBAAoB,KAAG,QAAQ,MAAM,CAAC,CA6BpE;IAEF;;;;;;;;;;OAUG;IACH,kBAAkB,QAAa,QAAQ,gCAAgC,CAAC,CAmBtE;IAEF;;;;;;;;;;;;;OAaG;IACH,yBAAyB,WACf,+BAA+B,KACtC,QAAQ,WAAW,CAAC,CAoDrB;IAEF;;;;;;;;;;OAUG;IACH,eAAe,WAAkB,qBAAqB,KAAG,QAAQ,IAAI,CAAC,CA+DpE;CACH"}
+{"version":3,"file":"core.d.ts","sourceRoot":"","sources":["../../src/__clients__/core.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAC;AACxE,OAAO,EACL,KAAK,8BAA8B,EACnC,KAAK,OAAO,EACZ,KAAK,mBAAmB,EAExB,KAAK,sBAAsB,EAC3B,KAAK,MAAM,EACX,KAAK,gCAAgC,EAErC,KAAK,YAAY,EACjB,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,iBAAiB,EAEtB,KAAK,WAAW,EAChB,KAAK,iCAAiC,EAQtC,UAAU,EACX,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAML,KAAK,EAKL,KAAK,YAAY,EACjB,KAAK,sBAAsB,EAC3B,KAAK,aAAa,EAClB,KAAK,MAAM,EAMX,KAAK,iBAAiB,EACtB,KAAK,cAAc,EAGnB,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACxB,KAAK,YAAY,EACjB,KAAK,sBAAsB,EAC3B,KAAK,uBAAuB,EAC5B,KAAK,8BAA8B,EACnC,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC3B,KAAK,6BAA6B,EAClC,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,KAAK,iBAAiB,EACtB,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAC1B,KAAK,kBAAkB,EACvB,KAAK,yBAAyB,EAC9B,KAAK,sBAAsB,EAC3B,KAAK,iBAAiB,EACtB,KAAK,qBAAqB,EAC1B,KAAK,4BAA4B,EACjC,KAAK,0BAA0B,EAC/B,KAAK,wBAAwB,EAC7B,KAAK,wBAAwB,EAC7B,KAAK,eAAe,EACpB,KAAK,iCAAiC,EACtC,KAAK,2BAA2B,EAChC,KAAK,2BAA2B,EAChC,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,EAC1B,KAAK,2BAA2B,EAChC,KAAK,2BAA2B,EAChC,KAAK,oBAAoB,EACzB,KAAK,sBAAsB,EAC3B,KAAK,0BAA0B,EAC/B,KAAK,gBAAgB,EACrB,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACvB,KAAK,0BAA0B,EAC/B,KAAK,kBAAkB,EACvB,KAAK,sBAAsB,EAC3B,KAAK,yBAAyB,EAC9B,KAAK,kBAAkB,EACvB,KAAK,sBAAsB,EAC3B,KAAK,2BAA2B,EAChC,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,EACzB,KAAK,gBAAgB,EACrB,KAAK,sBAAsB,EAC3B,KAAK,sBAAsB,EAC3B,KAAK,oBAAoB,EACzB,KAAK,+BAA+B,EACpC,KAAK,sBAAsB,EAC3B,KAAK,6BAA6B,EAClC,KAAK,6BAA6B,EAClC,KAAK,qBAAqB,EAC1B,KAAK,2BAA2B,EAChC,KAAK,2BAA2B,EAChC,KAAK,4BAA4B,EACjC,KAAK,6BAA6B,EAClC,KAAK,sBAAsB,EAC5B,MAAM,cAAc,CAAC;AAiCtB,OAAO,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AACtE,OAAO,EAAE,2BAA2B,EAAE,MAAM,8BAA8B,CAAC;AAW3E,OAAO,EAAkB,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAEhF;;;;;;;GAOG;AACH,KAAK,aAAa,CAAC,CAAC,IAAI;KACrB,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,QAAQ,GAAG,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;CAC1D,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG,IAAI,CACrC,aAAa,CAAC,aAAa,CAAC,EAC5B,MAAM,GAAG,QAAQ,GAAG,YAAY,GAAG,aAAa,CACjD,CAAC;AAEF,qBAAa,aAAa;IACxB,MAAM,EAAE,sBAAsB,CAAC;IAC/B,UAAU,EAAG,oBAAoB,CAAC;IAElC,OAAO,CAAC,aAAa,CAAC,CAAyC;IAC/D,OAAO,CAAC,cAAc,CAAC,CAA0C;IACjE,OAAO,CAAC,eAAe,CAAC,CAA8B;IACtD,OAAO,CAAC,aAAa,CAAC,CAAgC;IACtD,OAAO,CAAC,cAAc,CAAe;gBAGnC,MAAM,EAAE,sBAAsB,EAG9B,aAAa,CAAC,EAAE,0BAA0B,EAC1C,cAAc,CAAC,EAAE,2BAA2B,EAC5C,eAAe,CAAC,EAAE,eAAe,EACjC,aAAa,CAAC,EAAE,iBAAiB;IAa7B,IAAI;IA6CV;;;;;;;;;;;OAWG;IACH,qBAAqB,WACX,2BAA2B,KAClC,QAAQ,IAAI,CAAC,CA0Bd;IAEF;;;;;;;;;;OAUG;IACH,sBAAsB,WACZ,4BAA4B,KACnC,QAAQ,IAAI,CAAC,CAmBd;IAEF;;;;;;;;;;;;;;;OAeG;IACH,uBAAuB,WACb,6BAA6B,KACpC,QAAQ,IAAI,CAAC,CAiDd;IAEF;;;;;;;;;;;;;;;OAeG;IACH,gBAAgB,YACL,sBAAsB,KAC9B,oBAAoB,CAwBrB;IAEF;;;;;;;;;;;OAWG;IACH,aAAa,WACH,mBAAmB,KAC1B,QAAQ,mBAAmB,CAAC,CAuE7B;IAEF;;;;;;;;;;OAUG;IACH,MAAM,YAAmB,YAAY,KAAG,QAAQ,IAAI,CAAC,CA4BnD;IAEF;;;;;;;;;;;;;;;;;;OAkBG;IACH,gBAAgB,YACL,sBAAsB,KAC9B,QAAQ,iBAAiB,CAAC,CAoH3B;IAEF;;;;;;;;;;;;;;;;;;;OAmBG;IACH,iBAAiB,YACN,uBAAuB,KAC/B,QAAQ,iBAAiB,CAAC,CAkH3B;IAEF;;;;;;;;;OASG;IACH,oBAAoB,WAAkB,KAAK,KAAG,QAAQ,cAAc,EAAE,CAAC,CAiBrE;IAEF;;;;;;;;OAQG;IACH,oBAAoB,mBACF,cAAc,KAC7B,QAAQ,MAAM,CAAC,CA8BhB;IAEF;;;;;;;;OAQG;IACH,uBAAuB,mBAA0B,cAAc,mBAmB7D;IAEF;;;;;;;;;;;;;;;OAeG;IACH,wBAAwB,WACd,8BAA8B,KACrC,QAAQ,IAAI,CAAC,CAgDd;IAEF;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,uBAAuB,WACb,6BAA6B,KACpC,QAAQ,6BAA6B,CAAC,CAyGvC;IAEF;;;;;;;;;;;;;;;;;;OAkBG;IACH,eAAe,WACL,qBAAqB,KAC5B,QAAQ,gBAAgB,CAAC,CAwC1B;IAEF;;;;;;;;;;;;;;;;;;OAkBG;IACH,gBAAgB,WACN,sBAAsB,KAC7B,QAAQ,gBAAgB,CAAC,CAkE1B;IAEF;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,uBAAuB,WACb,6BAA6B,KACpC,QAAQ,gBAAgB,GAAG;QAAE,MAAM,EAAE,UAAU,CAAA;KAAE,CAAC,CA8FnD;IAEF;;;;;;;;;;;;;;;;OAgBG;IACH,OAAO,WAAkB,aAAa,KAAG,QAAQ,aAAa,CAAC,CAyC7D;IAEF;;;;;;;;;;;;;;;OAeG;IACH,SAAS,WAAkB,eAAe,KAAG,QAAQ,eAAe,CAAC,CA+DnE;IAEF;;;;;;;;;;;;;;;;OAgBG;IACH,YAAY,WACF,kBAAkB,KACzB,QAAQ,cAAc,CAAC,CAoExB;IAEF;;;;;;;;;;;;;;;;;;;OAmBG;IACH,aAAa,WACH,mBAAmB,KAC1B,QAAQ,cAAc,CAAC,CA0FxB;IAEF;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,WAAW,WACD,iBAAiB,KACxB,QACD,cAAc,GAAG;QAAE,iBAAiB,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,UAAU,CAAA;KAAE,CACnE,CAwGC;IAEF;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,aAAa,WACH,mBAAmB,KAC1B,QAAQ,cAAc,GAAG;QAAE,MAAM,EAAE,UAAU,CAAA;KAAE,CAAC,CAkEjD;IAEF;;;;;;;;;;;;;;;;;;OAkBG;IACH,cAAc,WACJ,oBAAoB,KAC3B,QAAQ,cAAc,CAAC,CAoFxB;IAEF;;;;;;;;;;;;;;;;;OAiBG;IACH,eAAe,WACL,qBAAqB,KAC5B,QAAQ,cAAc,CAAC,CAuDxB;IAEF;;;;;;;;;;;;;;;;OAgBG;IACH,YAAY,YAAmB,kBAAkB,KAAG,QAAQ,MAAM,EAAE,CAAC,CA0LnE;IAEF;;;;;;;;;;;;;;;;;;;OAmBG;IACH,mBAAmB,WACT,yBAAyB,KAChC,QAAQ,aAAa,EAAE,CAAC,CAmLzB;IAEF;;;;;;;;;;OAUG;IACH,gBAAgB,YACL,sBAAsB,KAC9B,QAAQ,YAAY,EAAE,CAAC,CAqCxB;IAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAqCG;IACH,WAAW,WACD,iBAAiB,KACxB,QAAQ,sBAAsB,CAAC,CAiFhC;IAEF;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,eAAe,WAAkB,qBAAqB,KAAG,QAAQ,MAAM,CAAC,CAsDtE;IAEF;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,sBAAsB,WACZ,4BAA4B,KACnC,QAAQ,MAAM,CAAC,CAuFhB;IAEF;;;;;;;;;;;;;;;;;;OAkBG;IACH,oBAAoB,WACV,0BAA0B,KACjC,QAAQ,MAAM,CAAC,CA2DhB;IAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA8BG;IACH,kBAAkB,WACR,wBAAwB,KAC/B,QAAQ,MAAM,CAAC,CAkDhB;IAEF;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,kBAAkB,WACR,wBAAwB,KAC/B,QAAQ,MAAM,CAAC,CAwDhB;IAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IAEG,qBAAqB,CACzB,MAAM,EAAE,2BAA2B,GAClC,OAAO,CAAC,iCAAiC,CAAC;IAuE7C;;;;;;;;;;;;;;OAcG;IACH,SAAS,YAAmB,eAAe,KAAG,QAAQ,MAAM,CAAC,CAgD3D;IAEF;;;;;;;;;;;;;;;OAeG;IACH,2BAA2B,WACjB,iCAAiC,KACxC,QAAQ,MAAM,CAAC,CA6GhB;IAEF;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,qBAAqB,WACX,2BAA2B,KAClC,QAAQ,2BAA2B,CAAC,CAuGrC;IAEF;;;;;;;;;;;;;;;;OAgBG;IACH,eAAe,WAAkB,qBAAqB,KAAG,QAAQ,MAAM,CAAC,CA6DtE;IAEF;;;;;;;;;;;;;OAaG;IACH,eAAe,YAAmB,qBAAqB,KAAG,QAAQ,MAAM,CAAC,CAuCvE;IAEF;;;;;;;;;;;;;;;;OAgBG;IACH,qBAAqB,WACX,2BAA2B,KAClC,QAAQ,MAAM,CAAC,CA6DhB;IAEF;;;;;;;;;;;;;OAaG;IACH,qBAAqB,YACV,2BAA2B,KACnC,QAAQ,MAAM,CAAC,CAuChB;IAEF;;;;;;;;;;;;;;;OAeG;IACH,cAAc,WAAkB,oBAAoB,KAAG,QAAQ,MAAM,CAAC,CA4CpE;IAEF;;;;;;;;;;;;;;;;;;OAkBG;IACH,gBAAgB,WACN,sBAAsB,KAC7B,QAAQ,MAAM,EAAE,CAAC,CA4KlB;IAEF;;;;;;;;;;;;;;;OAeG;IACH,oBAAoB,WACV,0BAA0B,KACjC,QAAQ,MAAM,EAAE,CAAC,CA0ClB;IAEF;;;;;;;;;;;;;;;;OAgBG;IACH,UAAU,YAAmB,gBAAgB,KAAG,QAAQ,MAAM,EAAE,CAAC,CAqD/D;IAEF;;;;;;;;;;;;;;;OAeG;IACH,cAAc,WAAkB,mBAAmB,KAAG,QAAQ,MAAM,EAAE,CAAC,CA2CrE;IAEF;;;;;;;;;;;;;;;;;;OAkBG;IACH,YAAY,WAAkB,kBAAkB,KAAG,QAAQ,MAAM,CAAC,CA0DhE;IAEF;;;;;;;;;;;;;;;;OAgBG;IACH,oBAAoB,WACV,0BAA0B,KACjC,QAAQ,MAAM,EAAE,CAAC,CAiElB;IAEF;;;;;;;;;;;;;;;;OAgBG;IACH,YAAY,WAAkB,kBAAkB,KAAG,QAAQ,YAAY,CAAC,CA6CtE;IAEF;;;;;;;;;;;;;;;OAeG;IACH,gBAAgB,WACN,sBAAsB,KAC7B,QAAQ,YAAY,CAAC,CA4CtB;IAEF;;;;;;;;;;;;;;;;OAgBG;IACH,mBAAmB,WACT,yBAAyB,KAChC,QAAQ,YAAY,CAAC,CA4CtB;IAEF;;;;;;;;;;;;;;;;;;OAkBG;IACH,YAAY,WAAkB,kBAAkB,KAAG,QAAQ,MAAM,CAAC,CAkEhE;IAEF;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,gBAAgB,WACN,sBAAsB,KAC7B,QAAQ,MAAM,CAAC,CAiEhB;IAEF;;;;;;;;;;;;;;OAcG;IACH,qBAAqB,YACV,2BAA2B,KACnC,QAAQ,8BAA8B,CAAC,CA0BxC;IAEF;;;;;;;;;;;;;OAaG;IACH,YAAY,WAAkB,kBAAkB,KAAG,QAAQ,IAAI,CAAC,CAgB9D;IAEF;;;;;;;;;;;OAWG;IACH,YAAY,YAAmB,kBAAkB,KAAG,QAAQ,IAAI,CAAC,CAsB/D;IAEF;;;;;;;;;;OAUG;IACH,gBAAgB,QAAa,QAAQ,IAAI,CAAC,CAcxC;IAEF;;;;;;;;;;;;;;;;;OAiBG;IACH,cAAc,YACH,oBAAoB,KAC5B,QAAQ,mBAAmB,GAAG,SAAS,CAAC,CAqFzC;IAEF;;;;;;;;;;OAUG;IACH,UAAU,YACC,gBAAgB,KACxB,QAAQ,OAAO,GAAG,SAAS,CAAC,CAY7B;IAEF;;;;;;;;;;OAUG;IACH,cAAc,QAAa,QAAQ,OAAO,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC,CAqBrE;IAEF;;;;;;;;;;;OAWG;IACH,gBAAgB,WAAkB,sBAAsB,KAAG,QAAQ,IAAI,CAAC,CAWtE;IAEF;;;;;;;;;;OAUG;IACH,mBAAmB,QAAa,QAAQ,MAAM,GAAG,SAAS,CAAC,CAUzD;IAEF;;;;;;;;;;OAUG;IACH,mBAAmB,QAAa,QAAQ,IAAI,CAAC,CAoC3C;IAEF;;;;;;;;;;;OAWG;IACH,gBAAgB,YACL,sBAAsB,KAC9B,QAAQ,MAAM,CAAC,CAsBhB;IAEF;;;;;;;;;;;OAWG;IACH,gBAAgB,WAAkB,sBAAsB,KAAG,QAAQ,IAAI,CAAC,CAkBtE;IAEF;;;;;;;;;;;;OAYG;IACH,cAAc,WAAkB,oBAAoB,KAAG,QAAQ,MAAM,CAAC,CA6BpE;IAEF;;;;;;;;;;OAUG;IACH,kBAAkB,QAAa,QAAQ,gCAAgC,CAAC,CAmBtE;IAEF;;;;;;;;;;;;;OAaG;IACH,yBAAyB,WACf,+BAA+B,KACtC,QAAQ,WAAW,CAAC,CAoDrB;IAEF;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,eAAe,WAAkB,qBAAqB,KAAG,QAAQ,IAAI,CAAC,CA+DpE;CACH"}

package/dist/__clients__/core.js

@@ -6,20 +6,21 @@ var auth = require('../__types__/auth.js');
 var enums = require('../__types__/enums.js');
 var utils = require('../utils.js');
 var crypto = require('@turnkey/crypto');
-var base = require('../__storage__/base.js');
-var base$1 = require('../__stampers__/api/base.js');
-var base$2 = require('../__stampers__/passkey/base.js');
+var base$1 = require('../__storage__/base.js');
+var base$2 = require('../__stampers__/api/base.js');
+var base$3 = require('../__stampers__/passkey/base.js');
 var turnkeyHelpers = require('../turnkey-helpers.js');
 var jwtDecode = require('jwt-decode');
-var base$3 = require('../__wallet__/base.js');
+var base$4 = require('../__wallet__/base.js');
 var ethers = require('ethers');
 var apiKeyStamper = require('@turnkey/api-key-stamper');
 var viem = require('viem');
+var base = require('../__stampers__/attested/base.js');
 
 class TurnkeyClient {
     constructor(config, 
     // Users can pass in their own stampers, or we will create them. Should we remove this?
-    apiKeyStamper$1, passkeyStamper, walletManager) {
+    apiKeyStamper$1, passkeyStamper, attestedStamper, walletManager) {
         /**
          * Overrides the API key stamper configuration.
          *
@@ -75,6 +76,58 @@ class TurnkeyClient {
                 errorCode: sdkTypes.TurnkeyErrorCodes.INITIALIZE_PASSKEY_STAMPER_ERROR,
             });
         };
+        /**
+         * Overrides the attested stamper with a verification token or OIDC token.
+         *
+         * - This function updates the attested stamper's identity and automatically sets the correct scheme.
+         * - Pass `verificationToken` to set the attestation identity and scheme to STAMP_ATTESTED_SCHEME_P256_VERIFICATION_TOKEN.
+         * - Pass `oidcToken` to set the attestation identity and scheme to STAMP_ATTESTED_SCHEME_P256_OIDC.
+         * - Only one of `verificationToken` or `oidcToken` can be provided at a time.
+         * - If neither token is provided, the attestation identity is cleared.
+         * - Useful for dynamically changing the attested identity and scheme used for signing requests.
+         *
+         * @param params.verificationToken - verification token to use as the attested identity with STAMP_ATTESTED_SCHEME_P256_VERIFICATION_TOKEN scheme.
+         * @param params.oidcToken - OIDC token to use as the attested identity with STAMP_ATTESTED_SCHEME_P256_OIDC scheme.
+         * @param params.publicKey - public key that signs the attested stamp. Must match the key bound to the token.
+         * @returns A promise that resolves when the stamper has been updated.
+         * @throws {TurnkeyError} If the attested stamper is not initialized, if both tokens are provided, or if there is an error updating it.
+         */
+        this.overrideAttestedStamper = async (params) => {
+            return utils.withTurnkeyErrorHandling(async () => {
+                if (!this.attestedStamper) {
+                    throw new sdkTypes.TurnkeyError("Attested stamper is not initialized", sdkTypes.TurnkeyErrorCodes.INTERNAL_ERROR);
+                }
+                const { verificationToken, oidcToken, publicKey } = params;
+                // we enforce that you cannot set both a verificationToken and an oidcToken
+                if (verificationToken && oidcToken) {
+                    throw new sdkTypes.TurnkeyError("Cannot set both verificationToken and oidcToken. Please provide only one.", sdkTypes.TurnkeyErrorCodes.INVALID_REQUEST);
+                }
+                // we require a publicKey if either a verificationToken or an oidcToken is provided
+                if ((verificationToken || oidcToken) && !publicKey) {
+                    throw new sdkTypes.TurnkeyError("A publicKey must be provided when setting a verificationToken or oidcToken.", sdkTypes.TurnkeyErrorCodes.INVALID_REQUEST);
+                }
+                if (verificationToken) {
+                    this.attestedStamper.configure({
+                        attestedIdentity: verificationToken,
+                        publicKey: publicKey,
+                        scheme: base.AttestedScheme.P256_VERIFICATION_TOKEN,
+                    });
+                }
+                else if (oidcToken) {
+                    this.attestedStamper.configure({
+                        attestedIdentity: oidcToken,
+                        publicKey: publicKey,
+                        scheme: base.AttestedScheme.P256_OIDC,
+                    });
+                }
+                else {
+                    this.attestedStamper.clear();
+                }
+            }, {
+                errorMessage: "Failed to override attested stamper",
+                errorCode: sdkTypes.TurnkeyErrorCodes.INTERNAL_ERROR,
+            });
+        };
         /**
          * Creates a new TurnkeySDKClientBase instance with the provided configuration.
          * This method is used internally to create the HTTP client for making API requests,
@@ -106,6 +159,7 @@ class TurnkeyClient {
                 organizationId,
                 apiKeyStamper: this.apiKeyStamper,
                 passkeyStamper: this.passkeyStamper,
+                attestedStamper: this.attestedStamper,
                 walletStamper: this.walletManager?.stamper,
                 storageManager: this.storageManager,
             });
@@ -247,6 +301,7 @@ class TurnkeyClient {
                     };
                     await this.overridePasskeyStamper({ config: mergedConfig });
                 }
+                const sessionProfileId = params?.sessionProfileId;
                 if (!generatedPublicKey) {
                     throw new sdkTypes.TurnkeyError("A publickey could not be found or generated.", sdkTypes.TurnkeyErrorCodes.INTERNAL_ERROR);
                 }
@@ -254,6 +309,7 @@ class TurnkeyClient {
                     publicKey: generatedPublicKey,
                     organizationId: params?.organizationId ?? this.config.organizationId,
                     expirationSeconds,
+                    ...(sessionProfileId && { sessionProfileId }),
                 };
                 const passkeyLoginRequest = await this.httpClient.stampStampLogin(loginPayload, enums.StamperType.Passkey);
                 if (!passkeyLoginRequest) {
@@ -321,7 +377,7 @@ class TurnkeyClient {
          * @throws {TurnkeyError} If there is an error during passkey creation, sub-organization creation, or session storage.
          */
         this.signUpWithPasskey = async (params) => {
-            const { passkeyDisplayName, challenge, expirationSeconds = auth.DEFAULT_SESSION_EXPIRATION_IN_SECONDS, createSubOrgParams, sessionKey = enums.SessionKey.DefaultSessionkey, captchaToken, } = params || {};
+            const { passkeyDisplayName, challenge, expirationSeconds = auth.DEFAULT_SESSION_EXPIRATION_IN_SECONDS, createSubOrgParams, sessionKey = enums.SessionKey.DefaultSessionkey, sessionProfileId, captchaToken, } = params || {};
             const generatedPublicKey = await this.createApiKeyPair();
             return utils.withTurnkeyErrorHandling(async () => {
                 if (!this.passkeyStamper) {
@@ -370,6 +426,7 @@ class TurnkeyClient {
                     publicKey: newGeneratedKeyPair,
                     organizationId: res.organizationId,
                     expirationSeconds,
+                    ...(sessionProfileId && { sessionProfileId }),
                 });
                 await this.storeSession({
                     sessionToken: sessionResponse.session,
@@ -528,7 +585,7 @@ class TurnkeyClient {
          *                        or the public key cannot be derived or generated.
          */
         this.buildWalletLoginRequest = async (params) => {
-            const { walletProvider, publicKey: providedPublicKey } = params;
+            const { walletProvider, publicKey: providedPublicKey, sessionProfileId, } = params;
             const expirationSeconds = params.expirationSeconds || auth.DEFAULT_SESSION_EXPIRATION_IN_SECONDS;
             const futureSessionPublicKey = providedPublicKey ?? (await this.createApiKeyPair());
             return utils.withTurnkeyErrorHandling(async () => {
@@ -547,6 +604,7 @@ class TurnkeyClient {
                         publicKey: futureSessionPublicKey,
                         organizationId: this.config.organizationId,
                         expirationSeconds,
+                        ...(sessionProfileId && { sessionProfileId }),
                     }, enums.StamperType.Wallet);
                 }, {
                     errorMessage: "Failed to create stamped request for wallet login",
@@ -889,34 +947,27 @@ class TurnkeyClient {
          * @throws {TurnkeyError} If there is an error during the OTP login process or if key pair cleanup fails.
          */
         this.loginWithOtp = async (params) => {
-            const { verificationToken, invalidateExisting = false, organizationId, sessionKey = enums.SessionKey.DefaultSessionkey, } = params;
+            const { verificationToken, invalidateExisting = false, organizationId, sessionKey = enums.SessionKey.DefaultSessionkey, expirationSeconds = auth.DEFAULT_SESSION_EXPIRATION_IN_SECONDS, sessionProfileId, } = params;
             return utils.withTurnkeyErrorHandling(async () => {
-                const { message, publicKey: verificationPublicKey } = utils.getClientSignatureMessageForLogin({ verificationToken });
-                // we sign with the verification token key. This is the key bound during
-                // verifyOtp() and is what Turnkey expects to sign the client signature for login
-                const signature = await this.signWithApiKey({
-                    message,
-                    publicKey: verificationPublicKey,
-                });
-                if (!signature) {
-                    throw new sdkTypes.TurnkeyError(`Failed to sign client signature for OTP login`, sdkTypes.TurnkeyErrorCodes.INTERNAL_ERROR);
+                const { public_key: verificationPublicKey } = utils.decodeVerificationToken(verificationToken);
+                if (!verificationPublicKey) {
+                    throw new sdkTypes.TurnkeyError("Invalid verification token: missing publicKey", sdkTypes.TurnkeyErrorCodes.INVALID_REQUEST);
                 }
-                const clientSignature = {
-                    message: message,
+                // We override the attested stamper with the verification token so the stampLogin request can be stamped with it.
+                await this.overrideAttestedStamper({
+                    verificationToken,
                     publicKey: verificationPublicKey,
-                    scheme: "CLIENT_SIGNATURE_SCHEME_API_P256",
-                    signature: signature,
-                };
+                });
                 // the verification token's public key is also used as the session public key for login
-                const loginRes = await this.httpClient.proxyOtpLoginV2({
-                    verificationToken,
+                const loginRes = await this.httpClient.stampLogin({
                     publicKey: verificationPublicKey,
-                    clientSignature,
+                    expirationSeconds,
                     invalidateExisting,
                     ...(organizationId && { organizationId }),
-                });
+                    ...(sessionProfileId && { sessionProfileId }),
+                }, enums.StamperType.Attested);
                 if (!loginRes) {
-                    throw new sdkTypes.TurnkeyError(`Auth proxy OTP login failed`, sdkTypes.TurnkeyErrorCodes.OTP_LOGIN_ERROR);
+                    throw new sdkTypes.TurnkeyError(`OTP login failed`, sdkTypes.TurnkeyErrorCodes.OTP_LOGIN_ERROR);
                 }
                 if (!loginRes.session) {
                     throw new sdkTypes.TurnkeyError("No session returned from OTP login", sdkTypes.TurnkeyErrorCodes.OTP_LOGIN_ERROR);
@@ -954,7 +1005,7 @@ class TurnkeyClient {
          * @throws {TurnkeyError} If there is an error during the OTP sign-up process or session storage.
          */
         this.signUpWithOtp = async (params) => {
-            const { verificationToken, contact, otpType, createSubOrgParams, invalidateExisting, sessionKey, captchaToken, } = params;
+            const { verificationToken, contact, otpType, createSubOrgParams, invalidateExisting, sessionKey, sessionProfileId, captchaToken, } = params;
             // build sign up body without client signature first
             const signUpBody = utils.buildSignUpBody({
                 createSubOrgParams: {
@@ -1002,6 +1053,7 @@ class TurnkeyClient {
                     verificationToken,
                     ...(invalidateExisting && { invalidateExisting }),
                     ...(sessionKey && { sessionKey }),
+                    ...(sessionProfileId && { sessionProfileId }),
                 });
                 return {
                     ...otpRes,
@@ -1039,7 +1091,7 @@ class TurnkeyClient {
          * @throws {TurnkeyError} If there is an error during OTP verification, sign-up, or login.
          */
         this.completeOtp = async (params) => {
-            const { otpId, otpCode, otpEncryptionTargetBundle, contact, otpType, invalidateExisting = false, sessionKey, createSubOrgParams, captchaToken, } = params;
+            const { otpId, otpCode, otpEncryptionTargetBundle, contact, otpType, invalidateExisting = false, sessionKey, createSubOrgParams, sessionProfileId, captchaToken, } = params;
             const publicKey = params.publicKey ?? (await this.createApiKeyPair());
             if (!publicKey) {
                 throw new sdkTypes.TurnkeyError("No public key available. Either pass a publicKey or ensure apiKeyStamper is configured.", sdkTypes.TurnkeyErrorCodes.INVALID_REQUEST);
@@ -1071,6 +1123,7 @@ class TurnkeyClient {
                         ...(createSubOrgParams && { createSubOrgParams }),
                         ...(invalidateExisting && { invalidateExisting }),
                         ...(sessionKey && { sessionKey }),
+                        ...(sessionProfileId && { sessionProfileId }),
                         ...(captchaToken && { captchaToken }),
                     });
                     return {
@@ -1084,6 +1137,7 @@ class TurnkeyClient {
                         verificationToken,
                         ...(invalidateExisting && { invalidateExisting }),
                         ...(sessionKey && { sessionKey }),
+                        ...(sessionProfileId && { sessionProfileId }),
                     });
                     return {
                         ...loginRes,
@@ -1129,7 +1183,7 @@ class TurnkeyClient {
          * @throws {TurnkeyError} If there is an error during the OAuth completion process, such as account lookup, sign-up, or login.
          */
         this.completeOauth = async (params) => {
-            const { oidcToken, publicKey, providerName, createSubOrgParams, invalidateExisting, sessionKey, captchaToken, } = params;
+            const { oidcToken, publicKey, providerName, createSubOrgParams, invalidateExisting, sessionKey, sessionProfileId, captchaToken, } = params;
             return utils.withTurnkeyErrorHandling(async () => {
                 const accountRes = await this.httpClient.proxyGetAccount({
                     filterType: "OIDC_TOKEN",
@@ -1145,6 +1199,7 @@ class TurnkeyClient {
                         publicKey,
                         ...(invalidateExisting && { invalidateExisting }),
                         ...(sessionKey && { sessionKey }),
+                        ...(sessionProfileId && { sessionProfileId }),
                     });
                     return {
                         ...loginRes,
@@ -1163,6 +1218,7 @@ class TurnkeyClient {
                         }),
                         ...(invalidateExisting && { invalidateExisting }),
                         ...(sessionKey && { sessionKey }),
+                        ...(sessionProfileId && { sessionProfileId }),
                         ...(captchaToken && { captchaToken }),
                     });
                     return {
@@ -1195,19 +1251,25 @@ class TurnkeyClient {
          * @throws {TurnkeyError} If there is an error during the OAuth login process or if key pair cleanup fails.
          */
         this.loginWithOauth = async (params) => {
-            const { oidcToken, publicKey, organizationId, invalidateExisting = false, sessionKey = enums.SessionKey.DefaultSessionkey, } = params;
+            const { oidcToken, publicKey, organizationId, invalidateExisting = false, sessionKey = enums.SessionKey.DefaultSessionkey, expirationSeconds = auth.DEFAULT_SESSION_EXPIRATION_IN_SECONDS, sessionProfileId, } = params;
             return utils.withTurnkeyErrorHandling(async () => {
                 if (!publicKey) {
                     throw new sdkTypes.TurnkeyError("Public key must be provided to log in with OAuth. Please create a key pair first.", sdkTypes.TurnkeyErrorCodes.MISSING_PARAMS);
                 }
-                const loginRes = await this.httpClient.proxyOAuthLogin({
+                // We override the attested stamper with the oidcToken so the stampLogin request can be stamped with it.
+                await this.overrideAttestedStamper({
                     oidcToken,
                     publicKey,
+                });
+                const loginRes = await this.httpClient.stampLogin({
+                    publicKey,
+                    expirationSeconds,
                     invalidateExisting,
                     ...(organizationId && { organizationId }),
-                });
+                    ...(sessionProfileId && { sessionProfileId }),
+                }, enums.StamperType.Attested);
                 if (!loginRes) {
-                    throw new sdkTypes.TurnkeyError(`Auth proxy OAuth login failed`, sdkTypes.TurnkeyErrorCodes.OAUTH_LOGIN_ERROR);
+                    throw new sdkTypes.TurnkeyError(`OAuth login failed`, sdkTypes.TurnkeyErrorCodes.OAUTH_LOGIN_ERROR);
                 }
                 if (!loginRes.session) {
                     throw new sdkTypes.TurnkeyError("No session returned from oauth login", sdkTypes.TurnkeyErrorCodes.OAUTH_LOGIN_ERROR);
@@ -1258,7 +1320,7 @@ class TurnkeyClient {
          * @throws {TurnkeyError} If there is an error during the OAuth sign-up or login process.
          */
         this.signUpWithOauth = async (params) => {
-            const { oidcToken, publicKey, providerName = "OpenID Connect Provider" + " " + Date.now(), createSubOrgParams, sessionKey, captchaToken, } = params;
+            const { oidcToken, publicKey, providerName = "OpenID Connect Provider" + " " + Date.now(), createSubOrgParams, sessionKey, sessionProfileId, captchaToken, } = params;
             return utils.withTurnkeyErrorHandling(async () => {
                 const signUpBody = utils.buildSignUpBody({
                     createSubOrgParams: {
@@ -1280,6 +1342,7 @@ class TurnkeyClient {
                     oidcToken,
                     publicKey: publicKey,
                     ...(sessionKey && { sessionKey }),
+                    ...(sessionProfileId && { sessionProfileId }),
                 });
                 return {
                     ...oauthRes,
@@ -3137,6 +3200,9 @@ class TurnkeyClient {
                     publicKey: keyPair,
                     expirationSeconds,
                     invalidateExisting: invalidateExisitng,
+                    ...(session.sessionProfileId && {
+                        sessionProfileId: session.sessionProfileId,
+                    }),
                 }, stampWith);
                 if (!res || !res.session) {
                     throw new sdkTypes.TurnkeyError("No session found in the refresh response", sdkTypes.TurnkeyErrorCodes.BAD_RESPONSE);
@@ -3437,10 +3503,24 @@ class TurnkeyClient {
             });
         };
         /**
-         * Verifies a list of app proofs against their corresponding boot proofs.
+         * Verifies a list of app proofs against their corresponding boot proofs using
+         * the example/reference-grade check from `@turnkey/crypto`.
          *
          * - This function iterates through each provided app proof, fetches the corresponding boot proof, and verifies the app proof against the boot proof.
          * - If any app proof fails verification, an error is thrown.
+         *
+         * @remarks
+         * WARNING: This is not full verification of a Turnkey enclave. It verifies
+         * that the proof came from a genuine AWS Nitro enclave and that proof
+         * signatures chain correctly, but it does not verify enclave identity or image
+         * measurements. It does not inspect `attestationDoc.pcrs` (PCR0-3 image
+         * measurements), and it does not compare the QOS manifest content against a
+         * known-good or pinned Turnkey manifest. Any party with an AWS account can
+         * produce attestations from their own Nitro enclave that pass this check.
+         *
+         * For full verification, callers must additionally pin and verify expected
+         * PCR measurements and manifest content. See https://github.com/tkhq/qos.
+         *
          * @param params.appProofs - the app proofs to verify.
          * @param params.organizationId - organization ID to specify the sub-organization (defaults to the current session's organizationId).
          * @param params.stampWith - parameter to stamp the request with a specific stamper (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet).
@@ -3488,29 +3568,32 @@ class TurnkeyClient {
         // Just store any explicitly provided stampers
         this.apiKeyStamper = apiKeyStamper$1;
         this.passkeyStamper = passkeyStamper;
+        this.attestedStamper = attestedStamper;
         this.walletManager = walletManager;
         // Actual initialization will happen in init()
     }
     async init() {
         // Initialize storage manager
         // TODO (Amir): StorageManager should be a class that extends StorageBase and has an init method
-        this.storageManager = await base.createStorageManager();
+        this.storageManager = await base$1.createStorageManager();
         // Initialize the API key stamper
-        this.apiKeyStamper = new base$1.CrossPlatformApiKeyStamper(this.storageManager);
+        this.apiKeyStamper = new base$2.CrossPlatformApiKeyStamper(this.storageManager);
+        // Then use it to initialize the attested stamper
+        this.attestedStamper = new base.AttestedStamper(this.apiKeyStamper);
         // we parallelize independent initializations:
         // - API key stamper init
         // - Passkey stamper creation and init (if configured)
         // - Wallet manager creation (if configured)
         const initTasks = [this.apiKeyStamper.init()];
         if (this.config.passkeyConfig) {
-            const passkeyStamper = new base$2.CrossPlatformPasskeyStamper(this.config.passkeyConfig);
+            const passkeyStamper = new base$3.CrossPlatformPasskeyStamper(this.config.passkeyConfig);
             initTasks.push(passkeyStamper.init().then(() => {
                 this.passkeyStamper = passkeyStamper;
             }));
         }
         if (this.config.walletConfig?.features?.auth ||
             this.config.walletConfig?.features?.connecting) {
-            initTasks.push(base$3.createWalletManager(this.config.walletConfig).then((manager) => {
+            initTasks.push(base$4.createWalletManager(this.config.walletConfig).then((manager) => {
                 this.walletManager = manager;
             }));
         }