@turnkey/core 2.6.0 → 2.7.1

package/dist/__clients__/core.mjs

@@ -2,7 +2,7 @@ import { TurnkeySDKClientBase } from '../__generated__/sdk-client-base.mjs';
 import { TurnkeyErrorCodes, TurnkeyError, AuthAction } from '@turnkey/sdk-types';
 import { DEFAULT_SESSION_EXPIRATION_IN_SECONDS } from '../__types__/auth.mjs';
 import { SessionKey, StamperType, WalletSource, FilterType, OtpType, OtpTypeToFilterTypeMap, Curve, Chain, SignIntent } from '../__types__/enums.mjs';
-import { withTurnkeyErrorHandling, isValidPasskeyName, isWeb, isReactNative, buildSignUpBody, findWalletProviderFromAddress, getPublicKeyFromStampHeader, addressFromPublicKey, getCurveTypeFromProvider, getClientSignatureMessageForLogin, getClientSignatureMessageForSignup, getAuthenticatorAddresses, fetchAllWalletAccountsWithCursor, mapAccountsToWallet, toExternalTimestamp, isEthereumProvider, isSolanaProvider, getActiveSessionOrThrowIfRequired, getHashFunction, getEncodingType, getEncodedMessage, splitSignature, broadcastTransaction, ERC20_TRANSFER_ABI, getPolicySignature, googleISS, isWalletAccountArray, generateWalletAccountsFromAddressFormat } from '../utils.mjs';
+import { withTurnkeyErrorHandling, isValidPasskeyName, isWeb, isReactNative, buildSignUpBody, findWalletProviderFromAddress, getPublicKeyFromStampHeader, addressFromPublicKey, getCurveTypeFromProvider, decodeVerificationToken, getClientSignatureMessageForSignup, getAuthenticatorAddresses, fetchAllWalletAccountsWithCursor, mapAccountsToWallet, toExternalTimestamp, isEthereumProvider, isSolanaProvider, getActiveSessionOrThrowIfRequired, getHashFunction, getEncodingType, getEncodedMessage, splitSignature, broadcastTransaction, ERC20_TRANSFER_ABI, getPolicySignature, googleISS, isWalletAccountArray, generateWalletAccountsFromAddressFormat } from '../utils.mjs';
 import { encryptOtpCodeToBundle, verify } from '@turnkey/crypto';
 import { createStorageManager } from '../__storage__/base.mjs';
 import { CrossPlatformApiKeyStamper } from '../__stampers__/api/base.mjs';
@@ -13,11 +13,12 @@ import { createWalletManager } from '../__wallet__/base.mjs';
 import { toUtf8Bytes } from 'ethers';
 import { SignatureFormat } from '@turnkey/api-key-stamper';
 import { encodeFunctionData } from 'viem';
+import { AttestedScheme, AttestedStamper } from '../__stampers__/attested/base.mjs';
 
 class TurnkeyClient {
     constructor(config, 
     // Users can pass in their own stampers, or we will create them. Should we remove this?
-    apiKeyStamper, passkeyStamper, walletManager) {
+    apiKeyStamper, passkeyStamper, attestedStamper, walletManager) {
         /**
          * Overrides the API key stamper configuration.
          *
@@ -73,6 +74,58 @@ class TurnkeyClient {
                 errorCode: TurnkeyErrorCodes.INITIALIZE_PASSKEY_STAMPER_ERROR,
             });
         };
+        /**
+         * Overrides the attested stamper with a verification token or OIDC token.
+         *
+         * - This function updates the attested stamper's identity and automatically sets the correct scheme.
+         * - Pass `verificationToken` to set the attestation identity and scheme to STAMP_ATTESTED_SCHEME_P256_VERIFICATION_TOKEN.
+         * - Pass `oidcToken` to set the attestation identity and scheme to STAMP_ATTESTED_SCHEME_P256_OIDC.
+         * - Only one of `verificationToken` or `oidcToken` can be provided at a time.
+         * - If neither token is provided, the attestation identity is cleared.
+         * - Useful for dynamically changing the attested identity and scheme used for signing requests.
+         *
+         * @param params.verificationToken - verification token to use as the attested identity with STAMP_ATTESTED_SCHEME_P256_VERIFICATION_TOKEN scheme.
+         * @param params.oidcToken - OIDC token to use as the attested identity with STAMP_ATTESTED_SCHEME_P256_OIDC scheme.
+         * @param params.publicKey - public key that signs the attested stamp. Must match the key bound to the token.
+         * @returns A promise that resolves when the stamper has been updated.
+         * @throws {TurnkeyError} If the attested stamper is not initialized, if both tokens are provided, or if there is an error updating it.
+         */
+        this.overrideAttestedStamper = async (params) => {
+            return withTurnkeyErrorHandling(async () => {
+                if (!this.attestedStamper) {
+                    throw new TurnkeyError("Attested stamper is not initialized", TurnkeyErrorCodes.INTERNAL_ERROR);
+                }
+                const { verificationToken, oidcToken, publicKey } = params;
+                // we enforce that you cannot set both a verificationToken and an oidcToken
+                if (verificationToken && oidcToken) {
+                    throw new TurnkeyError("Cannot set both verificationToken and oidcToken. Please provide only one.", TurnkeyErrorCodes.INVALID_REQUEST);
+                }
+                // we require a publicKey if either a verificationToken or an oidcToken is provided
+                if ((verificationToken || oidcToken) && !publicKey) {
+                    throw new TurnkeyError("A publicKey must be provided when setting a verificationToken or oidcToken.", TurnkeyErrorCodes.INVALID_REQUEST);
+                }
+                if (verificationToken) {
+                    this.attestedStamper.configure({
+                        attestedIdentity: verificationToken,
+                        publicKey: publicKey,
+                        scheme: AttestedScheme.P256_VERIFICATION_TOKEN,
+                    });
+                }
+                else if (oidcToken) {
+                    this.attestedStamper.configure({
+                        attestedIdentity: oidcToken,
+                        publicKey: publicKey,
+                        scheme: AttestedScheme.P256_OIDC,
+                    });
+                }
+                else {
+                    this.attestedStamper.clear();
+                }
+            }, {
+                errorMessage: "Failed to override attested stamper",
+                errorCode: TurnkeyErrorCodes.INTERNAL_ERROR,
+            });
+        };
         /**
          * Creates a new TurnkeySDKClientBase instance with the provided configuration.
          * This method is used internally to create the HTTP client for making API requests,
@@ -104,6 +157,7 @@ class TurnkeyClient {
                 organizationId,
                 apiKeyStamper: this.apiKeyStamper,
                 passkeyStamper: this.passkeyStamper,
+                attestedStamper: this.attestedStamper,
                 walletStamper: this.walletManager?.stamper,
                 storageManager: this.storageManager,
             });
@@ -245,6 +299,7 @@ class TurnkeyClient {
                     };
                     await this.overridePasskeyStamper({ config: mergedConfig });
                 }
+                const sessionProfileId = params?.sessionProfileId;
                 if (!generatedPublicKey) {
                     throw new TurnkeyError("A publickey could not be found or generated.", TurnkeyErrorCodes.INTERNAL_ERROR);
                 }
@@ -252,6 +307,7 @@ class TurnkeyClient {
                     publicKey: generatedPublicKey,
                     organizationId: params?.organizationId ?? this.config.organizationId,
                     expirationSeconds,
+                    ...(sessionProfileId && { sessionProfileId }),
                 };
                 const passkeyLoginRequest = await this.httpClient.stampStampLogin(loginPayload, StamperType.Passkey);
                 if (!passkeyLoginRequest) {
@@ -319,7 +375,7 @@ class TurnkeyClient {
          * @throws {TurnkeyError} If there is an error during passkey creation, sub-organization creation, or session storage.
          */
         this.signUpWithPasskey = async (params) => {
-            const { passkeyDisplayName, challenge, expirationSeconds = DEFAULT_SESSION_EXPIRATION_IN_SECONDS, createSubOrgParams, sessionKey = SessionKey.DefaultSessionkey, captchaToken, } = params || {};
+            const { passkeyDisplayName, challenge, expirationSeconds = DEFAULT_SESSION_EXPIRATION_IN_SECONDS, createSubOrgParams, sessionKey = SessionKey.DefaultSessionkey, sessionProfileId, captchaToken, } = params || {};
             const generatedPublicKey = await this.createApiKeyPair();
             return withTurnkeyErrorHandling(async () => {
                 if (!this.passkeyStamper) {
@@ -368,6 +424,7 @@ class TurnkeyClient {
                     publicKey: newGeneratedKeyPair,
                     organizationId: res.organizationId,
                     expirationSeconds,
+                    ...(sessionProfileId && { sessionProfileId }),
                 });
                 await this.storeSession({
                     sessionToken: sessionResponse.session,
@@ -526,7 +583,7 @@ class TurnkeyClient {
          *                        or the public key cannot be derived or generated.
          */
         this.buildWalletLoginRequest = async (params) => {
-            const { walletProvider, publicKey: providedPublicKey } = params;
+            const { walletProvider, publicKey: providedPublicKey, sessionProfileId, } = params;
             const expirationSeconds = params.expirationSeconds || DEFAULT_SESSION_EXPIRATION_IN_SECONDS;
             const futureSessionPublicKey = providedPublicKey ?? (await this.createApiKeyPair());
             return withTurnkeyErrorHandling(async () => {
@@ -545,6 +602,7 @@ class TurnkeyClient {
                         publicKey: futureSessionPublicKey,
                         organizationId: this.config.organizationId,
                         expirationSeconds,
+                        ...(sessionProfileId && { sessionProfileId }),
                     }, StamperType.Wallet);
                 }, {
                     errorMessage: "Failed to create stamped request for wallet login",
@@ -643,13 +701,14 @@ class TurnkeyClient {
          * @param params.sessionKey - session key to use for storing the session (defaults to the default session key).
          * @param params.expirationSeconds - session expiration time in seconds (defaults to the configured default).
          * @param params.organizationId - organization ID to target (defaults to the session's organization ID or the parent organization ID).
+         * @param params.captchaToken - optional captcha token for bot prevention during sign up (must be enabled in the auth proxy config to take effect).
          * @returns A promise that resolves to a {@link WalletAuthResult}, which includes:
          *          - `sessionToken`: the signed JWT session token.
          *          - `address`: the authenticated wallet address.
          * @throws {TurnkeyError} If there is an error during wallet authentication, sub-organization creation, session storage, or cleanup.
          */
         this.signUpWithWallet = async (params) => {
-            const { walletProvider, createSubOrgParams, sessionKey = SessionKey.DefaultSessionkey, } = params;
+            const { walletProvider, createSubOrgParams, sessionKey = SessionKey.DefaultSessionkey, captchaToken, } = params;
             return withTurnkeyErrorHandling(async () => {
                 const { signedRequest, publicKey } = await this.buildWalletLoginRequest(params);
                 const signUpBody = buildSignUpBody({
@@ -664,7 +723,7 @@ class TurnkeyClient {
                         ],
                     },
                 });
-                const res = await this.httpClient.proxySignupV2(signUpBody);
+                const res = await this.httpClient.proxySignupV2(signUpBody, captchaToken);
                 if (!res) {
                     throw new TurnkeyError(`Sign up failed`, TurnkeyErrorCodes.WALLET_SIGNUP_AUTH_ERROR);
                 }
@@ -887,34 +946,27 @@ class TurnkeyClient {
          * @throws {TurnkeyError} If there is an error during the OTP login process or if key pair cleanup fails.
          */
         this.loginWithOtp = async (params) => {
-            const { verificationToken, invalidateExisting = false, organizationId, sessionKey = SessionKey.DefaultSessionkey, } = params;
+            const { verificationToken, invalidateExisting = false, organizationId, sessionKey = SessionKey.DefaultSessionkey, expirationSeconds = DEFAULT_SESSION_EXPIRATION_IN_SECONDS, sessionProfileId, } = params;
             return withTurnkeyErrorHandling(async () => {
-                const { message, publicKey: verificationPublicKey } = getClientSignatureMessageForLogin({ verificationToken });
-                // we sign with the verification token key. This is the key bound during
-                // verifyOtp() and is what Turnkey expects to sign the client signature for login
-                const signature = await this.signWithApiKey({
-                    message,
-                    publicKey: verificationPublicKey,
-                });
-                if (!signature) {
-                    throw new TurnkeyError(`Failed to sign client signature for OTP login`, TurnkeyErrorCodes.INTERNAL_ERROR);
+                const { public_key: verificationPublicKey } = decodeVerificationToken(verificationToken);
+                if (!verificationPublicKey) {
+                    throw new TurnkeyError("Invalid verification token: missing publicKey", TurnkeyErrorCodes.INVALID_REQUEST);
                 }
-                const clientSignature = {
-                    message: message,
+                // We override the attested stamper with the verification token so the stampLogin request can be stamped with it.
+                await this.overrideAttestedStamper({
+                    verificationToken,
                     publicKey: verificationPublicKey,
-                    scheme: "CLIENT_SIGNATURE_SCHEME_API_P256",
-                    signature: signature,
-                };
+                });
                 // the verification token's public key is also used as the session public key for login
-                const loginRes = await this.httpClient.proxyOtpLoginV2({
-                    verificationToken,
+                const loginRes = await this.httpClient.stampLogin({
                     publicKey: verificationPublicKey,
-                    clientSignature,
+                    expirationSeconds,
                     invalidateExisting,
                     ...(organizationId && { organizationId }),
-                });
+                    ...(sessionProfileId && { sessionProfileId }),
+                }, StamperType.Attested);
                 if (!loginRes) {
-                    throw new TurnkeyError(`Auth proxy OTP login failed`, TurnkeyErrorCodes.OTP_LOGIN_ERROR);
+                    throw new TurnkeyError(`OTP login failed`, TurnkeyErrorCodes.OTP_LOGIN_ERROR);
                 }
                 if (!loginRes.session) {
                     throw new TurnkeyError("No session returned from OTP login", TurnkeyErrorCodes.OTP_LOGIN_ERROR);
@@ -952,7 +1004,7 @@ class TurnkeyClient {
          * @throws {TurnkeyError} If there is an error during the OTP sign-up process or session storage.
          */
         this.signUpWithOtp = async (params) => {
-            const { verificationToken, contact, otpType, createSubOrgParams, invalidateExisting, sessionKey, captchaToken, } = params;
+            const { verificationToken, contact, otpType, createSubOrgParams, invalidateExisting, sessionKey, sessionProfileId, captchaToken, } = params;
             // build sign up body without client signature first
             const signUpBody = buildSignUpBody({
                 createSubOrgParams: {
@@ -1000,6 +1052,7 @@ class TurnkeyClient {
                     verificationToken,
                     ...(invalidateExisting && { invalidateExisting }),
                     ...(sessionKey && { sessionKey }),
+                    ...(sessionProfileId && { sessionProfileId }),
                 });
                 return {
                     ...otpRes,
@@ -1037,7 +1090,7 @@ class TurnkeyClient {
          * @throws {TurnkeyError} If there is an error during OTP verification, sign-up, or login.
          */
         this.completeOtp = async (params) => {
-            const { otpId, otpCode, otpEncryptionTargetBundle, contact, otpType, invalidateExisting = false, sessionKey, createSubOrgParams, captchaToken, } = params;
+            const { otpId, otpCode, otpEncryptionTargetBundle, contact, otpType, invalidateExisting = false, sessionKey, createSubOrgParams, sessionProfileId, captchaToken, } = params;
             const publicKey = params.publicKey ?? (await this.createApiKeyPair());
             if (!publicKey) {
                 throw new TurnkeyError("No public key available. Either pass a publicKey or ensure apiKeyStamper is configured.", TurnkeyErrorCodes.INVALID_REQUEST);
@@ -1069,6 +1122,7 @@ class TurnkeyClient {
                         ...(createSubOrgParams && { createSubOrgParams }),
                         ...(invalidateExisting && { invalidateExisting }),
                         ...(sessionKey && { sessionKey }),
+                        ...(sessionProfileId && { sessionProfileId }),
                         ...(captchaToken && { captchaToken }),
                     });
                     return {
@@ -1082,6 +1136,7 @@ class TurnkeyClient {
                         verificationToken,
                         ...(invalidateExisting && { invalidateExisting }),
                         ...(sessionKey && { sessionKey }),
+                        ...(sessionProfileId && { sessionProfileId }),
                     });
                     return {
                         ...loginRes,
@@ -1127,7 +1182,7 @@ class TurnkeyClient {
          * @throws {TurnkeyError} If there is an error during the OAuth completion process, such as account lookup, sign-up, or login.
          */
         this.completeOauth = async (params) => {
-            const { oidcToken, publicKey, providerName, createSubOrgParams, invalidateExisting, sessionKey, captchaToken, } = params;
+            const { oidcToken, publicKey, providerName, createSubOrgParams, invalidateExisting, sessionKey, sessionProfileId, captchaToken, } = params;
             return withTurnkeyErrorHandling(async () => {
                 const accountRes = await this.httpClient.proxyGetAccount({
                     filterType: "OIDC_TOKEN",
@@ -1143,6 +1198,7 @@ class TurnkeyClient {
                         publicKey,
                         ...(invalidateExisting && { invalidateExisting }),
                         ...(sessionKey && { sessionKey }),
+                        ...(sessionProfileId && { sessionProfileId }),
                     });
                     return {
                         ...loginRes,
@@ -1161,6 +1217,7 @@ class TurnkeyClient {
                         }),
                         ...(invalidateExisting && { invalidateExisting }),
                         ...(sessionKey && { sessionKey }),
+                        ...(sessionProfileId && { sessionProfileId }),
                         ...(captchaToken && { captchaToken }),
                     });
                     return {
@@ -1193,19 +1250,25 @@ class TurnkeyClient {
          * @throws {TurnkeyError} If there is an error during the OAuth login process or if key pair cleanup fails.
          */
         this.loginWithOauth = async (params) => {
-            const { oidcToken, publicKey, organizationId, invalidateExisting = false, sessionKey = SessionKey.DefaultSessionkey, } = params;
+            const { oidcToken, publicKey, organizationId, invalidateExisting = false, sessionKey = SessionKey.DefaultSessionkey, expirationSeconds = DEFAULT_SESSION_EXPIRATION_IN_SECONDS, sessionProfileId, } = params;
             return withTurnkeyErrorHandling(async () => {
                 if (!publicKey) {
                     throw new TurnkeyError("Public key must be provided to log in with OAuth. Please create a key pair first.", TurnkeyErrorCodes.MISSING_PARAMS);
                 }
-                const loginRes = await this.httpClient.proxyOAuthLogin({
+                // We override the attested stamper with the oidcToken so the stampLogin request can be stamped with it.
+                await this.overrideAttestedStamper({
                     oidcToken,
                     publicKey,
+                });
+                const loginRes = await this.httpClient.stampLogin({
+                    publicKey,
+                    expirationSeconds,
                     invalidateExisting,
                     ...(organizationId && { organizationId }),
-                });
+                    ...(sessionProfileId && { sessionProfileId }),
+                }, StamperType.Attested);
                 if (!loginRes) {
-                    throw new TurnkeyError(`Auth proxy OAuth login failed`, TurnkeyErrorCodes.OAUTH_LOGIN_ERROR);
+                    throw new TurnkeyError(`OAuth login failed`, TurnkeyErrorCodes.OAUTH_LOGIN_ERROR);
                 }
                 if (!loginRes.session) {
                     throw new TurnkeyError("No session returned from oauth login", TurnkeyErrorCodes.OAUTH_LOGIN_ERROR);
@@ -1256,7 +1319,7 @@ class TurnkeyClient {
          * @throws {TurnkeyError} If there is an error during the OAuth sign-up or login process.
          */
         this.signUpWithOauth = async (params) => {
-            const { oidcToken, publicKey, providerName = "OpenID Connect Provider" + " " + Date.now(), createSubOrgParams, sessionKey, captchaToken, } = params;
+            const { oidcToken, publicKey, providerName = "OpenID Connect Provider" + " " + Date.now(), createSubOrgParams, sessionKey, sessionProfileId, captchaToken, } = params;
             return withTurnkeyErrorHandling(async () => {
                 const signUpBody = buildSignUpBody({
                     createSubOrgParams: {
@@ -1278,6 +1341,7 @@ class TurnkeyClient {
                     oidcToken,
                     publicKey: publicKey,
                     ...(sessionKey && { sessionKey }),
+                    ...(sessionProfileId && { sessionProfileId }),
                 });
                 return {
                     ...oauthRes,
@@ -3135,6 +3199,9 @@ class TurnkeyClient {
                     publicKey: keyPair,
                     expirationSeconds,
                     invalidateExisting: invalidateExisitng,
+                    ...(session.sessionProfileId && {
+                        sessionProfileId: session.sessionProfileId,
+                    }),
                 }, stampWith);
                 if (!res || !res.session) {
                     throw new TurnkeyError("No session found in the refresh response", TurnkeyErrorCodes.BAD_RESPONSE);
@@ -3500,6 +3567,7 @@ class TurnkeyClient {
         // Just store any explicitly provided stampers
         this.apiKeyStamper = apiKeyStamper;
         this.passkeyStamper = passkeyStamper;
+        this.attestedStamper = attestedStamper;
         this.walletManager = walletManager;
         // Actual initialization will happen in init()
     }
@@ -3509,6 +3577,8 @@ class TurnkeyClient {
         this.storageManager = await createStorageManager();
         // Initialize the API key stamper
         this.apiKeyStamper = new CrossPlatformApiKeyStamper(this.storageManager);
+        // Then use it to initialize the attested stamper
+        this.attestedStamper = new AttestedStamper(this.apiKeyStamper);
         // we parallelize independent initializations:
         // - API key stamper init
         // - Passkey stamper creation and init (if configured)