@turnkey/http 3.18.1 → 4.1.0

package/CHANGELOG.md

@@ -1,9 +1,285 @@
 # @turnkey/http
 
+## 4.1.0
+
+### Minor Changes
+
+- [#1324](https://github.com/tkhq/sdk/pull/1324) [`f505818`](https://github.com/tkhq/sdk/commit/f505818e121c137d290156a32918a884ba80e5f5) Author [@janjakubnanista](https://github.com/janjakubnanista) - ### Breaking/Behavioral Changes
+
+  #### `nonce` parameter in `oauth2Authenticate` is now required
+
+  ```ts
+  # Before
+  apiClient.oauth2Authenticate({
+    oauth2CredentialId: ...,
+    authCode: ...,
+    redirectUri: ...,
+    codeVerifier: ...,
+    bearerTokenTargetPublicKey: ...,
+    // nonce can be undefined
+    nonce: undefined
+  })
+
+  # After
+  apiClient.oauth2Authenticate({
+    oauth2CredentialId: ...,
+    authCode: ...,
+    redirectUri: ...,
+    codeVerifier: ...,
+    bearerTokenTargetPublicKey: ...,
+    // nonce is required
+    nonce: ""
+  })
+  ```
+
+  #### Solana transactions in Transaction Management are now limited to the following `caip2` values:
+  - `solana:mainnet`
+  - `solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp`
+  - `solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdpKuc147dw2N9d`
+  - `solana:devnet`
+  - `solana:EtWTRABZaYq6iMfeYKouRu166VU2xqa1`
+  - `solana:EtWTRABZaYq6iMfeYKouRu166VU2xqa1wcaWoxPkrZBG`
+
+  ### New SDK methods
+
+  #### TVC
+
+  These methods will only work if you are part of the [TVC beta](https://www.turnkey.com/turnkey-verifiable-cloud#waitlist)
+  - `getTvcApp`
+  - `getTvcDeployment`
+  - `getTvcAppDeployments`
+  - `getTvcApps`
+  - `validateTvcImage`
+  - `createTvcApp`
+  - `createTvcDeployment`
+  - `createTvcManifestApprovals`
+  - `deleteTvcAppAndDeployments`
+  - `deleteTvcDeployment`
+  - `restoreTvcDeployment`
+  - `updateTvcAppLiveDeployment`
+
+  #### Spark protocol support
+  - `sparkClaimTransfer`
+  - `sparkPrepareLightningReceive`
+  - `sparkPrepareTransfer`
+  - `sparkSignFrost`
+
+### Patch Changes
+
+- Updated dependencies []:
+  - @turnkey/api-key-stamper@0.6.7
+
+## 4.0.0
+
+### Major Changes
+
+- [#1250](https://github.com/tkhq/sdk/pull/1250) [`6128132`](https://github.com/tkhq/sdk/commit/6128132d910f658cdf83ecc1dec6598eb20c008a) Author [@moeodeh3](https://github.com/moeodeh3) - ### `INIT_OTP`
+
+  `ACTIVITY_TYPE_INIT_OTP_V2` → `ACTIVITY_TYPE_INIT_OTP_V3`
+
+  **What changed:** Added required `otpEncryptionTargetBundle` to the result.
+
+  ```ts
+  // before — v1InitOtpResult
+  {
+    otpId: string;
+  }
+
+  // after — v1InitOtpResultV2
+  {
+    otpId: string;
+    otpEncryptionTargetBundle: string; // new
+  }
+  ```
+
+  ***
+
+  ### `VERIFY_OTP`
+
+  `ACTIVITY_TYPE_VERIFY_OTP` → `ACTIVITY_TYPE_VERIFY_OTP_V2`
+
+  **What changed:** Replaced plaintext `otpCode` + `publicKey` with a single `encryptedOtpBundle`.
+
+  Instead of sending the OTP code in plaintext, you now HPKE-encrypt it (along with your public key) to Turnkey's enclave using the `otpEncryptionTargetBundle` returned by `initOtp`. This ensures the OTP code never leaves the client in plaintext.
+
+  Use `encryptOtpCodeToBundle` from `@turnkey/crypto` to build the bundle:
+
+  ```ts
+  import { encryptOtpCodeToBundle } from "@turnkey/crypto";
+
+  const { otpId, otpEncryptionTargetBundle } = await client.initOtp({ ... });
+
+  // After the user enters their OTP code:
+  const encryptedOtpBundle = await encryptOtpCodeToBundle(
+    otpCode,                    // the code the user entered
+    otpEncryptionTargetBundle,  // from the initOtp response
+    publicKey,                  // your target public key
+  );
+
+  await client.verifyOtp({
+    otpId,
+    encryptedOtpBundle,
+  });
+  ```
+
+  ```ts
+  // before — v1VerifyOtpIntent
+  {
+    otpId: string;
+    otpCode: string;           // removed
+    expirationSeconds?: string;
+    publicKey?: string;         // removed
+  }
+
+  // after — v1VerifyOtpIntentV2
+  {
+    otpId: string;
+    encryptedOtpBundle: string; // new — replaces otpCode + publicKey
+    expirationSeconds?: string;
+  }
+  ```
+
+  ***
+
+  ### `OTP_LOGIN`
+
+  `ACTIVITY_TYPE_OTP_LOGIN` → `ACTIVITY_TYPE_OTP_LOGIN_V2`
+
+  **What changed:** `clientSignature` promoted from optional to required.
+
+  ```ts
+  // before — v1OtpLoginIntent
+  {
+    verificationToken: string;
+    publicKey: string;
+    expirationSeconds?: string;
+    invalidateExisting?: boolean;
+    clientSignature?: v1ClientSignature; // optional
+  }
+
+  // after — v1OtpLoginIntentV2
+  {
+    verificationToken: string;
+    publicKey: string;
+    expirationSeconds?: string;
+    invalidateExisting?: boolean;
+    clientSignature: v1ClientSignature;  // now required
+  }
+  ```
+
+  ***
+
+  ### `CREATE_OAUTH_PROVIDERS`
+
+  `ACTIVITY_TYPE_CREATE_OAUTH_PROVIDERS` → `ACTIVITY_TYPE_CREATE_OAUTH_PROVIDERS_V2`
+
+  **What changed:** Added `oidcClaims` as a new option alongside `oidcToken`; you must provide exactly one. This updated type feeds into the `CREATE_SUB_ORGANIZATION` and `CREATE_USERS` changes below.
+
+  ```ts
+  // before — v1OauthProviderParams
+  {
+    providerName: string;
+    oidcToken: string;
+  }
+
+  // after — v1OauthProviderParamsV2
+  {
+    providerName: string;
+  } & (
+    | { oidcToken: string }
+    | { oidcClaims: { iss: string; sub: string; aud: string } }
+  )
+  ```
+
+  ***
+
+  ### `CREATE_SUB_ORGANIZATION`
+
+  `ACTIVITY_TYPE_CREATE_SUB_ORGANIZATION_V7` → `ACTIVITY_TYPE_CREATE_SUB_ORGANIZATION_V8`
+
+  **What changed:** `rootUsers` items updated from `v1RootUserParamsV4` → `v1RootUserParamsV5`, which updates `oauthProviders` from `v1OauthProviderParams` → `v1OauthProviderParamsV2`.
+
+  ```ts
+  // before — v1RootUserParamsV4
+  {
+    userName: string;
+    userEmail?: string;
+    userPhoneNumber?: string;
+    apiKeys: v1ApiKeyParamsV2[];
+    authenticators: v1AuthenticatorParamsV2[];
+    oauthProviders: {              // v1OauthProviderParams
+      providerName: string;
+      oidcToken: string;           // was required
+    }[];
+  }
+
+  // after — v1RootUserParamsV5
+  {
+    userName: string;
+    userEmail?: string;
+    userPhoneNumber?: string;
+    apiKeys: v1ApiKeyParamsV2[];
+    authenticators: v1AuthenticatorParamsV2[];
+    oauthProviders: ({             // v1OauthProviderParamsV2
+      providerName: string;
+    } & (
+      | { oidcToken: string }
+      | { oidcClaims: { iss: string; sub: string; aud: string } }
+    ))[];
+  }
+  ```
+
+  ***
+
+  ### `CREATE_USERS`
+
+  `ACTIVITY_TYPE_CREATE_USERS_V3` → `ACTIVITY_TYPE_CREATE_USERS_V4`
+
+  **What changed:** `users` items updated from `v1UserParamsV3` → `v1UserParamsV4`, which updates `oauthProviders` from `v1OauthProviderParams` → `v1OauthProviderParamsV2`.
+
+  ```ts
+  // before — v1UserParamsV3
+  {
+    userName: string;
+    userEmail?: string;
+    userPhoneNumber?: string;
+    apiKeys: v1ApiKeyParamsV2[];
+    authenticators: v1AuthenticatorParamsV2[];
+    oauthProviders: {              // v1OauthProviderParams
+      providerName: string;
+      oidcToken: string;           // was required
+    }[];
+    userTags: string[];
+  }
+
+  // after — v1UserParamsV4
+  {
+    userName: string;
+    userEmail?: string;
+    userPhoneNumber?: string;
+    apiKeys: v1ApiKeyParamsV2[];
+    authenticators: v1AuthenticatorParamsV2[];
+    oauthProviders: ({             // v1OauthProviderParamsV2
+      providerName: string;
+    } & (
+      | { oidcToken: string }
+      | { oidcClaims: { iss: string; sub: string; aud: string } }
+    ))[];
+    userTags: string[];
+  }
+  ```
+
+### Patch Changes
+
+- Updated dependencies []:
+  - @turnkey/api-key-stamper@0.6.6
+
 ## 3.18.1
 
 ### Patch Changes
 
+- [#1269](https://github.com/tkhq/sdk/pull/1269) [`ef66673`](https://github.com/tkhq/sdk/commit/ef6667325d210c8aa0ea4c1d11d834ff28ddb66c) Author [@ethankonk](https://github.com/ethankonk) - Sync with v2026.4.5 of mono
+
 - Updated dependencies []:
   - @turnkey/api-key-stamper@0.6.5
 
@@ -78,7 +354,7 @@
 
   The following activity types have been versioned:
   - `ACTIVITY_TYPE_INIT_OTP` → `ACTIVITY_TYPE_INIT_OTP_V2`
-  - `ACTIVITY_TYPE_INIT_OTP_AUTH_V2` → `ACTIVITY_TYPE_INIT_OTP_V3`
+  - `ACTIVITY_TYPE_INIT_OTP_AUTH_V2` → `ACTIVITY_TYPE_INIT_OTP_AUTH_V3`
   - `ACTIVITY_TYPE_EMAIL_AUTH_V2` → `ACTIVITY_TYPE_EMAIL_AUTH_V3`
   - `ACTIVITY_TYPE_INIT_USER_EMAIL_RECOVERY` -> `ACTIVITY_TYPE_INIT_USER_EMAIL_RECOVERY_V2`
 

package/dist/__fixtures__/shared.d.ts

@@ -0,0 +1,6 @@
+export declare function readFixture(): Promise<{
+    privateKey: string;
+    publicKey: string;
+    pemPublicKey: string;
+}>;
+//# sourceMappingURL=shared.d.ts.map

package/dist/__fixtures__/shared.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shared.d.ts","sourceRoot":"","sources":["../../src/__fixtures__/shared.ts"],"names":[],"mappings":"AAKA,wBAAsB,WAAW,IAAI,OAAO,CAAC;IAC3C,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;CACtB,CAAC,CA2BD"}