@turnkey/sdk-browser 4.2.0 → 5.0.0

package/CHANGELOG.md

@@ -1,5 +1,48 @@
 # @turnkey/sdk-browser
 
+## 5.0.0
+
+### Major Changes
+
+- [#601](https://github.com/tkhq/sdk/pull/601) [`07dfd33`](https://github.com/tkhq/sdk/commit/07dfd3397472687092e1c73b1d68714f421b9ca0) Author [@moe-dev](https://github.com/moe-dev)
+
+This release introduces the new `indexedDbClient`, leveraging the `indexedDbStamper` to securely store cryptographic keys directly in IndexedDB. It provides persistent, secure, non-extractable authentication, replacing legacy iframe-based flows for OTP, passkey, external wallet, and OAuth authentications.
+
+### Key Changes:
+
+- **IndexedDB Client (`indexedDbClient`)**:
+
+  - Offers persistent, tamper-resistant authentication using P-256 keys stored securely in IndexedDB.
+  - Eliminates the need for credential injection via iframes, significantly improving the DevEx and UX of session management.
+  - Provides human-readable sessions through `getSession()`.
+
+- **Deprecation Notice**:
+  - Authentication via the `iframeClient` (e.g., `auth.turnkey.com`) is deprecated. Developers should migrate authentication flows to the new IndexedDB-based client.
+  - Existing iframe-based wallet flows (Email Recovery, Import, and Export) remain supported.
+
+These enhancements simplify integrations, improve UX, and deliver a more robust client-side experience.
+
+### Patch Changes
+
+- Updated dependencies [[`07dfd33`](https://github.com/tkhq/sdk/commit/07dfd3397472687092e1c73b1d68714f421b9ca0)]:
+  - @turnkey/indexed-db-stamper@1.0.0
+  - @turnkey/http@3.4.0
+  - @turnkey/crypto@2.3.1
+  - @turnkey/wallet-stamper@1.0.3
+
+## 4.3.0
+
+### Minor Changes
+
+- 25ca339: Adding replyToEmailAddress field for specifying reply-to when using a customer sender
+
+### Patch Changes
+
+- Updated dependencies [25ca339]
+  - @turnkey/http@3.3.0
+  - @turnkey/crypto@2.3.1
+  - @turnkey/wallet-stamper@1.0.3
+
 ## 4.2.0
 
 ### Minor Changes

package/README.md

@@ -104,3 +104,49 @@ const walletsResponse = await walletClient.getWallets();
 ## Helpers
 
 `@turnkey/sdk-browser` provides `TurnkeySDKBrowserClient`, which offers wrappers around commonly used Turnkey activities, such as creating new wallets and wallet accounts.
+
+### IndexedDB Sessions (Recommended)
+
+Turnkey now supports persistent, **secure, non-extractable authentication** using P-256 passkeys stored in **IndexedDB**. This replaces legacy iframe-based flows for otp, passkey, and OAuth authentication.
+
+The [`TurnkeyIndexedDbClient`](https://github.com/tkhq/sdk/blob/main/packages/sdk-browser/src/__clients__/browser-clients.ts) provides a long-lived session mechanism where the private key never leaves the browser and is scoped per sub-organization. This client handles login, session persistence, and API request signing entirely on the client side — without requiring iframes or sensitive credential injection.
+
+```ts
+import { Turnkey } from "@turnkey/sdk-browser";
+
+const turnkey = new Turnkey({
+  apiBaseUrl: "https://api.turnkey.com",
+  defaultOrganizationId: "<YOUR_PARENT_ORG_ID>",
+  rpId: "<YOUR_WEBAUTHN_RELYING_PARTY_ID>",
+});
+
+const client = turnkey.indexedDbClient();
+const passkeyClient = turnkey.passkeyClient();
+// Create authenticated session
+const pubKey = await indexedDbClient!.getPublicKey();
+await passkeyClient?.loginWithPasskey({
+  sessionType: SessionType.READ_WRITE,
+  publicKey: pubKey!,
+  expirationSeconds: "3600",
+});
+
+// Now the client is authenticated and ready to interact with Turnkey API
+const wallets = await client.getWallets();
+```
+
+> 💡 **Why IndexedDB?**  
+> Keys are stored using the [Web Crypto API](https://developer.mozilla.org/en-US/docs/Web/API/CryptoKey), marked as `nonExtractable`, and survive page reloads — offering persistent, tamper-resistant authentication without ever exposing the raw key material.
+
+---
+
+### ⚠️ Deprecated: iframeClient for Auth
+
+Authentication via `iframeClient()` and injected credentials (e.g., from `https://auth.turnkey.com`) is now considered **deprecated** for new integrations. These flows required sensitive credential bundles to be delivered via email or OAuth and injected into a sandboxed iframe — a pattern with limited persistence and higher complexity.
+
+Developers are encouraged to migrate to `indexedDbClient()` for:
+
+- Seamless passkey authentication
+- Improved security model (no credential injection)
+- Long-lived, resumable sessions
+
+Existing iframe use cases like **Email Recovery**, **Wallet Import**, and **Wallet Export** are still supported but should be isolated from authentication logic.

package/dist/__clients__/browser-clients.d.ts

@@ -2,7 +2,7 @@ import type { WalletInterface } from "@turnkey/wallet-stamper";
 import type { KeyFormat } from "@turnkey/iframe-stamper";
 import type * as SdkApiTypes from "../__generated__/sdk_api_types";
 import { TurnkeyBaseClient } from "../__clients__/base-client";
-import { Session, AuthClient, TurnkeySDKClientConfig, TurnkeyWalletClientConfig, ReadWriteSession, LoginWithBundleParams, LoginWithPasskeyParams, LoginWithWalletParams, RefreshSessionParams } from "@types";
+import { AuthClient, TurnkeySDKClientConfig, TurnkeyWalletClientConfig, LoginWithBundleParams, LoginWithPasskeyParams, LoginWithWalletParams, RefreshSessionParams } from "@types";
 import type { Passkey } from "@models";
 export interface OauthProvider {
     providerName: string;
@@ -59,16 +59,29 @@ interface AddUserAuthParams {
 }
 export declare class TurnkeyBrowserClient extends TurnkeyBaseClient {
     constructor(config: TurnkeySDKClientConfig, authClient?: AuthClient);
+    /**
+     * @deprecated
+     * This method is deprecated and only creates a READ_ONLY session using an API key.
+     * Use one of the following methods instead, depending on your context:
+     *
+     * - `loginWithPasskey()` for WebAuthn-based sessions using IndexedDB
+     * - `loginWithWallet()` for EVM or Solana wallet-based sessions
+     * - `loginWithSession()` if the session string is already available (e.g. from server actions)
+     * - `loginWithBundle()` for iframe-based sessions (e.g. for email-auth non otp based login)
+     *
+     * @param config Optional configuration containing an organization ID
+     * @returns A Promise resolving to the created read-only session
+     */
     login: (config?: {
         organizationId?: string;
     }) => Promise<SdkApiTypes.TCreateReadOnlySessionResponse>;
     /**
      * Attempts to refresh an existing Session. This method infers the current user's organization ID and target userId.
-     * This will use a passkeyStamper for `READ_ONLY` sessions or an `iframeStamper` for `READ_WRITE` sessions.
+     * This will use a passkeyStamper for `READ_ONLY` sessions or an `indexedDbStamper` for `READ_WRITE` sessions.
      *
      * @param RefreshSessionParams
      *   @param params.sessionType - The type of session that is being refreshed
-     *   @param params.targetPublicKey - The public key of the target client
+     *   @param params.publicKey - The public key of the indexedDb client
      *   @param params.expirationSeconds - Specify how long to extend the session. Defaults to 900 seconds or 15 minutes.
      * @returns {Promise<void>}
      */
@@ -84,21 +97,20 @@ export declare class TurnkeyBrowserClient extends TurnkeyBaseClient {
      */
     loginWithBundle: (params: LoginWithBundleParams) => Promise<void>;
     /**
-     * Log in with a session object. This method uses a session object from server actions and stores it and the active client in local storage
-     * To be used in conjunction with an `iframeStamper`.
+     * Log in with a session returns from Turnkey. This method uses a session from server actions and stores it and the active client in local storage
+     * To be used in conjunction with an `indexeDbStamper`.
      *
      * @param session
      * @returns {Promise<void>}
      */
-    loginWithSession: (session: Session) => Promise<void>;
+    loginWithSession: (session: string) => Promise<void>;
     /**
      * Log in with a passkey.
      * To be used in conjunction with a `passkeyStamper`
      *
      * @param LoginWithPasskeyParams
      *   @param params.sessionType - The type of session to create
-     *   @param params.iframeClient - The iframe client to use to inject the credential bundle
-     *   @param params.targetPublicKey - The public key of the target client
+     *   @param params.publicKey - The public key of indexedDb
      *   @param params.expirationSeconds - Expiration time for the session in seconds. Defaults to 900 seconds or 15 minutes.
      * @returns {Promise<void>}
      */
@@ -108,31 +120,11 @@ export declare class TurnkeyBrowserClient extends TurnkeyBaseClient {
      *
      * @param LoginWithWalletParams
      *   @param params.sessionType - The type of session to create
-     *   @param params.iframeClient - The iframe client to use to inject the credential bundle
-     *   @param params.targetPublicKey - The public key of the target iframe
+     *   @param params.publicKey - The public key of indexedDb
      *   @param params.expirationSeconds - The expiration time for the session in seconds
      * @returns {Promise<void>}
      */
     loginWithWallet: (params: LoginWithWalletParams) => Promise<void>;
-    /**
-     * Creates a read-write session. This method infers the current user's organization ID and target userId.
-     * To be used in conjunction with an `iframeStamper`: the resulting session's credential bundle can be
-     * injected into an iframeStamper to create a session that enables both read and write requests.
-     *
-     * @param targetEmbeddedKey
-     * @param expirationSeconds
-     * @param userId
-     * @returns {Promise<SdkApiTypes.TCreateReadWriteSessionResponse>}
-     */
-    loginWithReadWriteSession: (targetEmbeddedKey: string, expirationSeconds?: string, userId?: string) => Promise<SdkApiTypes.TCreateReadWriteSessionResponse>;
-    /**
-     * Logs in with an existing auth bundle. this bundle enables both read and write requests.
-     *
-     * @param credentialBundle
-     * @param expirationSeconds
-     * @returns {Promise<boolean>}
-     */
-    loginWithAuthBundle: (credentialBundle: string, expirationSeconds?: string) => Promise<boolean>;
     /**
      * Removes authentication factors from an end user.
      *
@@ -210,20 +202,6 @@ export declare class TurnkeyPasskeyClient extends TurnkeyBrowserClient {
      * @returns {Promise<Passkey>}
      */
     createUserPasskey: (config?: Record<any, any>) => Promise<Passkey>;
-    /**
-     * Uses passkey authentication to create a read-write session, via an embedded API key,
-     * and stores + returns the resulting auth bundle that contains the encrypted API key.
-     * This auth bundle (also referred to as a credential bundle) can be injected into an `iframeStamper`,
-     * resulting in a touch-free authenticator. Unlike `loginWithReadWriteSession`, this method
-     * assumes the end-user's organization ID (i.e. the sub-organization ID) is already known.
-     *
-     * @param userId
-     * @param targetEmbeddedKey
-     * @param expirationSeconds
-     * @param curveType
-     * @returns {Promise<ReadWriteSession>}
-     */
-    createPasskeySession: (userId: string, targetEmbeddedKey: string, expirationSeconds?: string, organizationId?: string) => Promise<ReadWriteSession>;
 }
 /**
  * TurnkeyIframeClient is a client that uses an iframe to interact with the Turnkey API.
@@ -250,5 +228,16 @@ export declare class TurnkeyWalletClient extends TurnkeyBrowserClient {
     getPublicKey(): Promise<string>;
     getWalletInterface(): WalletInterface;
 }
+/**
+ * TurnkeyIndexedDbClient is a client that uses IndexedDb to interact with the Turnkey API.
+ * @extends TurnkeyBrowserClient
+ */
+export declare class TurnkeyIndexedDbClient extends TurnkeyBrowserClient {
+    constructor(config: TurnkeySDKClientConfig);
+    clear: () => Promise<void>;
+    getPublicKey: () => Promise<string | null>;
+    init: () => Promise<void>;
+    resetKeyPair: () => Promise<void>;
+}
 export {};
 //# sourceMappingURL=browser-clients.d.ts.map

package/dist/__clients__/browser-clients.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"browser-clients.d.ts","sourceRoot":"","sources":["../../src/__clients__/browser-clients.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,KAAK,EAAiB,SAAS,EAAE,MAAM,yBAAyB,CAAC;AAIxE,OAAO,KAAK,KAAK,WAAW,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAE/D,OAAO,EACL,OAAO,EACP,UAAU,EACV,sBAAsB,EAEtB,yBAAyB,EACzB,gBAAgB,EAChB,qBAAqB,EACrB,sBAAsB,EACtB,qBAAqB,EACrB,oBAAoB,EACrB,MAAM,QAAQ,CAAC;AAQhB,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAWvC,MAAM,WAAW,aAAa;IAC5B,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,MAAM;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EACL,oBAAoB,GACpB,yBAAyB,GACzB,uBAAuB,CAAC;IAC5B,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,aAAa;IAC5B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE;QACX,YAAY,EAAE,MAAM,CAAC;QACrB,cAAc,EAAE,MAAM,CAAC;QACvB,iBAAiB,EAAE,MAAM,CAAC;QAC1B,UAAU,EAAE,CACR,6BAA6B,GAC7B,kCAAkC,GAClC,6BAA6B,GAC7B,6BAA6B,GAC7B,gCAAgC,CACnC,EAAE,CAAC;KACL,CAAC;CACH;AACD,UAAU,oBAAoB;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,cAAc,CAAC,EAAE;QACf,GAAG,CAAC,EAAE,aAAa,EAAE,CAAC;QACtB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;KACtB,CAAC;IACF,cAAc,CAAC,EAAE;QACf,GAAG,CAAC,EAAE,aAAa,EAAE,CAAC;QACtB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;KACtB,CAAC;IACF,OAAO,CAAC,EAAE;QACR,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;QACf,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;KACtB,CAAC;CACH;AAED,UAAU,oBAAoB;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;CACtB;AAED,UAAU,iBAAiB;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,aAAa,EAAE,CAAC;IACjC,cAAc,CAAC,EAAE,aAAa,EAAE,CAAC;IACjC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;CACpB;AACD,qBAAa,oBAAqB,SAAQ,iBAAiB;gBAC7C,MAAM,EAAE,sBAAsB,EAAE,UAAU,CAAC,EAAE,UAAU;IAInE,KAAK,YAAmB;QACtB,cAAc,CAAC,EAAE,MAAM,CAAC;KACzB,KAAG,QAAQ,YAAY,8BAA8B,CAAC,CAcrD;IAEF;;;;;;;;;OASG;IACH,cAAc,WAAkB,oBAAoB,KAAG,QAAQ,IAAI,CAAC,CAyDlE;IAEF;;;;;;;;OAQG;IACH,eAAe,WAAkB,qBAAqB,KAAG,QAAQ,IAAI,CAAC,CAwBpE;IAEF;;;;;;OAMG;IACH,gBAAgB,YAAmB,OAAO,KAAG,QAAQ,IAAI,CAAC,CAUxD;IAEF;;;;;;;;;;OAUG;IACH,gBAAgB,WAAkB,sBAAsB,KAAG,QAAQ,IAAI,CAAC,CAuDtE;IAEF;;;;;;;;;OASG;IACH,eAAe,WAAkB,qBAAqB,KAAG,QAAQ,IAAI,CAAC,CAuDpE;IAEF;;;;;;;;;OASG;IACH,yBAAyB,sBACJ,MAAM,sBACN,MAAM,WAChB,MAAM,KACd,QAAQ,YAAY,+BAA+B,CAAC,CAwBrD;IAEF;;;;;;OAMG;IACH,mBAAmB,qBACC,MAAM,sBACL,MAAM,KACxB,QAAQ,OAAO,CAAC,CAiBjB;IAEF;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,cAAc,WAAkB,oBAAoB,KAAG,QAAQ,GAAG,EAAE,CAAC,CAwCnE;IAEF;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,WAAW,WAAkB,iBAAiB,KAAG,QAAQ,GAAG,EAAE,CAAC,CA0C7D;IAEF;;;;;;;;;;;;;;;;;;;OAmBG;IACG,cAAc,CAAC,MAAM,EAAE,oBAAoB,GAAG,OAAO,CAAC,OAAO,CAAC;CAgGrE;AAED,qBAAa,oBAAqB,SAAQ,oBAAoB;IAC5D,IAAI,EAAE,MAAM,CAAC;gBAED,MAAM,EAAE,sBAAsB;IAK1C;;;;OAIG;IACH,iBAAiB,YACP,OAAO,GAAG,EAAE,GAAG,CAAC,KACvB,QAAQ,OAAO,CAAC,CA4DjB;IAEF;;;;;;;;;;;;OAYG;IACH,oBAAoB,WACV,MAAM,qBACK,MAAM,sBACN,MAAM,mBACR,MAAM,KACtB,QAAQ,gBAAgB,CAAC,CAuD1B;CACH;AAED;;;;;GAKG;AACH,qBAAa,mBAAoB,SAAQ,oBAAoB;IAC3D,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;gBAEnB,MAAM,EAAE,sBAAsB;IAK1C,sBAAsB,qBACF,MAAM,KACvB,QAAQ,OAAO,CAAC,CAIjB;IAEF,wBAAwB,qBACJ,MAAM,kBACR,MAAM,KACrB,QAAQ,OAAO,CAAC,CAKjB;IAEF,qBAAqB,qBACD,MAAM,kBACR,MAAM,cACV,SAAS,GAAG,SAAS,KAChC,QAAQ,OAAO,CAAC,CAMjB;IAEF,kBAAkB,WACR,MAAM,kBACE,MAAM,UACd,MAAM,KACb,QAAQ,OAAO,CAAC,CAMjB;IAEF,4BAA4B,QAAa,QAAQ,MAAM,CAAC,CAEtD;IAEF,yBAAyB,QAAa,QAAQ,MAAM,CAAC,CAEnD;IAEF,oBAAoB,QAAa,QAAQ,MAAM,GAAG,IAAI,CAAC,CAErD;IAEF,gBAAgB,QAAa,QAAQ,IAAI,CAAC,CAExC;IAEF,eAAe,QAAa,QAAQ,MAAM,GAAG,IAAI,CAAC,CAEhD;CACH;AAED,qBAAa,mBAAoB,SAAQ,oBAAoB;IAC3D,OAAO,CAAC,MAAM,CAAkB;gBAEpB,MAAM,EAAE,yBAAyB;IAKvC,YAAY,IAAI,OAAO,CAAC,MAAM,CAAC;IAIrC,kBAAkB,IAAI,eAAe;CAGtC"}
+{"version":3,"file":"browser-clients.d.ts","sourceRoot":"","sources":["../../src/__clients__/browser-clients.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,KAAK,EAAiB,SAAS,EAAE,MAAM,yBAAyB,CAAC;AAKxE,OAAO,KAAK,KAAK,WAAW,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAE/D,OAAO,EAEL,UAAU,EACV,sBAAsB,EAEtB,yBAAyB,EACzB,qBAAqB,EACrB,sBAAsB,EACtB,qBAAqB,EACrB,oBAAoB,EACrB,MAAM,QAAQ,CAAC;AAIhB,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAMvC,MAAM,WAAW,aAAa;IAC5B,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,MAAM;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EACL,oBAAoB,GACpB,yBAAyB,GACzB,uBAAuB,CAAC;IAC5B,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,aAAa;IAC5B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE;QACX,YAAY,EAAE,MAAM,CAAC;QACrB,cAAc,EAAE,MAAM,CAAC;QACvB,iBAAiB,EAAE,MAAM,CAAC;QAC1B,UAAU,EAAE,CACR,6BAA6B,GAC7B,kCAAkC,GAClC,6BAA6B,GAC7B,6BAA6B,GAC7B,gCAAgC,CACnC,EAAE,CAAC;KACL,CAAC;CACH;AACD,UAAU,oBAAoB;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,cAAc,CAAC,EAAE;QACf,GAAG,CAAC,EAAE,aAAa,EAAE,CAAC;QACtB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;KACtB,CAAC;IACF,cAAc,CAAC,EAAE;QACf,GAAG,CAAC,EAAE,aAAa,EAAE,CAAC;QACtB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;KACtB,CAAC;IACF,OAAO,CAAC,EAAE;QACR,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;QACf,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;KACtB,CAAC;CACH;AAED,UAAU,oBAAoB;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;CACtB;AAED,UAAU,iBAAiB;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,aAAa,EAAE,CAAC;IACjC,cAAc,CAAC,EAAE,aAAa,EAAE,CAAC;IACjC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;CACpB;AACD,qBAAa,oBAAqB,SAAQ,iBAAiB;gBAC7C,MAAM,EAAE,sBAAsB,EAAE,UAAU,CAAC,EAAE,UAAU;IAInE;;;;;;;;;;;;OAYG;IAEH,KAAK,YAAmB;QACtB,cAAc,CAAC,EAAE,MAAM,CAAC;KACzB,KAAG,QAAQ,YAAY,8BAA8B,CAAC,CAcrD;IAEF;;;;;;;;;OASG;IACH,cAAc,WAAkB,oBAAoB,KAAG,QAAQ,IAAI,CAAC,CA0ClE;IAEF;;;;;;;;OAQG;IACH,eAAe,WAAkB,qBAAqB,KAAG,QAAQ,IAAI,CAAC,CAwBpE;IAEF;;;;;;OAMG;IACH,gBAAgB,YAAmB,MAAM,KAAG,QAAQ,IAAI,CAAC,CASvD;IAEF;;;;;;;;;OASG;IACH,gBAAgB,WAAkB,sBAAsB,KAAG,QAAQ,IAAI,CAAC,CAuCtE;IAEF;;;;;;;;OAQG;IACH,eAAe,WAAkB,qBAAqB,KAAG,QAAQ,IAAI,CAAC,CAuCpE;IAEF;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,cAAc,WAAkB,oBAAoB,KAAG,QAAQ,GAAG,EAAE,CAAC,CAwCnE;IAEF;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,WAAW,WAAkB,iBAAiB,KAAG,QAAQ,GAAG,EAAE,CAAC,CA0C7D;IAEF;;;;;;;;;;;;;;;;;;;OAmBG;IACG,cAAc,CAAC,MAAM,EAAE,oBAAoB,GAAG,OAAO,CAAC,OAAO,CAAC;CAgGrE;AAED,qBAAa,oBAAqB,SAAQ,oBAAoB;IAC5D,IAAI,EAAE,MAAM,CAAC;gBAED,MAAM,EAAE,sBAAsB;IAK1C;;;;OAIG;IACH,iBAAiB,YACP,OAAO,GAAG,EAAE,GAAG,CAAC,KACvB,QAAQ,OAAO,CAAC,CA4DjB;CACH;AAED;;;;;GAKG;AACH,qBAAa,mBAAoB,SAAQ,oBAAoB;IAC3D,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;gBAEnB,MAAM,EAAE,sBAAsB;IAK1C,sBAAsB,qBACF,MAAM,KACvB,QAAQ,OAAO,CAAC,CAIjB;IAEF,wBAAwB,qBACJ,MAAM,kBACR,MAAM,KACrB,QAAQ,OAAO,CAAC,CAKjB;IAEF,qBAAqB,qBACD,MAAM,kBACR,MAAM,cACV,SAAS,GAAG,SAAS,KAChC,QAAQ,OAAO,CAAC,CAMjB;IAEF,kBAAkB,WACR,MAAM,kBACE,MAAM,UACd,MAAM,KACb,QAAQ,OAAO,CAAC,CAMjB;IAEF,4BAA4B,QAAa,QAAQ,MAAM,CAAC,CAEtD;IAEF,yBAAyB,QAAa,QAAQ,MAAM,CAAC,CAEnD;IAEF,oBAAoB,QAAa,QAAQ,MAAM,GAAG,IAAI,CAAC,CAErD;IAEF,gBAAgB,QAAa,QAAQ,IAAI,CAAC,CAExC;IAEF,eAAe,QAAa,QAAQ,MAAM,GAAG,IAAI,CAAC,CAEhD;CACH;AAED,qBAAa,mBAAoB,SAAQ,oBAAoB;IAC3D,OAAO,CAAC,MAAM,CAAkB;gBAEpB,MAAM,EAAE,yBAAyB;IAKvC,YAAY,IAAI,OAAO,CAAC,MAAM,CAAC;IAIrC,kBAAkB,IAAI,eAAe;CAGtC;AAED;;;GAGG;AACH,qBAAa,sBAAuB,SAAQ,oBAAoB;gBAClD,MAAM,EAAE,sBAAsB;IAI1C,KAAK,QAAa,QAAQ,IAAI,CAAC,CAE7B;IAEF,YAAY,QAAa,QAAQ,MAAM,GAAG,IAAI,CAAC,CAE7C;IAEF,IAAI,QAAa,QAAQ,IAAI,CAAC,CAE5B;IAEF,YAAY,QAAa,QAAQ,IAAI,CAAC,CAEpC;CACH"}

package/dist/__clients__/browser-clients.js

@@ -10,6 +10,19 @@ var constants = require('../constants.js');
 class TurnkeyBrowserClient extends baseClient.TurnkeyBaseClient {
     constructor(config, authClient) {
         super(config, authClient);
+        /**
+         * @deprecated
+         * This method is deprecated and only creates a READ_ONLY session using an API key.
+         * Use one of the following methods instead, depending on your context:
+         *
+         * - `loginWithPasskey()` for WebAuthn-based sessions using IndexedDB
+         * - `loginWithWallet()` for EVM or Solana wallet-based sessions
+         * - `loginWithSession()` if the session string is already available (e.g. from server actions)
+         * - `loginWithBundle()` for iframe-based sessions (e.g. for email-auth non otp based login)
+         *
+         * @param config Optional configuration containing an organization ID
+         * @returns A Promise resolving to the created read-only session
+         */
         this.login = async (config) => {
             const readOnlySessionResult = await this.createReadOnlySession(config || {});
             const session = {
@@ -24,16 +37,16 @@ class TurnkeyBrowserClient extends baseClient.TurnkeyBaseClient {
         };
         /**
          * Attempts to refresh an existing Session. This method infers the current user's organization ID and target userId.
-         * This will use a passkeyStamper for `READ_ONLY` sessions or an `iframeStamper` for `READ_WRITE` sessions.
+         * This will use a passkeyStamper for `READ_ONLY` sessions or an `indexedDbStamper` for `READ_WRITE` sessions.
          *
          * @param RefreshSessionParams
          *   @param params.sessionType - The type of session that is being refreshed
-         *   @param params.targetPublicKey - The public key of the target client
+         *   @param params.publicKey - The public key of the indexedDb client
          *   @param params.expirationSeconds - Specify how long to extend the session. Defaults to 900 seconds or 15 minutes.
          * @returns {Promise<void>}
          */
         this.refreshSession = async (params) => {
-            const { sessionType = base.SessionType.READ_WRITE, targetPublicKey, expirationSeconds = constants.DEFAULT_SESSION_EXPIRATION_IN_SECONDS, } = params;
+            const { sessionType = base.SessionType.READ_WRITE, publicKey, expirationSeconds = constants.DEFAULT_SESSION_EXPIRATION_IN_SECONDS, } = params;
             try {
                 if (sessionType === base.SessionType.READ_ONLY) {
                     if (this instanceof TurnkeyPasskeyClient) {
@@ -50,29 +63,14 @@ class TurnkeyBrowserClient extends baseClient.TurnkeyBaseClient {
                     await storage.storeSession(session, base.AuthClient.Passkey);
                 }
                 else if (sessionType === base.SessionType.READ_WRITE) {
-                    if (!targetPublicKey) {
-                        throw new Error("You must provide a targetPublicKey to refresh a read-write session.");
+                    if (!publicKey) {
+                        throw new Error("You must provide a publicKey to refresh a read-write session.");
                     }
-                    const readWriteSessionResult = await this.createReadWriteSession({
-                        targetPublicKey,
+                    const sessionResponse = await this.stampLogin({
+                        publicKey: publicKey,
                         expirationSeconds,
-                        invalidateExisting: true,
                     });
-                    const session = {
-                        sessionType: base.SessionType.READ_WRITE,
-                        userId: readWriteSessionResult.userId,
-                        organizationId: readWriteSessionResult.organizationId,
-                        expiry: Date.now() + Number(expirationSeconds) * 1000,
-                        token: readWriteSessionResult.credentialBundle,
-                    };
-                    if (this instanceof TurnkeyIframeClient) {
-                        await this.injectCredentialBundle(session.token);
-                    }
-                    else {
-                        // Throw an error if the client is not an iframe client
-                        throw new Error("You must use an iframe client to refresh a read-write session");
-                    }
-                    await storage.storeSession(session, base.AuthClient.Iframe);
+                    await storage.storeSession(sessionResponse.session, base.AuthClient.IndexedDb);
                 }
                 else {
                     throw new Error(`Invalid session type passed: ${sessionType}`);
@@ -111,21 +109,20 @@ class TurnkeyBrowserClient extends baseClient.TurnkeyBaseClient {
             await storage.storeSession(session, base.AuthClient.Iframe);
         };
         /**
-         * Log in with a session object. This method uses a session object from server actions and stores it and the active client in local storage
-         * To be used in conjunction with an `iframeStamper`.
+         * Log in with a session returns from Turnkey. This method uses a session from server actions and stores it and the active client in local storage
+         * To be used in conjunction with an `indexeDbStamper`.
          *
          * @param session
          * @returns {Promise<void>}
          */
         this.loginWithSession = async (session) => {
-            if (this instanceof TurnkeyIframeClient) {
-                await this.injectCredentialBundle(session.token);
+            if (this instanceof TurnkeyIndexedDbClient) {
+                await storage.storeSession(session, base.AuthClient.IndexedDb);
             }
             else {
-                // Throw an error if the client is not an iframe client
-                throw new Error("You must use an iframe client to log in with a session."); //should we default to a "localStorage" client?
+                // Throw an error if the client is not an indexedDb client
+                throw new Error("You must use an indexedDb client to log in with a session.");
             }
-            await storage.storeSession(session, base.AuthClient.Iframe);
         };
         /**
          * Log in with a passkey.
@@ -133,14 +130,13 @@ class TurnkeyBrowserClient extends baseClient.TurnkeyBaseClient {
          *
          * @param LoginWithPasskeyParams
          *   @param params.sessionType - The type of session to create
-         *   @param params.iframeClient - The iframe client to use to inject the credential bundle
-         *   @param params.targetPublicKey - The public key of the target client
+         *   @param params.publicKey - The public key of indexedDb
          *   @param params.expirationSeconds - Expiration time for the session in seconds. Defaults to 900 seconds or 15 minutes.
          * @returns {Promise<void>}
          */
         this.loginWithPasskey = async (params) => {
             try {
-                const { sessionType = base.SessionType.READ_WRITE, iframeClient, targetPublicKey, expirationSeconds = constants.DEFAULT_SESSION_EXPIRATION_IN_SECONDS, } = params;
+                const { sessionType = base.SessionType.READ_WRITE, publicKey, expirationSeconds = constants.DEFAULT_SESSION_EXPIRATION_IN_SECONDS, } = params;
                 // Create a read-only session
                 if (sessionType === base.SessionType.READ_ONLY) {
                     const readOnlySessionResult = await this.createReadOnlySession({});
@@ -149,31 +145,20 @@ class TurnkeyBrowserClient extends baseClient.TurnkeyBaseClient {
                         userId: readOnlySessionResult.userId,
                         organizationId: readOnlySessionResult.organizationId,
                         expiry: Number(readOnlySessionResult.sessionExpiry),
-                        token: readOnlySessionResult.session,
+                        token: readOnlySessionResult.session, // Once we have api key session scopes this can change
                     };
                     await storage.storeSession(session, base.AuthClient.Passkey);
                     // Create a read-write session
                 }
                 else if (sessionType === base.SessionType.READ_WRITE) {
-                    if (!targetPublicKey) {
-                        throw new Error("You must provide a targetPublicKey to create a read-write session.");
+                    if (!publicKey) {
+                        throw new Error("You must provide a publicKey to create a passkey read write session.");
                     }
-                    const readWriteSessionResult = await this.createReadWriteSession({
-                        targetPublicKey,
+                    const sessionResponse = await this.stampLogin({
+                        publicKey,
                         expirationSeconds,
                     });
-                    const session = {
-                        sessionType: base.SessionType.READ_WRITE,
-                        userId: readWriteSessionResult.userId,
-                        organizationId: readWriteSessionResult.organizationId,
-                        expiry: Date.now() + Number(expirationSeconds) * 1000,
-                        token: readWriteSessionResult.credentialBundle,
-                    };
-                    if (!iframeClient) {
-                        throw new Error("You must provide an iframe client to log in with a passkey.");
-                    }
-                    await iframeClient.injectCredentialBundle(session.token);
-                    await storage.storeSession(session, base.AuthClient.Iframe);
+                    await storage.storeSession(sessionResponse.session, base.AuthClient.IndexedDb);
                 }
                 else {
                     throw new Error(`Invalid session type passed: ${sessionType}`);
@@ -188,15 +173,13 @@ class TurnkeyBrowserClient extends baseClient.TurnkeyBaseClient {
          *
          * @param LoginWithWalletParams
          *   @param params.sessionType - The type of session to create
-         *   @param params.iframeClient - The iframe client to use to inject the credential bundle
-         *   @param params.targetPublicKey - The public key of the target iframe
+         *   @param params.publicKey - The public key of indexedDb
          *   @param params.expirationSeconds - The expiration time for the session in seconds
          * @returns {Promise<void>}
          */
         this.loginWithWallet = async (params) => {
             try {
-                const { sessionType = base.SessionType.READ_WRITE, iframeClient, targetPublicKey, expirationSeconds = constants.DEFAULT_SESSION_EXPIRATION_IN_SECONDS, } = params;
-                // Create a read-only session
+                const { sessionType = base.SessionType.READ_WRITE, publicKey, expirationSeconds = constants.DEFAULT_SESSION_EXPIRATION_IN_SECONDS, } = params;
                 if (sessionType === base.SessionType.READ_ONLY) {
                     const readOnlySessionResult = await this.createReadOnlySession({});
                     const session = {
@@ -207,28 +190,16 @@ class TurnkeyBrowserClient extends baseClient.TurnkeyBaseClient {
                         token: readOnlySessionResult.session,
                     };
                     await storage.storeSession(session, base.AuthClient.Wallet);
-                    // Create a read-write session
                 }
                 else if (sessionType === base.SessionType.READ_WRITE) {
-                    if (!targetPublicKey) {
-                        throw new Error("You must provide a targetPublicKey to create a read-write session.");
+                    if (!publicKey) {
+                        throw new Error("You must provide a publicKey to create a read-write session.");
                     }
-                    const readWriteSessionResult = await this.createReadWriteSession({
-                        targetPublicKey,
+                    const sessionResponse = await this.stampLogin({
+                        publicKey: publicKey,
                         expirationSeconds,
                     });
-                    const session = {
-                        sessionType: base.SessionType.READ_WRITE,
-                        userId: readWriteSessionResult.userId,
-                        organizationId: readWriteSessionResult.organizationId,
-                        expiry: Date.now() + Number(expirationSeconds) * 1000,
-                        token: readWriteSessionResult.credentialBundle,
-                    };
-                    if (!iframeClient) {
-                        throw new Error("You must provide an iframe client to log in with a wallet.");
-                    }
-                    await iframeClient.injectCredentialBundle(session.token);
-                    await storage.storeSession(session, base.AuthClient.Iframe);
+                    await storage.storeSession(sessionResponse.session, base.AuthClient.IndexedDb);
                 }
                 else {
                     throw new Error(`Invalid session type passed: ${sessionType}`);
@@ -238,59 +209,6 @@ class TurnkeyBrowserClient extends baseClient.TurnkeyBaseClient {
                 throw new Error(`Unable to log in with the provided wallet: ${error}`);
             }
         };
-        /**
-         * Creates a read-write session. This method infers the current user's organization ID and target userId.
-         * To be used in conjunction with an `iframeStamper`: the resulting session's credential bundle can be
-         * injected into an iframeStamper to create a session that enables both read and write requests.
-         *
-         * @param targetEmbeddedKey
-         * @param expirationSeconds
-         * @param userId
-         * @returns {Promise<SdkApiTypes.TCreateReadWriteSessionResponse>}
-         */
-        this.loginWithReadWriteSession = async (targetEmbeddedKey, expirationSeconds = constants.DEFAULT_SESSION_EXPIRATION_IN_SECONDS, userId) => {
-            try {
-                const readWriteSessionResult = await this.createReadWriteSession({
-                    targetPublicKey: targetEmbeddedKey,
-                    expirationSeconds,
-                    userId: userId,
-                });
-                // Ensure session and sessionExpiry are included in the object
-                const readWriteSessionResultWithSession = {
-                    ...readWriteSessionResult,
-                    credentialBundle: readWriteSessionResult.credentialBundle,
-                    sessionExpiry: Date.now() + Number(expirationSeconds) * 1000,
-                };
-                // store auth bundle in local storage
-                await storage.saveSession(readWriteSessionResultWithSession, this.authClient);
-                return readWriteSessionResultWithSession;
-            }
-            catch (error) {
-                throw new Error(`Unable to log in with the provided read-write session: ${error}`);
-            }
-        };
-        /**
-         * Logs in with an existing auth bundle. this bundle enables both read and write requests.
-         *
-         * @param credentialBundle
-         * @param expirationSeconds
-         * @returns {Promise<boolean>}
-         */
-        this.loginWithAuthBundle = async (credentialBundle, expirationSeconds = constants.DEFAULT_SESSION_EXPIRATION_IN_SECONDS) => {
-            try {
-                const whoAmIResult = await this.getWhoami();
-                const readWriteSessionResultWithSession = {
-                    ...whoAmIResult,
-                    credentialBundle: credentialBundle,
-                    sessionExpiry: Date.now() + Number(expirationSeconds) * 1000,
-                };
-                await storage.saveSession(readWriteSessionResultWithSession, this.authClient);
-                return true;
-            }
-            catch (error) {
-                throw new Error(`Unable to log in with the provided auth bundle: ${error}`);
-            }
-        };
         /**
          * Removes authentication factors from an end user.
          *
@@ -530,7 +448,7 @@ class TurnkeyPasskeyClient extends TurnkeyBrowserClient {
                     },
                     authenticatorSelection: {
                         authenticatorAttachment: config.publicKey?.authenticatorSelection?.authenticatorAttachment ??
-                            undefined,
+                            undefined, // default to empty
                         requireResidentKey: config.publicKey?.authenticatorSelection?.requireResidentKey ??
                             true,
                         residentKey: config.publicKey?.authenticatorSelection?.residentKey ?? "required",
@@ -547,63 +465,6 @@ class TurnkeyPasskeyClient extends TurnkeyBrowserClient {
                 attestation,
             };
         };
-        /**
-         * Uses passkey authentication to create a read-write session, via an embedded API key,
-         * and stores + returns the resulting auth bundle that contains the encrypted API key.
-         * This auth bundle (also referred to as a credential bundle) can be injected into an `iframeStamper`,
-         * resulting in a touch-free authenticator. Unlike `loginWithReadWriteSession`, this method
-         * assumes the end-user's organization ID (i.e. the sub-organization ID) is already known.
-         *
-         * @param userId
-         * @param targetEmbeddedKey
-         * @param expirationSeconds
-         * @param curveType
-         * @returns {Promise<ReadWriteSession>}
-         */
-        this.createPasskeySession = async (userId, targetEmbeddedKey, expirationSeconds = constants.DEFAULT_SESSION_EXPIRATION_IN_SECONDS, organizationId) => {
-            try {
-                const session = await storage.getStorageValue(storage.StorageKeys.Session);
-                organizationId = organizationId ?? session?.organizationId;
-                userId = userId ?? session?.userId;
-                if (!organizationId) {
-                    throw new Error("Error creating passkey session: Organization ID is required");
-                }
-                if (!userId) {
-                    throw new Error("Error creating passkey session: User ID is required");
-                }
-                const { authBundle: credentialBundle, publicKey } = await utils.createEmbeddedAPIKey(targetEmbeddedKey);
-                // add API key to Turnkey User
-                await this.createApiKeys({
-                    organizationId,
-                    userId,
-                    apiKeys: [
-                        {
-                            apiKeyName: `Session Key ${String(Date.now())}`,
-                            publicKey,
-                            expirationSeconds,
-                            curveType: "API_KEY_CURVE_P256",
-                        },
-                    ],
-                });
-                const whoAmI = await this.getWhoami();
-                const expiry = Date.now() + Number(expirationSeconds) * 1000;
-                await storage.saveSession({
-                    organizationId,
-                    organizationName: whoAmI?.organizationName ?? "",
-                    userId,
-                    username: whoAmI?.username ?? "",
-                    credentialBundle,
-                    sessionExpiry: expiry,
-                }, this.authClient);
-                return {
-                    credentialBundle,
-                    expiry,
-                };
-            }
-            catch (error) {
-                throw new Error("Unable to create passkey session.");
-            }
-        };
         this.rpId = this.stamper.rpId;
     }
 }
@@ -658,9 +519,31 @@ class TurnkeyWalletClient extends TurnkeyBrowserClient {
         return this.wallet;
     }
 }
+/**
+ * TurnkeyIndexedDbClient is a client that uses IndexedDb to interact with the Turnkey API.
+ * @extends TurnkeyBrowserClient
+ */
+class TurnkeyIndexedDbClient extends TurnkeyBrowserClient {
+    constructor(config) {
+        super(config, base.AuthClient.IndexedDb);
+        this.clear = async () => {
+            return await this.stamper.clear();
+        };
+        this.getPublicKey = async () => {
+            return await this.stamper.getPublicKey();
+        };
+        this.init = async () => {
+            return await this.stamper.init();
+        };
+        this.resetKeyPair = async () => {
+            return await this.stamper.resetKeyPair();
+        };
+    }
+}
 
 exports.TurnkeyBrowserClient = TurnkeyBrowserClient;
 exports.TurnkeyIframeClient = TurnkeyIframeClient;
+exports.TurnkeyIndexedDbClient = TurnkeyIndexedDbClient;
 exports.TurnkeyPasskeyClient = TurnkeyPasskeyClient;
 exports.TurnkeyWalletClient = TurnkeyWalletClient;
 //# sourceMappingURL=browser-clients.js.map