@zerodev/wallet-core 0.0.1-alpha.22 → 0.0.1-alpha.23

package/package.json

@@ -1,7 +1,10 @@
 {
   "name": "@zerodev/wallet-core",
-  "version": "0.0.1-alpha.22",
+  "version": "0.0.1-alpha.23",
   "description": "ZeroDev Wallet SDK built on Turnkey",
+  "publishConfig": {
+    "tag": "alpha"
+  },
   "sideEffects": false,
   "main": "./dist/_cjs/index.js",
   "module": "./dist/_esm/index.js",

package/src/actions/auth/loginWithStamp.ts

@@ -70,8 +70,11 @@ export async function loginWithStamp(
   return client.request({
     path: `${projectId}/auth/login/stamp`,
     method: 'POST',
+    // The sub-org id is intentionally not sent: the backend derives it from
+    // the stamped credential. `organizationId` (the parent org) is only
+    // signed into `stampPayload` above so the stamp matches the body the
+    // backend relays to Turnkey — it is not part of the wire request.
     body: {
-      subOrganizationId: organizationId,
       targetPublicKey,
       timestamp: timestampIso,
       stamp,

package/src/core/createZeroDevWalletCore.ts

@@ -190,7 +190,11 @@ export async function createZeroDevWalletCore(
         const data = await client.loginWithStamp({
           targetPublicKey: compressedPublicKeyHex,
           projectId,
-          organizationId: activeSession.organizationId,
+          // Stamp-login is signed against the Turnkey parent org; the backend
+          // resolves the sub-org from the stamped credential. Signing the
+          // sub-org here makes the relayed payload's org mismatch the
+          // signature → Turnkey SIGNATURE_INVALID.
+          organizationId,
           stampWith: 'apiKey',
         })
         await client.apiKeyStamper.commitKeyRotation()
@@ -270,7 +274,9 @@ export async function createZeroDevWalletCore(
             const loginData = await client.loginWithStamp({
               projectId,
               targetPublicKey: compressedPublicKeyHex,
-              organizationId: data.subOrganizationId,
+              // Sign against the parent org (see refreshSession note) — the
+              // backend derives the sub-org from the stamped credential.
+              organizationId,
             })
             await client.apiKeyStamper.commitKeyRotation()
             const parsedSession = parseSession(loginData.session)
@@ -302,6 +308,9 @@ export async function createZeroDevWalletCore(
             const loginData = await client.loginWithStamp({
               targetPublicKey: generatedPublicKey,
               projectId,
+              // Sign against the parent org, not the user's sub-org (see the
+              // refreshSession note). The backend derives the sub-org from the
+              // stamped passkey credential.
               organizationId,
               stampWith: 'passkey',
             })