@zerodev/wallet-core 0.0.1-alpha.22 → 0.0.1-alpha.24

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zerodev/wallet-core",
-  "version": "0.0.1-alpha.22",
+  "version": "0.0.1-alpha.24",
   "description": "ZeroDev Wallet SDK built on Turnkey",
   "sideEffects": false,
   "main": "./dist/_cjs/index.js",

package/src/actions/auth/authenticateWithEmail.ts

@@ -1,10 +1,5 @@
 import type { Client } from '../../client/types.js'
 
-export type EmailCustomization = {
-  /** A template for the URL to be used in a magic link button, e.g. `https://dapp.xyz/%s`. The auth bundle will be interpolated into the `%s`. */
-  magicLinkTemplate?: string
-}
-
 export type AuthenticateWithEmailParameters = {
   /** The email address to authenticate */
   email: string
@@ -12,8 +7,6 @@ export type AuthenticateWithEmailParameters = {
   projectId: string
   /** Target public key for authentication */
   targetPublicKey: string
-  /** Optional email customization settings */
-  emailCustomization?: EmailCustomization
 }
 
 export type AuthenticateWithEmailReturnType = {
@@ -37,14 +30,13 @@ export async function authenticateWithEmail(
   client: Client,
   params: AuthenticateWithEmailParameters,
 ): Promise<AuthenticateWithEmailReturnType> {
-  const { email, projectId, targetPublicKey, emailCustomization } = params
+  const { email, projectId, targetPublicKey } = params
 
   return await client.request({
     path: `${projectId}/auth/email-magic`,
     method: 'POST',
     body: {
       email,
-      emailCustomization,
       targetPublicKey,
       projectId,
     },

package/src/actions/auth/getAuthenticators.ts

@@ -72,18 +72,18 @@ export async function getAuthenticators(
   client: Client,
   params: GetAuthenticatorsParameters,
 ): Promise<GetAuthenticatorsReturnType> {
-  const { subOrganizationId, projectId, token } = params
+  const { projectId, token } = params
 
+  // GET behind StampCheckUser: the backend resolves the user from the stamped
+  // credential (+ session JWT), so no body / sub-org is sent. The stamp signs
+  // the X-Timestamp value (see transport `stampPostion: 'timestamp'`).
   return await client.request({
     path: `${projectId}/authenticators`,
-    method: 'POST',
-    body: {
-      subOrganizationId,
-    },
+    method: 'GET',
     headers: {
       Authorization: `Bearer ${token}`,
     },
     stamp: true,
-    stampPostion: 'headers',
+    stampPostion: 'timestamp',
   })
 }

package/src/actions/auth/index.ts

@@ -2,7 +2,6 @@ export {
   type AuthenticateWithEmailParameters,
   type AuthenticateWithEmailReturnType,
   authenticateWithEmail,
-  type EmailCustomization,
 } from './authenticateWithEmail.js'
 
 export {
@@ -44,7 +43,6 @@ export {
   loginWithStamp,
 } from './loginWithStamp.js'
 export {
-  type OtpCodeCustomization,
   type OtpContact,
   type RegisterWithOTPParameters,
   type RegisterWithOTPReturnType,

package/src/actions/auth/loginWithStamp.ts

@@ -3,11 +3,6 @@ import type { Client } from '../../client/types.js'
 import type { Stamp } from '../../stampers/types.js'
 import type { StamperType } from '../../types/session.js'
 
-export type EmailCustomization = {
-  /** A template for the URL to be used in a magic link button, e.g. `https://dapp.xyz/%s`. The auth bundle will be interpolated into the `%s`. */
-  magicLinkTemplate?: string
-}
-
 export type LoginWithStampParameters = {
   /** The project ID for the request */
   projectId: string
@@ -70,8 +65,11 @@ export async function loginWithStamp(
   return client.request({
     path: `${projectId}/auth/login/stamp`,
     method: 'POST',
+    // The sub-org id is intentionally not sent: the backend derives it from
+    // the stamped credential. `organizationId` (the parent org) is only
+    // signed into `stampPayload` above so the stamp matches the body the
+    // backend relays to Turnkey — it is not part of the wire request.
     body: {
-      subOrganizationId: organizationId,
       targetPublicKey,
       timestamp: timestampIso,
       stamp,

package/src/actions/auth/registerWithOTP.ts

@@ -1,5 +1,4 @@
 import type { Client } from '../../client/types.js'
-import type { EmailCustomization } from './authenticateWithEmail.js'
 
 export type OtpContact = {
   /** The OTP delivery type (currently only 'email' is supported) */
@@ -8,13 +7,6 @@ export type OtpContact = {
   contact: string
 }
 
-export type OtpCodeCustomization = {
-  /** The length of the OTP code (must be between 6 and 9 inclusive) */
-  length: 6 | 7 | 8 | 9
-  /** Whether the OTP code should be alphanumeric */
-  alphanumeric: boolean
-}
-
 export type RegisterWithOTPParameters = {
   /** The email address to register */
   email: string
@@ -22,10 +14,6 @@ export type RegisterWithOTPParameters = {
   contact: OtpContact
   /** The project ID for the request */
   projectId: string
-  /** Optional email customization settings */
-  emailCustomization?: EmailCustomization
-  /** Optional OTP code customization settings */
-  otpCodeCustomization?: OtpCodeCustomization
 }
 
 export type RegisterWithOTPReturnType = {
@@ -43,6 +31,10 @@ export type RegisterWithOTPReturnType = {
  * Initiates OTP (One-Time Password) authentication
  * This will send an OTP code to the specified contact method
  *
+ * OTP code length/format and, when enabled, the magic-link URL template are
+ * configured per-project on the backend (`wallet.otp_configs`). The client no
+ * longer sends customization fields — they are ignored server-side.
+ *
  * @param client - The ZeroDev Wallet client
  * @param params - The parameters for OTP initiation
  * @returns The result including otpId needed for verification
@@ -65,20 +57,7 @@ export async function registerWithOTP(
   client: Client,
   params: RegisterWithOTPParameters,
 ): Promise<RegisterWithOTPReturnType> {
-  const {
-    email,
-    contact,
-    projectId,
-    emailCustomization,
-    otpCodeCustomization,
-  } = params
-
-  if (
-    otpCodeCustomization &&
-    (otpCodeCustomization.length < 6 || otpCodeCustomization.length > 9)
-  ) {
-    throw new Error('OTP code length must be between 6 and 9')
-  }
+  const { email, contact, projectId } = params
 
   return await client.request({
     path: `${projectId}/auth/init/otp`,
@@ -86,8 +65,6 @@ export async function registerWithOTP(
     body: {
       email,
       contact,
-      emailCustomization,
-      otpCodeCustomization,
     },
   })
 }

package/src/actions/auth/registerWithPasskey.ts

@@ -1,10 +1,5 @@
 import type { Client } from '../../client/types.js'
 
-export type EmailCustomization = {
-  /** A template for the URL to be used in a magic link button, e.g. `https://dapp.xyz/%s`. The auth bundle will be interpolated into the `%s`. */
-  magicLinkTemplate?: string
-}
-
 export type RegisterWithPasskeyParameters = {
   /** The project ID for the request */
   projectId: string

package/src/actions/index.ts

@@ -8,7 +8,6 @@ export {
   authenticateWithEmail,
   authenticateWithOAuth,
   type EmailContact,
-  type EmailCustomization,
   type GetAuthenticatorsParameters,
   type GetAuthenticatorsReturnType,
   type GetAuthProxyConfigIdReturnType,

package/src/actions/wallet/getUserWallet.ts

@@ -37,17 +37,17 @@ export async function getUserWallet(
   client: Client,
   params: GetUserWalletParameters,
 ): Promise<GetUserWalletReturnType> {
-  const { organizationId, projectId, token } = params
+  const { projectId, token } = params
 
+  // GET behind StampCheckUser: user is resolved from the stamped credential
+  // (+ session JWT); no body sent. The stamp signs the X-Timestamp value.
   return await client.request({
     path: `${projectId}/user-wallet`,
-    body: {
-      organizationId,
-    },
+    method: 'GET',
     headers: {
       Authorization: `Bearer ${token}`,
     },
     stamp: true,
-    stampPostion: 'headers',
+    stampPostion: 'timestamp',
   })
 }

package/src/client/transports/rest.ts

@@ -10,7 +10,14 @@ export type RestRequestArgs = {
   headers?: Record<string, string>
   stamp?: boolean
   stampWith?: StamperType
-  stampPostion?: 'body' | 'headers'
+  /**
+   * Where the stamp goes / what it signs:
+   * - `body`/`headers`: sign the canonicalized request body (POST endpoints).
+   * - `timestamp`: GET endpoints behind StampCheckUser — sign the current
+   *   unix-millis string, send it as the `X-Timestamp` header plus the stamp
+   *   header. No request body. Matches the backend's `FormatTimestamp`.
+   */
+  stampPostion?: 'body' | 'headers' | 'timestamp'
   /** Include credentials (cookies) in the request */
   credentials?: RequestCredentials
 }
@@ -49,8 +56,8 @@ export function rest(url: string, cfg: RestTransportConfig): RestTransport {
 
     try {
       let requestBody = args.body
-      let requestHeaders = {
-        ...(cfg.fetchOptions?.headers ?? {}),
+      let requestHeaders: Record<string, string> = {
+        ...((cfg.fetchOptions?.headers as Record<string, string>) ?? {}),
         ...(args.headers ?? {}),
         'content-type': 'application/json',
       }
@@ -65,32 +72,47 @@ export function rest(url: string, cfg: RestTransportConfig): RestTransport {
         } else {
           stamper = cfg.apiKeyStamper
         }
-        const { body, apiUrl } = args.body
-        const bodyString = canonicalizeEx(body ?? args.body)
-        const stamp = await stamper.stamp(bodyString)
 
-        // Restructure request body to match backend expectation
-        if (args.stampPostion === 'headers') {
+        // Timestamped stamp for GET endpoints behind StampCheckUser: the
+        // signed body is the unix-millis string itself (the backend rebuilds
+        // it from the X-Timestamp header via FormatTimestamp). No request body.
+        if (args.stampPostion === 'timestamp') {
+          const ts = Date.now().toString()
+          const stamp = await stamper.stamp(ts)
           requestHeaders = {
             ...requestHeaders,
+            'X-Timestamp': ts,
             [stamp.stampHeaderName]: stamp.stampHeaderValue,
           }
-        } else if (body) {
-          requestBody = {
-            body: bodyString,
-            stamp: {
-              stampHeaderName: stamp.stampHeaderName,
-              stampHeaderValue: stamp.stampHeaderValue,
-            },
-            apiUrl: apiUrl,
-          }
+          requestBody = undefined
         } else {
-          requestBody = {
-            ...args.body,
-            stamp: {
-              stampHeaderName: stamp.stampHeaderName,
-              stampHeaderValue: stamp.stampHeaderValue,
-            },
+          const { body, apiUrl } = args.body
+          const bodyString = canonicalizeEx(body ?? args.body)
+          const stamp = await stamper.stamp(bodyString)
+
+          // Restructure request body to match backend expectation
+          if (args.stampPostion === 'headers') {
+            requestHeaders = {
+              ...requestHeaders,
+              [stamp.stampHeaderName]: stamp.stampHeaderValue,
+            }
+          } else if (body) {
+            requestBody = {
+              body: bodyString,
+              stamp: {
+                stampHeaderName: stamp.stampHeaderName,
+                stampHeaderValue: stamp.stampHeaderValue,
+              },
+              apiUrl: apiUrl,
+            }
+          } else {
+            requestBody = {
+              ...args.body,
+              stamp: {
+                stampHeaderName: stamp.stampHeaderName,
+                stampHeaderValue: stamp.stampHeaderValue,
+              },
+            }
           }
         }
       }

package/src/core/createZeroDevWalletCore.ts

@@ -1,8 +1,4 @@
 import type { LocalAccount } from 'viem/accounts'
-import type {
-  EmailCustomization,
-  OtpCodeCustomization,
-} from '../actions/auth/index.js'
 import { toViemAccount } from '../adapters/viem.js'
 import {
   type CreateTransportOptions,
@@ -37,8 +33,6 @@ export interface ZeroDevWalletConfigCore {
   fetchOptions?: CreateTransportOptions['fetchOptions']
 }
 
-// Re-export EmailCustomization for convenience
-export type { EmailCustomization } from '../actions/auth/index.js'
 export type { StorageAdapter, StorageManager } from '../storage/manager.js'
 // Re-export new session types
 export type { StamperType, ZeroDevWalletSession } from '../types/session.js'
@@ -61,8 +55,6 @@ export type AuthParams =
         type: 'email' | 'sms'
         contact: string
       }
-      emailCustomization?: EmailCustomization
-      otpCodeCustomization?: OtpCodeCustomization
     }
   | {
       type: 'otp'
@@ -79,8 +71,6 @@ export type AuthParams =
       type: 'magicLink'
       mode: 'send'
       email: string
-      redirectURL: string
-      otpCodeCustomization?: OtpCodeCustomization
     }
   | {
       type: 'magicLink'
@@ -190,7 +180,11 @@ export async function createZeroDevWalletCore(
         const data = await client.loginWithStamp({
           targetPublicKey: compressedPublicKeyHex,
           projectId,
-          organizationId: activeSession.organizationId,
+          // Stamp-login is signed against the Turnkey parent org; the backend
+          // resolves the sub-org from the stamped credential. Signing the
+          // sub-org here makes the relayed payload's org mismatch the
+          // signature → Turnkey SIGNATURE_INVALID.
+          organizationId,
           stampWith: 'apiKey',
         })
         await client.apiKeyStamper.commitKeyRotation()
@@ -270,7 +264,9 @@ export async function createZeroDevWalletCore(
             const loginData = await client.loginWithStamp({
               projectId,
               targetPublicKey: compressedPublicKeyHex,
-              organizationId: data.subOrganizationId,
+              // Sign against the parent org (see refreshSession note) — the
+              // backend derives the sub-org from the stamped credential.
+              organizationId,
             })
             await client.apiKeyStamper.commitKeyRotation()
             const parsedSession = parseSession(loginData.session)
@@ -302,6 +298,9 @@ export async function createZeroDevWalletCore(
             const loginData = await client.loginWithStamp({
               targetPublicKey: generatedPublicKey,
               projectId,
+              // Sign against the parent org, not the user's sub-org (see the
+              // refreshSession note). The backend derives the sub-org from the
+              // stamped passkey credential.
               organizationId,
               stampWith: 'passkey',
             })
@@ -329,17 +328,14 @@ export async function createZeroDevWalletCore(
           let otpParams: Extract<AuthParams, { type: 'otp' }>
           if (params.type === 'magicLink') {
             if (params.mode === 'send') {
+              // Magic-link vs plain-OTP delivery and the link URL template are
+              // configured per-project on the backend (`wallet.otp_configs`);
+              // the client just initiates OTP and the backend decides.
               otpParams = {
                 type: 'otp',
                 mode: 'sendOtp',
                 email: params.email,
                 contact: { type: 'email', contact: params.email },
-                emailCustomization: {
-                  magicLinkTemplate: `${params.redirectURL}${params.redirectURL.includes('?') ? '&' : '?'}code=%s`,
-                },
-                ...(params.otpCodeCustomization && {
-                  otpCodeCustomization: params.otpCodeCustomization,
-                }),
               }
             } else {
               otpParams = {
@@ -355,15 +351,12 @@ export async function createZeroDevWalletCore(
           }
 
           if (otpParams.mode === 'sendOtp') {
-            const { email, contact, emailCustomization, otpCodeCustomization } =
-              otpParams
+            const { email, contact } = otpParams
 
             const data = await client.registerWithOTP({
               email,
               contact,
               projectId,
-              ...(emailCustomization && { emailCustomization }),
-              ...(otpCodeCustomization && { otpCodeCustomization }),
             })
 
             return data

package/src/index.native.ts

@@ -19,7 +19,6 @@ export type {
   AuthenticateWithOAuthParameters,
   AuthenticateWithOAuthReturnType,
   EmailContact,
-  EmailCustomization,
   GetAuthenticatorsParameters,
   GetAuthenticatorsReturnType,
   GetUserWalletParameters,

package/src/index.ts

@@ -15,7 +15,6 @@ export type {
   AuthenticateWithOAuthParameters,
   AuthenticateWithOAuthReturnType,
   EmailContact,
-  EmailCustomization,
   GetAuthenticatorsParameters,
   GetAuthenticatorsReturnType,
   // Wallet types