@zerodev/wallet-core 0.0.1-alpha.8 → 0.0.1

package/dist/_types/stampers/types.d.ts

@@ -4,8 +4,6 @@ export type Stamp = {
     stampHeaderValue: string;
 };
 export type Stamper = {
-    /** retrieve public key compressed or otherwise as per the stamper */
-    getPublicKey: () => Promise<string | null>;
     /** produce Turnkey header value for a given request body */
     stamp: (payload: string) => Promise<Stamp>;
     /** clear local state (embedded key, IDB keypair, etc.) */
@@ -13,13 +11,49 @@ export type Stamper = {
 };
 export type KeyFormat = 'Hexadecimal' | 'Solana';
 export type IframeStamper = Stamper & {
+    /** retrieve public key compressed or otherwise as per the stamper */
+    getPublicKey: () => Promise<string | null>;
     init(): Promise<string>;
     injectCredentialBundle(bundle: string): Promise<boolean>;
     injectWalletExportBundle(bundle: string, organizationId: string): Promise<boolean>;
     injectKeyExportBundle(bundle: string, organizationId: string, keyFormat?: KeyFormat): Promise<boolean>;
+    applySettings(settings: {
+        styles?: Record<string, string>;
+    }): Promise<boolean>;
+};
+export type ApiKeyStamper = Stamper & {
+    /** retrieve public key compressed or otherwise as per the stamper */
+    getPublicKey: () => Promise<string | null>;
+    /** Generate + activate a new key pair immediately (simple cases: login init, logout). */
+    resetKeyPair: () => Promise<void>;
+    /** Generate a new key pair internally, return its compressed public key, but keep the OLD key active for stamp(). */
+    prepareKeyRotation: () => Promise<string>;
+    /** Promote the pending key to active. Call after the server accepts the new key. */
+    commitKeyRotation: () => Promise<void>;
+    /**
+     * Sign `payload` with the currently active key. Returns a hex-encoded
+     * ECDSA-P256 / SHA-256 signature in ASN.1 DER form.
+     */
+    sign: (payload: string) => Promise<string>;
+};
+export type Attestation = {
+    attestationObject: string;
+    clientDataJson: string;
+    credentialId: string;
+};
+export type PasskeyRegistrationOptions = {
+    rp: {
+        id: string;
+        name: string;
+    };
+    userName: string;
+};
+export type PasskeyRegistrationResult = {
+    attestation: Attestation;
+    encodedChallenge: string;
 };
-export type IndexedDbStamper = Stamper & {
-    resetKeyPair: (externalKeyPair?: CryptoKeyPair) => Promise<void>;
+export type PasskeyStamper = Stamper & {
+    /** Create a new passkey credential. Owns challenge and user ID generation internally. */
+    register: (options: PasskeyRegistrationOptions) => Promise<PasskeyRegistrationResult>;
 };
-export type WebauthnStamper = Stamper;
 //# sourceMappingURL=types.d.ts.map

package/dist/_types/stampers/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/stampers/types.ts"],"names":[],"mappings":"AAAA,6CAA6C;AAC7C,MAAM,MAAM,KAAK,GAAG;IAClB,eAAe,EAAE,MAAM,CAAA;IACvB,gBAAgB,EAAE,MAAM,CAAA;CACzB,CAAA;AAED,MAAM,MAAM,OAAO,GAAG;IACpB,qEAAqE;IACrE,YAAY,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;IAC1C,4DAA4D;IAC5D,KAAK,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,KAAK,CAAC,CAAA;IAC1C,0DAA0D;IAC1D,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;CAC3B,CAAA;AAED,MAAM,MAAM,SAAS,GAAG,aAAa,GAAG,QAAQ,CAAA;AAEhD,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG;IACpC,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,CAAA;IACvB,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IACxD,wBAAwB,CACtB,MAAM,EAAE,MAAM,EACd,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,OAAO,CAAC,CAAA;IACnB,qBAAqB,CACnB,MAAM,EAAE,MAAM,EACd,cAAc,EAAE,MAAM,EACtB,SAAS,CAAC,EAAE,SAAS,GACpB,OAAO,CAAC,OAAO,CAAC,CAAA;CACpB,CAAA;AAED,MAAM,MAAM,gBAAgB,GAAG,OAAO,GAAG;IACvC,YAAY,EAAE,CAAC,eAAe,CAAC,EAAE,aAAa,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CACjE,CAAA;AACD,MAAM,MAAM,eAAe,GAAG,OAAO,CAAA"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/stampers/types.ts"],"names":[],"mappings":"AAAA,6CAA6C;AAC7C,MAAM,MAAM,KAAK,GAAG;IAClB,eAAe,EAAE,MAAM,CAAA;IACvB,gBAAgB,EAAE,MAAM,CAAA;CACzB,CAAA;AAED,MAAM,MAAM,OAAO,GAAG;IACpB,4DAA4D;IAC5D,KAAK,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,KAAK,CAAC,CAAA;IAC1C,0DAA0D;IAC1D,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;CAC3B,CAAA;AAED,MAAM,MAAM,SAAS,GAAG,aAAa,GAAG,QAAQ,CAAA;AAEhD,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG;IACpC,qEAAqE;IACrE,YAAY,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;IAC1C,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,CAAA;IACvB,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IACxD,wBAAwB,CACtB,MAAM,EAAE,MAAM,EACd,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,OAAO,CAAC,CAAA;IACnB,qBAAqB,CACnB,MAAM,EAAE,MAAM,EACd,cAAc,EAAE,MAAM,EACtB,SAAS,CAAC,EAAE,SAAS,GACpB,OAAO,CAAC,OAAO,CAAC,CAAA;IACnB,aAAa,CAAC,QAAQ,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CAC/E,CAAA;AAED,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG;IACpC,qEAAqE;IACrE,YAAY,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;IAC1C,yFAAyF;IACzF,YAAY,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;IACjC,qHAAqH;IACrH,kBAAkB,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAA;IACzC,oFAAoF;IACpF,iBAAiB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;IACtC;;;OAGG;IACH,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAA;CAC3C,CAAA;AACD,MAAM,MAAM,WAAW,GAAG;IACxB,iBAAiB,EAAE,MAAM,CAAA;IACzB,cAAc,EAAE,MAAM,CAAA;IACtB,YAAY,EAAE,MAAM,CAAA;CACrB,CAAA;AAED,MAAM,MAAM,0BAA0B,GAAG;IACvC,EAAE,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;IAChC,QAAQ,EAAE,MAAM,CAAA;CACjB,CAAA;AAED,MAAM,MAAM,yBAAyB,GAAG;IACtC,WAAW,EAAE,WAAW,CAAA;IACxB,gBAAgB,EAAE,MAAM,CAAA;CACzB,CAAA;AAED,MAAM,MAAM,cAAc,GAAG,OAAO,GAAG;IACrC,yFAAyF;IACzF,QAAQ,EAAE,CACR,OAAO,EAAE,0BAA0B,KAChC,OAAO,CAAC,yBAAyB,CAAC,CAAA;CACxC,CAAA"}

package/dist/_types/stampers/webauthnStamper.d.ts

@@ -1,5 +1,5 @@
-import type { WebauthnStamper } from './types.js';
+import type { PasskeyStamper } from './types.js';
 export declare function createWebauthnStamper({ rpId, }: {
     rpId: string;
-}): Promise<WebauthnStamper>;
+}): Promise<PasskeyStamper>;
 //# sourceMappingURL=webauthnStamper.d.ts.map

package/dist/_types/stampers/webauthnStamper.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"webauthnStamper.d.ts","sourceRoot":"","sources":["../../../src/stampers/webauthnStamper.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAEjD,wBAAsB,qBAAqB,CAAC,EAC1C,IAAI,GACL,EAAE;IACD,IAAI,EAAE,MAAM,CAAA;CACb,GAAG,OAAO,CAAC,eAAe,CAAC,CAa3B"}
+{"version":3,"file":"webauthnStamper.d.ts","sourceRoot":"","sources":["../../../src/stampers/webauthnStamper.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAA8B,cAAc,EAAE,MAAM,YAAY,CAAA;AAE5E,wBAAsB,qBAAqB,CAAC,EAC1C,IAAI,GACL,EAAE;IACD,IAAI,EAAE,MAAM,CAAA;CACb,GAAG,OAAO,CAAC,cAAc,CAAC,CAgC1B"}

package/dist/_types/stubs/native-on-web.d.ts

@@ -0,0 +1,6 @@
+declare function throwOnUse(): never;
+export declare const createSecureStoreStamper: typeof throwOnUse;
+export declare const createReactNativePasskeyStamper: typeof throwOnUse;
+export declare const asyncStorageAdapter: typeof throwOnUse;
+export default throwOnUse;
+//# sourceMappingURL=native-on-web.d.ts.map

package/dist/_types/stubs/native-on-web.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"native-on-web.d.ts","sourceRoot":"","sources":["../../../src/stubs/native-on-web.ts"],"names":[],"mappings":"AAiBA,iBAAS,UAAU,IAAI,KAAK,CAE3B;AAED,eAAO,MAAM,wBAAwB,mBAAa,CAAA;AAClD,eAAO,MAAM,+BAA+B,mBAAa,CAAA;AACzD,eAAO,MAAM,mBAAmB,mBAAa,CAAA;AAK7C,eAAe,UAAU,CAAA"}

package/dist/_types/types/session.d.ts

@@ -2,15 +2,14 @@ export declare enum SessionType {
     READ_ONLY = "SESSION_TYPE_READ_ONLY",
     READ_WRITE = "SESSION_TYPE_READ_WRITE"
 }
-export type StamperType = 'iframe' | 'indexedDb' | 'passkey';
+export type StamperType = 'apiKey' | 'passkey';
 export type ZeroDevWalletSession = {
     id: string;
     userId: string;
     organizationId: string;
     stamperType: StamperType;
     sessionType?: SessionType;
-    token?: string;
-    publicKey?: string;
+    token: string;
     expiry: number;
     createdAt: number;
 };

package/dist/_types/types/session.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../../src/types/session.ts"],"names":[],"mappings":"AAAA,oBAAY,WAAW;IACrB,SAAS,2BAA2B;IACpC,UAAU,4BAA4B;CACvC;AAED,MAAM,MAAM,WAAW,GAAG,QAAQ,GAAG,WAAW,GAAG,SAAS,CAAA;AAE5D,MAAM,MAAM,oBAAoB,GAAG;IACjC,EAAE,EAAE,MAAM,CAAA;IACV,MAAM,EAAE,MAAM,CAAA;IACd,cAAc,EAAE,MAAM,CAAA;IACtB,WAAW,EAAE,WAAW,CAAA;IACxB,WAAW,CAAC,EAAE,WAAW,CAAA;IACzB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,MAAM,EAAE,MAAM,CAAA;IACd,SAAS,EAAE,MAAM,CAAA;CAClB,CAAA"}
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../../src/types/session.ts"],"names":[],"mappings":"AAAA,oBAAY,WAAW;IACrB,SAAS,2BAA2B;IACpC,UAAU,4BAA4B;CACvC;AAED,MAAM,MAAM,WAAW,GAAG,QAAQ,GAAG,SAAS,CAAA;AAE9C,MAAM,MAAM,oBAAoB,GAAG;IACjC,EAAE,EAAE,MAAM,CAAA;IACV,MAAM,EAAE,MAAM,CAAA;IACd,cAAc,EAAE,MAAM,CAAA;IACtB,WAAW,EAAE,WAAW,CAAA;IACxB,WAAW,CAAC,EAAE,WAAW,CAAA;IACzB,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,MAAM,CAAA;IACd,SAAS,EAAE,MAAM,CAAA;CAClB,CAAA"}

package/dist/_types/utils/buildClientSignature.d.ts

@@ -1,11 +1,11 @@
-import type { IndexedDbStamper } from '../stampers/types.js';
+import type { ApiKeyStamper } from '../stampers/types.js';
 export type BuildClientSignatureParams = {
     /** The verification token JWT from Auth Proxy's verifyOtp */
     verificationToken: string;
     /** The compressed public key hex */
     publicKey: string;
-    /** The IndexedDB stamper for signing */
-    stamper: IndexedDbStamper;
+    /** The API key stamper for signing */
+    stamper: ApiKeyStamper;
 };
 /**
  * Builds a client signature for OTP login.

package/dist/_types/utils/buildClientSignature.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"buildClientSignature.d.ts","sourceRoot":"","sources":["../../../src/utils/buildClientSignature.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AAG5D,MAAM,MAAM,0BAA0B,GAAG;IACvC,6DAA6D;IAC7D,iBAAiB,EAAE,MAAM,CAAA;IACzB,oCAAoC;IACpC,SAAS,EAAE,MAAM,CAAA;IACjB,wCAAwC;IACxC,OAAO,EAAE,gBAAgB,CAAA;CAC1B,CAAA;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,0BAA0B,GACjC,OAAO,CAAC,MAAM,CAAC,CA2BjB"}
+{"version":3,"file":"buildClientSignature.d.ts","sourceRoot":"","sources":["../../../src/utils/buildClientSignature.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AAGzD,MAAM,MAAM,0BAA0B,GAAG;IACvC,6DAA6D;IAC7D,iBAAiB,EAAE,MAAM,CAAA;IACzB,oCAAoC;IACpC,SAAS,EAAE,MAAM,CAAA;IACjB,sCAAsC;IACtC,OAAO,EAAE,aAAa,CAAA;CACvB,CAAA;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,0BAA0B,GACjC,OAAO,CAAC,MAAM,CAAC,CA2BjB"}

package/dist/_types/utils/encryptOtpAttempt.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Wraps the OTP code + client public key in a Turnkey-compatible HPKE bundle
+ * for the `/v1/otp_verify_v2` auth-proxy endpoint.
+ *
+ * Bundle flow (RFC 9180 mode_base over Turnkey's TLS Fetcher enclave):
+ *   1. The backend's /init/otp returns a signed envelope that contains an
+ *      ephemeral HPKE public key (`targetPublic`) generated fresh by the
+ *      enclave for this OTP attempt.
+ *   2. We verify the envelope's ECDSA signature against a pinned production
+ *      key (`TURNKEY_TLS_FETCHER_SIGN_PUBLIC_KEY`) so a compromised proxy
+ *      cannot substitute its own ephemeral key.
+ *   3. We HPKE-seal `{otp_code, public_key}` to `targetPublic`. The auth proxy
+ *      forwards the ciphertext to the enclave; only the enclave can decrypt
+ *      it. The enclave then issues a `verificationToken` bound to the public
+ *      key embedded in the plaintext.
+ *
+ * See: tkhq/go-sdk `examples/email_otp` and `pkg/enclave_encrypt`.
+ */
+export type EncryptOtpAttemptParams = {
+    /** The OTP code the user entered. */
+    otpCode: string;
+    /**
+     * The client's session public key (compressed P-256 hex). The enclave binds
+     * this key into the `verificationToken` it issues.
+     */
+    publicKey: string;
+    /** The signed envelope returned by `/auth/init/otp`. */
+    encryptionTargetBundle: string;
+    /**
+     * Test-only override for the pinned signing key. Production callers should
+     * leave this undefined; it exists so tests don't have to use the real key.
+     */
+    dangerouslyOverrideSignerPublicKey?: string;
+};
+/**
+ * Returns a JSON string ready to be sent as `encryptedOtpBundle` on
+ * `POST /v1/otp_verify_v2`.
+ */
+export declare function encryptOtpAttempt({ otpCode, publicKey, encryptionTargetBundle, dangerouslyOverrideSignerPublicKey, }: EncryptOtpAttemptParams): Promise<string>;
+//# sourceMappingURL=encryptOtpAttempt.d.ts.map

package/dist/_types/utils/encryptOtpAttempt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"encryptOtpAttempt.d.ts","sourceRoot":"","sources":["../../../src/utils/encryptOtpAttempt.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAyBH,MAAM,MAAM,uBAAuB,GAAG;IACpC,qCAAqC;IACrC,OAAO,EAAE,MAAM,CAAA;IACf;;;OAGG;IACH,SAAS,EAAE,MAAM,CAAA;IACjB,wDAAwD;IACxD,sBAAsB,EAAE,MAAM,CAAA;IAC9B;;;OAGG;IACH,kCAAkC,CAAC,EAAE,MAAM,CAAA;CAC5C,CAAA;AAED;;;GAGG;AACH,wBAAsB,iBAAiB,CAAC,EACtC,OAAO,EACP,SAAS,EACT,sBAAsB,EACtB,kCAAkC,GACnC,EAAE,uBAAuB,GAAG,OAAO,CAAC,MAAM,CAAC,CAyE3C"}

package/dist/_types/utils/exportPrivateKey.d.ts

@@ -1,4 +1,4 @@
-import type { ZeroDevWalletSDK } from '../core/createZeroDevWallet.js';
+import type { ZeroDevWalletSDK } from '../core/createZeroDevWalletCore.js';
 import type { KeyFormat } from '../stampers/types.js';
 export type ExportPrivateKeyParameters = {
     /** Wallet to use for the export */

package/dist/_types/utils/exportPrivateKey.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"exportPrivateKey.d.ts","sourceRoot":"","sources":["../../../src/utils/exportPrivateKey.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAA;AACtE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAA;AAErD,MAAM,MAAM,0BAA0B,GAAG;IACvC,mCAAmC;IACnC,MAAM,EAAE,gBAAgB,CAAA;IACxB,0DAA0D;IAC1D,eAAe,EAAE,MAAM,CAAA;IACvB,gFAAgF;IAChF,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB,CAAA;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,0BAA0B,GACjC,OAAO,CAAC;IAAE,YAAY,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAA;CAAE,CAAC,CAqE5E;AAED,YAAY,EAAE,SAAS,EAAE,CAAA"}
+{"version":3,"file":"exportPrivateKey.d.ts","sourceRoot":"","sources":["../../../src/utils/exportPrivateKey.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oCAAoC,CAAA;AAC1E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAA;AAErD,MAAM,MAAM,0BAA0B,GAAG;IACvC,mCAAmC;IACnC,MAAM,EAAE,gBAAgB,CAAA;IACxB,0DAA0D;IAC1D,eAAe,EAAE,MAAM,CAAA;IACvB,gFAAgF;IAChF,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB,CAAA;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,0BAA0B,GACjC,OAAO,CAAC;IAAE,YAAY,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAA;CAAE,CAAC,CAqE5E;AAED,YAAY,EAAE,SAAS,EAAE,CAAA"}

package/dist/_types/utils/exportWallet.d.ts

@@ -1,4 +1,4 @@
-import type { ZeroDevWalletSDK } from '../core/createZeroDevWallet.js';
+import type { ZeroDevWalletSDK } from '../core/createZeroDevWalletCore.js';
 export type ExportWalletParameters = {
     /** Wallet to use for the export */
     wallet: ZeroDevWalletSDK;

package/dist/_types/utils/exportWallet.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"exportWallet.d.ts","sourceRoot":"","sources":["../../../src/utils/exportWallet.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAA;AAEtE,MAAM,MAAM,sBAAsB,GAAG;IACnC,mCAAmC;IACnC,MAAM,EAAE,gBAAgB,CAAA;IACxB,0DAA0D;IAC1D,eAAe,EAAE,MAAM,CAAA;CACxB,CAAA;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAsB,YAAY,CAChC,MAAM,EAAE,sBAAsB,GAC7B,OAAO,CAAC;IAAE,YAAY,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAA;CAAE,CAAC,CAuF7E"}
+{"version":3,"file":"exportWallet.d.ts","sourceRoot":"","sources":["../../../src/utils/exportWallet.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oCAAoC,CAAA;AAE1E,MAAM,MAAM,sBAAsB,GAAG;IACnC,mCAAmC;IACnC,MAAM,EAAE,gBAAgB,CAAA;IACxB,0DAA0D;IAC1D,eAAe,EAAE,MAAM,CAAA;CACxB,CAAA;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAsB,YAAY,CAChC,MAAM,EAAE,sBAAsB,GAC7B,OAAO,CAAC;IAAE,YAAY,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAA;CAAE,CAAC,CA8E7E"}

package/dist/_types/utils/hpke.d.ts

@@ -0,0 +1,38 @@
+/**
+ * HPKE (RFC 9180) seal for Turnkey enclave-encrypted requests.
+ *
+ * Suite: DHKEM(P-256, HKDF-SHA256) / HKDF-SHA256 / AES-256-GCM
+ *   - KEM ID  = 0x0010 (DHKEM-P256-HKDF-SHA256)
+ *   - KDF ID  = 0x0001 (HKDF-SHA256)
+ *   - AEAD ID = 0x0002 (AES-256-GCM)
+ *
+ * Wire format and AAD construction match Turnkey's enclave_encrypt Go package:
+ *   info = "turnkey_hpke"
+ *   aad  = enc || pkR  (both 65-byte uncompressed P-256 points)
+ *
+ * References:
+ *   - RFC 9180 §4 / §5
+ *   - tkhq/go-sdk/pkg/enclave_encrypt
+ */
+export type HpkeSealResult = {
+    /** Ephemeral sender public key (uncompressed P-256, 65 bytes). */
+    encappedPublic: Uint8Array;
+    /** AES-256-GCM ciphertext with a 16-byte authentication tag appended. */
+    ciphertext: Uint8Array;
+};
+/**
+ * Single-shot HPKE seal in mode_base for Turnkey's TLS Fetcher enclave.
+ *
+ * Uses the fixed Turnkey `info = "turnkey_hpke"` and the AAD shape
+ * `enc || receiverPublicKey` so the resulting bundle is decryptable by
+ * `enclave_encrypt.EnclaveEncryptServer.Decrypt`.
+ *
+ * @param receiverPublicKey - The enclave's ephemeral target public key
+ *   (uncompressed P-256, 65 bytes), extracted from the encryption target bundle.
+ * @param plaintext - The bytes to encrypt (e.g. the JSON-encoded OTP attempt).
+ */
+export declare function hpkeSealP256({ receiverPublicKey, plaintext, }: {
+    receiverPublicKey: Uint8Array;
+    plaintext: Uint8Array;
+}): Promise<HpkeSealResult>;
+//# sourceMappingURL=hpke.d.ts.map

package/dist/_types/utils/hpke.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hpke.d.ts","sourceRoot":"","sources":["../../../src/utils/hpke.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAoKH,MAAM,MAAM,cAAc,GAAG;IAC3B,kEAAkE;IAClE,cAAc,EAAE,UAAU,CAAA;IAC1B,yEAAyE;IACzE,UAAU,EAAE,UAAU,CAAA;CACvB,CAAA;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,YAAY,CAAC,EACjC,iBAAiB,EACjB,SAAS,GACV,EAAE;IACD,iBAAiB,EAAE,UAAU,CAAA;IAC7B,SAAS,EAAE,UAAU,CAAA;CACtB,GAAG,OAAO,CAAC,cAAc,CAAC,CAe1B"}

package/dist/_types/utils/platform.d.ts

@@ -0,0 +1,2 @@
+export declare function isReactNative(): boolean;
+//# sourceMappingURL=platform.d.ts.map

package/dist/_types/utils/platform.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform.d.ts","sourceRoot":"","sources":["../../../src/utils/platform.ts"],"names":[],"mappings":"AAAA,wBAAgB,aAAa,IAAI,OAAO,CAoBvC"}

package/dist/_types/utils/resolveOrganizationId.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Builds a memoized resolver for the Turnkey parent org that stamp-login is
+ * signed against. Resolution order:
+ *   1. explicit override (self-hosted / local backends)
+ *   2. value fetched from the backend, cached after the first success
+ *   3. fallback (the known prod parent org) if the fetch fails
+ *
+ * The fetch is only attempted when there's no override, and only once — a
+ * failure is cached as the fallback so we don't refetch on every login.
+ */
+export declare function createOrganizationIdResolver(opts: {
+    organizationId?: string | undefined;
+    fetchParentOrgId: () => Promise<string>;
+    fallback: string;
+}): () => Promise<string>;
+//# sourceMappingURL=resolveOrganizationId.d.ts.map

package/dist/_types/utils/resolveOrganizationId.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolveOrganizationId.d.ts","sourceRoot":"","sources":["../../../src/utils/resolveOrganizationId.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,wBAAgB,4BAA4B,CAAC,IAAI,EAAE;IACjD,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACnC,gBAAgB,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAA;IACvC,QAAQ,EAAE,MAAM,CAAA;CACjB,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,CAaxB"}

package/dist/_types/utils/utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../../../src/utils/utils.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,MAAM,CAAA;AACrC,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAE/D;;;;;GAKG;AACH,wBAAgB,YAAY,CAC1B,KAAK,EAAE,MAAM,GAAG,oBAAoB,GACnC,SAAS,CAAC,oBAAoB,EAAE,WAAW,GAAG,IAAI,GAAG,aAAa,CAAC,CA6BrE;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAE5D;AAED;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,QAAO,WAIvC,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,eAAe,GAAI,WAAW,WAAW,KAAG,MAMxD,CAAA;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,UAAU,GAAG,UAAU,CAkBvD;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAK/D;AAED;;;;GAIG;AACH,wBAAsB,sCAAsC,CAC1D,OAAO,EAAE,aAAa,GACrB,OAAO,CAAC,MAAM,CAAC,CAOjB;AAED,eAAO,MAAM,qBAAqB,QAAO,MAExC,CAAA"}
+{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../../../src/utils/utils.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,MAAM,CAAA;AACrC,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAE/D;;;;;GAKG;AACH,wBAAgB,YAAY,CAC1B,KAAK,EAAE,MAAM,GAAG,oBAAoB,GACnC,SAAS,CAAC,oBAAoB,EAAE,WAAW,GAAG,IAAI,GAAG,aAAa,CAAC,CA8BrE;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAE5D;AAED;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,QAAO,WAIvC,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,eAAe,GAAI,WAAW,WAAW,KAAG,MAIxD,CAAA;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,UAAU,GAAG,UAAU,CAkBvD;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAK/D;AAED;;;;GAIG;AACH,wBAAsB,sCAAsC,CAC1D,OAAO,EAAE,aAAa,GACrB,OAAO,CAAC,MAAM,CAAC,CAOjB;AAED,eAAO,MAAM,qBAAqB,QAAO,MAExC,CAAA"}

package/dist/_types/web/createZeroDevWallet.d.ts

@@ -0,0 +1,18 @@
+import { type ZeroDevWalletConfigCore, type ZeroDevWalletSDK } from '../core/createZeroDevWalletCore.js';
+import type { ApiKeyStamper, PasskeyStamper } from '../stampers/types.js';
+import type { StorageAdapter } from '../storage/manager.js';
+/**
+ * Web config: all four web-defaulted fields are optional overrides.
+ * `rpId` falls back to `window.location.hostname`; the others fall back to
+ * IndexedDB / WebAuthn / sessionStorage-backed implementations. RN consumers
+ * go through `@zerodev/wallet-core/react-native`, which exposes the strict
+ * `ZeroDevWalletConfigCore` shape directly.
+ */
+export type ZeroDevWalletConfig = Omit<ZeroDevWalletConfigCore, 'apiKeyStamper' | 'passkeyStamper' | 'rpId' | 'sessionStorage'> & {
+    rpId?: string;
+    sessionStorage?: StorageAdapter;
+    apiKeyStamper?: ApiKeyStamper;
+    passkeyStamper?: PasskeyStamper;
+};
+export declare function createZeroDevWallet(config: ZeroDevWalletConfig): Promise<ZeroDevWalletSDK>;
+//# sourceMappingURL=createZeroDevWallet.d.ts.map

package/dist/_types/web/createZeroDevWallet.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"createZeroDevWallet.d.ts","sourceRoot":"","sources":["../../../src/web/createZeroDevWallet.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,uBAAuB,EAC5B,KAAK,gBAAgB,EACtB,MAAM,oCAAoC,CAAA;AAE3C,OAAO,KAAK,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAGzE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAE3D;;;;;;GAMG;AACH,MAAM,MAAM,mBAAmB,GAAG,IAAI,CACpC,uBAAuB,EACvB,eAAe,GAAG,gBAAgB,GAAG,MAAM,GAAG,gBAAgB,CAC/D,GAAG;IACF,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,cAAc,CAAC,EAAE,cAAc,CAAA;IAC/B,aAAa,CAAC,EAAE,aAAa,CAAA;IAC7B,cAAc,CAAC,EAAE,cAAc,CAAA;CAChC,CAAA;AAED,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,mBAAmB,GAC1B,OAAO,CAAC,gBAAgB,CAAC,CAc3B"}