@zerodev/wallet-core 0.0.1-alpha.8 → 0.0.1

package/src/index.ts

@@ -1,10 +1,22 @@
+import { isReactNative } from './utils/platform.js'
+
+if (isReactNative()) {
+  // biome-ignore lint/suspicious/noConsole: Warning users if they try to use the web entry on React Native.
+  console.warn(
+    '@zerodev/wallet-core: the web entry was loaded in a React Native runtime. Check that your metro.config.js has `unstable_enablePackageExports: true` and `"react-native"` in `unstable_conditionNames`.',
+  )
+}
+
 export type {
   // Auth types
+  ApiKeyAuthenticator,
   AuthenticateWithEmailParameters,
   AuthenticateWithEmailReturnType,
   AuthenticateWithOAuthParameters,
   AuthenticateWithOAuthReturnType,
-  EmailCustomization,
+  EmailContact,
+  GetAuthenticatorsParameters,
+  GetAuthenticatorsReturnType,
   // Wallet types
   GetUserWalletParameters,
   GetUserWalletReturnType,
@@ -12,13 +24,21 @@ export type {
   GetWhoamiReturnType,
   LoginWithOTPParameters,
   LoginWithOTPReturnType,
+  OAuthAuthenticator,
   OtpContact,
+  PasskeyAuthenticator,
   RegisterWithOTPParameters,
   RegisterWithOTPReturnType,
-  SignRawPayloadParameters,
-  SignRawPayloadReturnType,
+  Sign7702AuthorizationParameters,
+  Sign7702AuthorizationReturnType,
+  SignMessageParameters,
+  SignMessageReturnType,
   SignTransactionParameters,
   SignTransactionReturnType,
+  SignTypedDataV4Parameters,
+  SignTypedDataV4ReturnType,
+  SignUserOperationParameters,
+  SignUserOperationReturnType,
 } from './actions/index.js'
 
 // Actions
@@ -26,13 +46,17 @@ export {
   // Auth actions
   authenticateWithEmail,
   authenticateWithOAuth,
+  getAuthenticators,
   // Wallet actions
   getUserWallet,
   getWhoami,
   loginWithOTP,
   registerWithOTP,
-  signRawPayload,
+  sign7702Authorization,
+  signMessage,
   signTransaction,
+  signTypedDataV4,
+  signUserOperation,
 } from './actions/index.js'
 export type { ToViemAccountParams } from './adapters/viem.js'
 // Adapters
@@ -40,7 +64,12 @@ export { toViemAccount } from './adapters/viem.js'
 export type { ZeroDevWalletActions } from './client/decorators/client.js'
 // Client decorators
 export { zeroDevWalletActions } from './client/decorators/client.js'
-export type { Client, ClientConfig, Transport } from './client/index.js'
+export type {
+  Client,
+  ClientConfig,
+  CreateTransportOptions,
+  Transport,
+} from './client/index.js'
 // Client
 export {
   createBaseClient,
@@ -52,21 +81,17 @@ export {
 export { KMS_SERVER_URL } from './constants.js'
 export type {
   AuthParams,
-  ZeroDevWalletConfig,
   ZeroDevWalletSDK,
-} from './core/createZeroDevWallet.js'
-// Core
-export { createZeroDevWallet } from './core/createZeroDevWallet.js'
+} from './core/createZeroDevWalletCore.js'
 // Stampers
-export {
-  createIframeStamper,
-  createIndexedDbStamper,
-  createWebauthnStamper,
-} from './stampers/index.js'
+export { createIframeStamper } from './stampers/iframeStamper.js'
 export type {
+  ApiKeyStamper,
+  Attestation,
   IframeStamper,
-  IndexedDbStamper,
-  WebauthnStamper,
+  PasskeyRegistrationOptions,
+  PasskeyRegistrationResult,
+  PasskeyStamper,
 } from './stampers/types.js'
 // Storage
 export type { StorageAdapter, StorageManager } from './storage/manager.js'
@@ -77,3 +102,11 @@ export { exportPrivateKey } from './utils/exportPrivateKey.js'
 export { exportWallet } from './utils/exportWallet.js'
 // Utils
 export { normalizeTimestamp } from './utils/utils.js'
+// Core — bare specifier resolves web defaults (IndexedDB, WebAuthn, session
+// storage, hostname-derived rpId) before forwarding to the shared factory.
+// RN consumers go through `@zerodev/wallet-core/react-native`, which exposes
+// the strict `ZeroDevWalletConfig` (= core's required-fields shape) directly.
+export {
+  createZeroDevWallet,
+  type ZeroDevWalletConfig,
+} from './web/createZeroDevWallet.js'

package/src/native/createZeroDevWallet.ts

@@ -0,0 +1,26 @@
+import {
+  createZeroDevWalletCore,
+  type ZeroDevWalletConfigCore,
+  type ZeroDevWalletSDK,
+} from '../core/createZeroDevWalletCore.js'
+
+/**
+ * React Native config — mirrors `web/createZeroDevWallet.ts`'s wrapper
+ * pattern. RN consumers must supply all four adapter fields up front
+ * (no platform-native defaults exist for IndexedDB/WebAuthn). The only
+ * RN-specific defaulting is `fetchOptions`: when omitted, we set
+ * `Origin: https://${rpId}` so Turnkey's ACL accepts the request. Power
+ * users wanting a different Origin can pass `fetchOptions` explicitly.
+ */
+export type ZeroDevWalletConfig = ZeroDevWalletConfigCore
+
+export async function createZeroDevWallet(
+  config: ZeroDevWalletConfig,
+): Promise<ZeroDevWalletSDK> {
+  return createZeroDevWalletCore({
+    ...config,
+    fetchOptions: config.fetchOptions ?? {
+      headers: { Origin: `https://${config.rpId}` },
+    },
+  })
+}

package/src/native/stampers/passkey.ts

@@ -0,0 +1,39 @@
+import {
+  createPasskey,
+  PasskeyStamper as TurnkeyPasskeyStamper,
+} from '@turnkey/react-native-passkey-stamper'
+import { v4 as uuidv4 } from 'uuid'
+import type {
+  PasskeyRegistrationOptions,
+  PasskeyStamper,
+} from '../../stampers/types.js'
+
+export async function createReactNativePasskeyStamper({
+  rpId,
+}: {
+  rpId: string
+}): Promise<PasskeyStamper> {
+  const inner = new TurnkeyPasskeyStamper({ rpId })
+
+  return {
+    async stamp(payload: string) {
+      return await inner.stamp(payload)
+    },
+    async clear() {},
+    async register({ rp, userName }: PasskeyRegistrationOptions) {
+      const { attestation, challenge: encodedChallenge } = await createPasskey({
+        rp: {
+          id: rp.id,
+          name: rp.name ?? 'Turnkey',
+        },
+        user: {
+          id: uuidv4(),
+          name: userName,
+          displayName: userName,
+        },
+        authenticatorName: userName ?? 'End-User Passkey',
+      })
+      return { attestation, encodedChallenge }
+    },
+  }
+}

package/src/native/stampers/secureStore.ts

@@ -0,0 +1,139 @@
+import { ApiKeyStamper, SignatureFormat } from '@turnkey/api-key-stamper'
+import { generateP256KeyPair } from '@turnkey/crypto'
+import * as SecureStore from 'expo-secure-store'
+import type { ApiKeyStamper as ZDApiKeyStamper } from '../../stampers/types.js'
+
+const PUBLIC_KEY = 'zerodev.publicKey'
+const PRIVATE_KEY = 'zerodev.privateKey'
+
+class SecureStoreStamperInner {
+  private publicKeyHex: string | null = null
+
+  async init(): Promise<void> {
+    const publicKey = await SecureStore.getItemAsync(PUBLIC_KEY)
+    const privateKey = await SecureStore.getItemAsync(PRIVATE_KEY)
+
+    if (publicKey && privateKey) {
+      this.publicKeyHex = publicKey
+    } else {
+      await this.resetKeyPair()
+    }
+  }
+
+  async getPublicKey(): Promise<string | null> {
+    return this.publicKeyHex
+  }
+
+  async resetKeyPair(externalKeyPair?: {
+    publicKey: string
+    privateKey: string
+  }): Promise<void> {
+    await this.clear()
+
+    const pair = externalKeyPair ?? generateP256KeyPair()
+
+    await SecureStore.setItemAsync(PUBLIC_KEY, pair.publicKey)
+    await SecureStore.setItemAsync(PRIVATE_KEY, pair.privateKey)
+
+    this.publicKeyHex = pair.publicKey
+  }
+
+  private async getTurnkeyApiKeyStamper(): Promise<ApiKeyStamper> {
+    if (!this.publicKeyHex) {
+      throw new Error(
+        'Key not initialized. Call init() or resetKeyPair() first.',
+      )
+    }
+
+    const privateKey = await SecureStore.getItemAsync(PRIVATE_KEY)
+    if (!privateKey) {
+      throw new Error('No private key found in secure store.')
+    }
+
+    return new ApiKeyStamper({
+      apiPublicKey: this.publicKeyHex,
+      apiPrivateKey: privateKey,
+    })
+  }
+
+  async stamp(
+    payload: string,
+  ): Promise<{ stampHeaderName: string; stampHeaderValue: string }> {
+    const stamper = await this.getTurnkeyApiKeyStamper()
+    const { stampHeaderName, stampHeaderValue } = await stamper.stamp(payload)
+    return { stampHeaderName, stampHeaderValue }
+  }
+
+  async sign(payload: string): Promise<string> {
+    const stamper = await this.getTurnkeyApiKeyStamper()
+    return stamper.sign(payload, SignatureFormat.Der)
+  }
+
+  async clear(): Promise<void> {
+    await SecureStore.deleteItemAsync(PUBLIC_KEY)
+    await SecureStore.deleteItemAsync(PRIVATE_KEY)
+    this.publicKeyHex = null
+  }
+}
+
+async function warmApiKeyStamperForMetroDev(
+  inner: SecureStoreStamperInner,
+): Promise<void> {
+  // `__DEV__` is a global set by React Native's Metro; read it via globalThis
+  // so this file needs no ambient `.d.ts` (which would conflict with RN's own
+  // typings when both happen to be in scope, e.g. in the editor).
+  if (!(globalThis as { __DEV__?: boolean }).__DEV__) return
+
+  // In Expo dev, Turnkey's API key stamper loads its React Native signer with a
+  // dynamic import the first time `stamp()` runs. OTP verification is usually
+  // the first code path that stamps a payload, and if the app was backgrounded
+  // while the user copied the code, Metro can serve that lazy module after
+  // foregrounding and trigger a full JS reload. Warming the stamper during dev
+  // startup makes Metro load the signer while the app is foregrounded; production
+  // builds do not use Metro and skip this block via `__DEV__`.
+  try {
+    await inner.stamp('{"purpose":"metro-dev-warmup"}')
+  } catch (error) {
+    // biome-ignore lint/suspicious/noConsole: This only runs in dev mode
+    console.warn('Failed to warm API key stamper in dev:', error)
+  }
+}
+
+export async function createSecureStoreStamper(): Promise<ZDApiKeyStamper> {
+  const inner = new SecureStoreStamperInner()
+  await inner.init()
+  await warmApiKeyStamperForMetroDev(inner)
+
+  let pendingKeyPair: { publicKey: string; privateKey: string } | null = null
+
+  return {
+    async getPublicKey() {
+      return inner.getPublicKey()
+    },
+    async stamp(payload: string) {
+      return inner.stamp(payload)
+    },
+    async sign(payload: string) {
+      return inner.sign(payload)
+    },
+    async clear() {
+      await inner.clear()
+    },
+    async resetKeyPair() {
+      pendingKeyPair = null
+      await inner.resetKeyPair()
+    },
+    async prepareKeyRotation() {
+      const keyPair = generateP256KeyPair()
+      pendingKeyPair = keyPair
+      return keyPair.publicKey
+    },
+    async commitKeyRotation() {
+      if (!pendingKeyPair) {
+        throw new Error('No pending key rotation to commit')
+      }
+      await inner.resetKeyPair(pendingKeyPair)
+      pendingKeyPair = null
+    },
+  }
+}

package/src/native/storage/asyncStorage.ts

@@ -0,0 +1,18 @@
+import type { AsyncStorageStatic } from '@react-native-async-storage/async-storage'
+import * as AsyncStorageNS from '@react-native-async-storage/async-storage'
+import type { StorageAdapter } from '../../storage/manager.js'
+
+// CJS package whose `.d.ts` declares `export default AsyncStorage`. Our tsconfig
+// keeps `esModuleInterop: false` (and `verbatimModuleSyntax: true`), so a plain
+// `import AsyncStorage from '...'` types as the module namespace instead of
+// the default. Unwrap explicitly. At runtime Metro returns the default object
+// either way; this only affects the static type.
+const AsyncStorage: AsyncStorageStatic = (
+  AsyncStorageNS as unknown as { default: AsyncStorageStatic }
+).default
+
+export const asyncStorageAdapter: StorageAdapter = {
+  getItem: (key) => AsyncStorage.getItem(key),
+  setItem: (key, value) => AsyncStorage.setItem(key, value),
+  removeItem: (key) => AsyncStorage.removeItem(key),
+}

package/src/stampers/iframeStamper.ts

@@ -45,5 +45,8 @@ export async function createIframeStamper(cfg: {
         keyFormat ? KeyFormat[keyFormat] : KeyFormat.Hexadecimal,
       )
     },
+    async applySettings(settings: { styles?: Record<string, string> }) {
+      return await inner.applySettings(settings)
+    },
   }
 }

package/src/stampers/indexedDbStamper.ts

@@ -1,10 +1,13 @@
 import { IndexedDbStamper as TurnkeyIndexedDbStamper } from '@turnkey/indexed-db-stamper'
-import type { IndexedDbStamper } from './types.js'
+import { generateCompressedPublicKeyFromKeyPair } from '../utils/utils.js'
+import type { ApiKeyStamper } from './types.js'
 
-export async function createIndexedDbStamper(): Promise<IndexedDbStamper> {
+export async function createIndexedDbStamper(): Promise<ApiKeyStamper> {
   const inner = new TurnkeyIndexedDbStamper()
   await inner.init()
 
+  let pendingKeyPair: CryptoKeyPair | null = null
+
   return {
     async getPublicKey() {
       return await inner.getPublicKey()
@@ -12,11 +15,31 @@ export async function createIndexedDbStamper(): Promise<IndexedDbStamper> {
     async stamp(payload: string) {
       return await inner.stamp(payload)
     },
+    async sign(payload: string) {
+      return await inner.sign(payload)
+    },
     async clear() {
       await inner.clear()
     },
-    async resetKeyPair(externalKeyPair?: CryptoKeyPair) {
-      await inner.resetKeyPair(externalKeyPair)
+    async resetKeyPair() {
+      pendingKeyPair = null
+      await inner.resetKeyPair()
+    },
+    async prepareKeyRotation() {
+      const keyPair = await crypto.subtle.generateKey(
+        { name: 'ECDSA', namedCurve: 'P-256' },
+        false,
+        ['sign', 'verify'],
+      )
+      pendingKeyPair = keyPair
+      return await generateCompressedPublicKeyFromKeyPair(keyPair)
+    },
+    async commitKeyRotation() {
+      if (!pendingKeyPair) {
+        throw new Error('No pending key rotation to commit')
+      }
+      await inner.resetKeyPair(pendingKeyPair)
+      pendingKeyPair = null
     },
   }
 }

package/src/stampers/noopPasskeyStamper.ts

@@ -0,0 +1,21 @@
+import type { PasskeyStamper } from './types.js'
+
+const NOT_CONFIGURED_MESSAGE =
+  'passkeyStamper is not configured. Pass passkeyStamper to zeroDevWallet({ ... }) — use createReactNativePasskeyStamper({ rpId }) on React Native or createWebauthnStamper({ rpId }) on web.'
+
+/**
+ * Internal fallback used when a consumer doesn't supply a `passkeyStamper`.
+ * Methods throw on use, so passkey register/login fails with an actionable
+ * message — all other flows (apiKey signing, OAuth, OTP) are unaffected.
+ */
+export function createNoopPasskeyStamper(): PasskeyStamper {
+  return {
+    async stamp() {
+      throw new Error(NOT_CONFIGURED_MESSAGE)
+    },
+    async register() {
+      throw new Error(NOT_CONFIGURED_MESSAGE)
+    },
+    async clear() {},
+  }
+}

package/src/stampers/types.ts

@@ -5,8 +5,6 @@ export type Stamp = {
 }
 
 export type Stamper = {
-  /** retrieve public key compressed or otherwise as per the stamper */
-  getPublicKey: () => Promise<string | null>
   /** produce Turnkey header value for a given request body */
   stamp: (payload: string) => Promise<Stamp>
   /** clear local state (embedded key, IDB keypair, etc.) */
@@ -16,6 +14,8 @@ export type Stamper = {
 export type KeyFormat = 'Hexadecimal' | 'Solana'
 
 export type IframeStamper = Stamper & {
+  /** retrieve public key compressed or otherwise as per the stamper */
+  getPublicKey: () => Promise<string | null>
   init(): Promise<string>
   injectCredentialBundle(bundle: string): Promise<boolean>
   injectWalletExportBundle(
@@ -27,9 +27,43 @@ export type IframeStamper = Stamper & {
     organizationId: string,
     keyFormat?: KeyFormat,
   ): Promise<boolean>
+  applySettings(settings: { styles?: Record<string, string> }): Promise<boolean>
+}
+
+export type ApiKeyStamper = Stamper & {
+  /** retrieve public key compressed or otherwise as per the stamper */
+  getPublicKey: () => Promise<string | null>
+  /** Generate + activate a new key pair immediately (simple cases: login init, logout). */
+  resetKeyPair: () => Promise<void>
+  /** Generate a new key pair internally, return its compressed public key, but keep the OLD key active for stamp(). */
+  prepareKeyRotation: () => Promise<string>
+  /** Promote the pending key to active. Call after the server accepts the new key. */
+  commitKeyRotation: () => Promise<void>
+  /**
+   * Sign `payload` with the currently active key. Returns a hex-encoded
+   * ECDSA-P256 / SHA-256 signature in ASN.1 DER form.
+   */
+  sign: (payload: string) => Promise<string>
+}
+export type Attestation = {
+  attestationObject: string
+  clientDataJson: string
+  credentialId: string
+}
+
+export type PasskeyRegistrationOptions = {
+  rp: { id: string; name: string }
+  userName: string
+}
+
+export type PasskeyRegistrationResult = {
+  attestation: Attestation
+  encodedChallenge: string
 }
 
-export type IndexedDbStamper = Stamper & {
-  resetKeyPair: (externalKeyPair?: CryptoKeyPair) => Promise<void>
+export type PasskeyStamper = Stamper & {
+  /** Create a new passkey credential. Owns challenge and user ID generation internally. */
+  register: (
+    options: PasskeyRegistrationOptions,
+  ) => Promise<PasskeyRegistrationResult>
 }
-export type WebauthnStamper = Stamper

package/src/stampers/webauthnStamper.ts

@@ -1,21 +1,42 @@
+import { getWebAuthnAttestation } from '@turnkey/http'
 import { WebauthnStamper as TurnkeyWebauthnStamper } from '@turnkey/webauthn-stamper'
-import type { WebauthnStamper } from './types.js'
+import { base64UrlEncode, generateRandomBuffer } from '../utils/utils.js'
+import type { PasskeyRegistrationOptions, PasskeyStamper } from './types.js'
 
 export async function createWebauthnStamper({
   rpId,
 }: {
   rpId: string
-}): Promise<WebauthnStamper> {
+}): Promise<PasskeyStamper> {
   const inner = new TurnkeyWebauthnStamper({ rpId })
 
   return {
-    async getPublicKey() {
-      //   return await inner.();
-      return null
-    },
     async stamp(payload: string) {
       return await inner.stamp(payload)
     },
     async clear() {},
+    async register(options: PasskeyRegistrationOptions) {
+      const challenge = generateRandomBuffer()
+      const encodedChallenge = base64UrlEncode(challenge)
+      const authenticatorUserId = generateRandomBuffer()
+
+      const attestation = await getWebAuthnAttestation({
+        publicKey: {
+          rp: options.rp,
+          challenge,
+          pubKeyCredParams: [
+            { type: 'public-key', alg: -7 },
+            { type: 'public-key', alg: -257 },
+          ],
+          user: {
+            id: authenticatorUserId,
+            name: options.userName,
+            displayName: options.userName,
+          },
+        },
+      })
+
+      return { attestation, encodedChallenge }
+    },
   }
 }

package/src/stubs/native-on-web.ts

@@ -0,0 +1,29 @@
+// Catch-all stub used by every `./react-native/*` subpath in this package
+// under the `browser` and `node` exports conditions. Both are needed for
+// Expo web: the client bundle resolves with `browser` active, while Expo
+// Router's SSR/RSC route render drops platform conditions (no `browser`)
+// and turns on `node` instead — so the web stub has to be gated on both or
+// the SSR pass falls through to the native impl. Imports must be safe on web
+// (some route files are bundled even when they aren't rendered) so we expose
+// the RN-only symbols as throw-on-use functions instead of throwing at
+// module-init time.
+//
+// Anyone who *uses* these on web gets a clear actionable error; anyone who
+// merely imports them (typically because their universal app bundles the
+// native variant too) is unaffected.
+
+const message =
+  '@zerodev/wallet-core react-native subpaths cannot be imported in a web environment. Use the bare specifier (`import { ... } from "@zerodev/wallet-core"`) instead.'
+
+function throwOnUse(): never {
+  throw new Error(message)
+}
+
+export const createSecureStoreStamper = throwOnUse
+export const createReactNativePasskeyStamper = throwOnUse
+export const asyncStorageAdapter = throwOnUse
+
+// For the broad `./react-native` entry: any consumer reaching it on web is
+// already off-pattern (they should use the bare specifier). Default export
+// covers `import X from '...'`.
+export default throwOnUse

package/src/types/session.ts

@@ -3,7 +3,7 @@ export enum SessionType {
   READ_WRITE = 'SESSION_TYPE_READ_WRITE',
 }
 
-export type StamperType = 'iframe' | 'indexedDb' | 'passkey'
+export type StamperType = 'apiKey' | 'passkey'
 
 export type ZeroDevWalletSession = {
   id: string
@@ -11,8 +11,7 @@ export type ZeroDevWalletSession = {
   organizationId: string
   stamperType: StamperType
   sessionType?: SessionType
-  token?: string
-  publicKey?: string
+  token: string
   expiry: number
   createdAt: number
 }

package/src/utils/buildClientSignature.ts

@@ -1,4 +1,4 @@
-import type { IndexedDbStamper } from '../stampers/types.js'
+import type { ApiKeyStamper } from '../stampers/types.js'
 import { derToRawSignature } from './derToRawSignature.js'
 
 export type BuildClientSignatureParams = {
@@ -6,8 +6,8 @@ export type BuildClientSignatureParams = {
   verificationToken: string
   /** The compressed public key hex */
   publicKey: string
-  /** The IndexedDB stamper for signing */
-  stamper: IndexedDbStamper
+  /** The API key stamper for signing */
+  stamper: ApiKeyStamper
 }
 
 /**