@zerodev/wallet-core 0.0.1-alpha.9 → 0.0.1

package/src/adapters/viem.ts

@@ -1,14 +1,18 @@
 import {
+  bytesToHex,
+  concat,
+  getTypesForEIP712Domain,
   type Hex,
-  hashMessage,
+  hashTypedData,
   type LocalAccount,
+  numberToHex,
   parseSignature,
-  parseTransaction,
   type SerializeTransactionFn,
   type SignableMessage,
   serializeTransaction,
   serializeTypedData,
   type TransactionSerializable,
+  toRlp,
   zeroAddress,
 } from 'viem'
 import type {
@@ -17,20 +21,19 @@ import type {
 } from 'viem/accounts'
 import { toAccount } from 'viem/accounts'
 import { hashAuthorization } from 'viem/utils'
-import type { signRawPayload } from '../actions/index.js'
 import type { ZeroDevWalletClient } from '../client/index.js'
 
 export interface ToViemAccountParams {
   client: ZeroDevWalletClient
   organizationId: string
   projectId: string
-  token: string
+  getToken: () => string | Promise<string>
 }
 
 export async function toViemAccount(
   params: ToViemAccountParams,
 ): Promise<LocalAccount> {
-  const { client, organizationId, projectId, token } = params
+  const { client, organizationId, projectId, getToken } = params
 
   let address: Hex = zeroAddress
 
@@ -38,27 +41,12 @@ export async function toViemAccount(
     const walletResponse = await client.getUserWallet({
       organizationId,
       projectId,
-      token,
+      token: await getToken(),
     })
     address = walletResponse.walletAddresses[0]
   } catch {
     address = zeroAddress
   }
-  const signRawPayloadInternal = async (
-    payload: string,
-    encoding: Parameters<
-      typeof signRawPayload
-    >[1]['encoding'] = 'PAYLOAD_ENCODING_HEXADECIMAL',
-  ) => {
-    return await client.signRawPayload({
-      organizationId,
-      projectId,
-      token,
-      address,
-      payload,
-      encoding,
-    })
-  }
 
   // Modified from: https://github.com/tkhq/sdk/blob/4e439bf2973ea13b51d981d7c24a4841d4e5fd5f/packages/viem/src/index.ts#L419-L461
   const signTransactionInternal = async <
@@ -79,32 +67,42 @@ export async function toViemAccount(
     const signature = await client.signTransaction({
       organizationId,
       projectId,
-      token,
+      token: await getToken(),
       address,
       unsignedTransaction: nonHexPrefixedSerializedTx,
     })
 
-    if (transaction.type === 'eip4844') {
-      // Grab components of the signature
-      const { r, s, v } = parseTransaction(signature)
-
-      // Recombine with the original transaction
-      return serializeTransaction(transaction, {
-        r: r!,
-        s: s!,
-        v: v!,
-      })
-    }
-
-    return signature
+    const { r, s, v, yParity } = parseSignature(signature)
+    return serializeTransaction(transaction, { r, s, v, yParity })
   }
 
   return toAccount({
     address,
 
     async signMessage({ message }: { message: SignableMessage }): Promise<Hex> {
-      const hashedMessage = hashMessage(message)
-      return signRawPayloadInternal(hashedMessage)
+      if (typeof message === 'string') {
+        return client.signMessage({
+          organizationId,
+          projectId,
+          token: await getToken(),
+          address,
+          message,
+          encoding: 'utf8',
+        })
+      }
+      // Raw message (Hex or ByteArray)
+      const raw =
+        typeof message.raw === 'string'
+          ? message.raw.replace(/^0x/, '')
+          : bytesToHex(message.raw).slice(2)
+      return client.signMessage({
+        organizationId,
+        projectId,
+        token: await getToken(),
+        address,
+        message: raw,
+        encoding: 'hex',
+      })
     },
 
     signTransaction: async <
@@ -123,11 +121,28 @@ export async function toViemAccount(
       return signTransactionInternal(transaction, serializer)
     },
     signTypedData: async (typedData) => {
-      const serializedTypedData = serializeTypedData(typedData)
-      return signRawPayloadInternal(
-        serializedTypedData,
-        'PAYLOAD_ENCODING_EIP712',
-      )
+      const serializedTypedData = serializeTypedData({
+        ...typedData,
+        types: {
+          ...typedData.types,
+          EIP712Domain: getTypesForEIP712Domain({
+            domain: typedData.domain as Parameters<
+              typeof getTypesForEIP712Domain
+            >[0]['domain'],
+          }),
+        },
+      } as Parameters<typeof serializeTypedData>[0])
+      return client.signTypedDataV4({
+        organizationId,
+        projectId,
+        token: await getToken(),
+        address,
+        unsignedTypedDataV4: serializedTypedData,
+        encoding: 'utf8',
+        typedDataHash: hashTypedData(
+          typedData as Parameters<typeof hashTypedData>[0],
+        ).slice(2),
+      })
     },
 
     async signAuthorization(
@@ -146,7 +161,24 @@ export async function toViemAccount(
         nonce,
       })
 
-      const signature = await signRawPayloadInternal(hashedAuthorization)
+      // Serialize EIP-7702 authorization: 0x05 || RLP([chainId, address, nonce])
+      const unsignedTransaction = concat([
+        '0x05',
+        toRlp([
+          chainId ? numberToHex(chainId) : '0x',
+          authAddress,
+          nonce ? numberToHex(nonce) : '0x',
+        ]),
+      ]).slice(2)
+
+      const signature = await client.sign7702Authorization({
+        organizationId,
+        projectId,
+        token: await getToken(),
+        address,
+        unsignedTransaction,
+        hashedAuthorization: hashedAuthorization.slice(2),
+      })
 
       const parsedSignature = parseSignature(signature)
 

package/src/client/authProxy.ts

@@ -10,10 +10,11 @@ export type AuthProxyClientConfig = {
 export type AuthProxyVerifyOtpRequest = {
   /** The OTP ID from registration */
   otpId: string
-  /** The OTP code entered by the user */
-  otpCode: string
-  /** The public key to associate with the verification */
-  public_key: string
+  /**
+   * HPKE-sealed bundle containing `{otp_code, public_key}` encrypted to the
+   * enclave's per-session target key. Produced by `encryptOtpAttempt`.
+   */
+  encryptedOtpBundle: string
 }
 
 export type AuthProxyVerifyOtpResponse = {
@@ -62,15 +63,20 @@ export function createAuthProxyClient(config: AuthProxyClientConfig) {
 
   return {
     /**
-     * Verifies an OTP code with Turnkey's Auth Proxy
+     * Verifies an OTP attempt with Turnkey's Auth Proxy.
      *
-     * Returns a verificationToken that should be passed to the backend's
-     * /auth/login/otp endpoint along with a client signature.
+     * The `encryptedOtpBundle` is HPKE-sealed `{otp_code, public_key}` JSON
+     * (see `encryptOtpAttempt`). The auth proxy forwards the ciphertext to
+     * the TLS Fetcher enclave, which decrypts it, verifies the OTP code, and
+     * returns a `verificationToken` bound to the embedded public key.
+     *
+     * Pass the returned `verificationToken` to `/auth/login/otp` along with
+     * a client signature to complete the login.
      */
     async verifyOtp(
       params: AuthProxyVerifyOtpRequest,
     ): Promise<AuthProxyVerifyOtpResponse> {
-      return request<AuthProxyVerifyOtpResponse>('/v1/otp_verify', params)
+      return request<AuthProxyVerifyOtpResponse>('/v1/otp_verify_v2', params)
     },
   }
 }

package/src/client/createClient.ts

@@ -16,8 +16,8 @@ export function createBaseClient<
 >(config: ClientConfig): Client<extended> {
   const {
     transport,
-    indexedDbStamper,
-    webauthnStamper,
+    apiKeyStamper,
+    passkeyStamper,
     organizationId,
     key = 'zeroDevWallet',
     name = 'ZeroDev Wallet Client',
@@ -29,8 +29,8 @@ export function createBaseClient<
     request,
     value,
   } = transport({
-    indexedDbStamper,
-    webauthnStamper,
+    apiKeyStamper,
+    passkeyStamper,
   })
   const transportInstance = { ...transportConfig, ...value }
 
@@ -39,8 +39,8 @@ export function createBaseClient<
   const client = {
     transport: transportInstance,
     request,
-    indexedDbStamper,
-    webauthnStamper,
+    apiKeyStamper,
+    passkeyStamper,
     organizationId,
     key,
     name,

package/src/client/decorators/client.ts

@@ -10,13 +10,20 @@ import {
   type AuthenticateWithOAuthReturnType,
   authenticateWithEmail,
   authenticateWithOAuth,
-  type GetUserEmailParameters,
-  type GetUserEmailReturnType,
+  type GetAuthenticatorsParameters,
+  type GetAuthenticatorsReturnType,
+  type GetAuthProxyConfigIdReturnType,
+  type GetOAuthLoginUrlParameters,
+  type GetOAuthLoginUrlReturnType,
+  type GetParentOrgIdReturnType,
   type GetUserWalletParameters,
   type GetUserWalletReturnType,
   type GetWhoamiParameters,
   type GetWhoamiReturnType,
-  getUserEmail,
+  getAuthenticators,
+  getAuthProxyConfigId,
+  getOAuthLoginUrl,
+  getParentOrgId,
   getUserWallet,
   getWhoami,
   type LoginWithOTPParameters,
@@ -28,15 +35,22 @@ import {
   type RegisterWithPasskeyReturnType,
   registerWithOTP,
   registerWithPasskey,
-  type SignRawPayloadParameters,
-  type SignRawPayloadReturnType,
-  signRawPayload,
-} from '../../actions/index.js'
-import {
+  type Sign7702AuthorizationParameters,
+  type Sign7702AuthorizationReturnType,
+  type SignMessageParameters,
+  type SignMessageReturnType,
   type SignTransactionParameters,
   type SignTransactionReturnType,
+  type SignTypedDataV4Parameters,
+  type SignTypedDataV4ReturnType,
+  type SignUserOperationParameters,
+  type SignUserOperationReturnType,
+  sign7702Authorization,
+  signMessage,
   signTransaction,
-} from '../../actions/wallet/signTransaction.js'
+  signTypedDataV4,
+  signUserOperation,
+} from '../../actions/index.js'
 import type { Client } from '../types.js'
 
 /**
@@ -64,11 +78,12 @@ export type ZeroDevWalletActions = {
   getWhoami: (params: GetWhoamiParameters) => Promise<GetWhoamiReturnType>
 
   /**
-   * Gets the user's email address
+   * Fetches all authenticators (oauths, passkeys, emailContacts, apiKeys)
+   * for the authenticated user within the given project/sub-organization
    */
-  getUserEmail: (
-    params: GetUserEmailParameters,
-  ) => Promise<GetUserEmailReturnType>
+  getAuthenticators: (
+    params: GetAuthenticatorsParameters,
+  ) => Promise<GetAuthenticatorsReturnType>
 
   // Wallet actions
   /**
@@ -79,11 +94,9 @@ export type ZeroDevWalletActions = {
   ) => Promise<GetUserWalletReturnType>
 
   /**
-   * Signs a raw payload with the user's wallet
+   * Signs a message with the user's wallet
    */
-  signRawPayload: (
-    params: SignRawPayloadParameters,
-  ) => Promise<SignRawPayloadReturnType>
+  signMessage: (params: SignMessageParameters) => Promise<SignMessageReturnType>
 
   /**
    * Signs a transaction with the user's wallet
@@ -92,6 +105,27 @@ export type ZeroDevWalletActions = {
     params: SignTransactionParameters,
   ) => Promise<SignTransactionReturnType>
 
+  /**
+   * Signs EIP-712 typed data with the user's wallet
+   */
+  signTypedDataV4: (
+    params: SignTypedDataV4Parameters,
+  ) => Promise<SignTypedDataV4ReturnType>
+
+  /**
+   * Signs a user operation with the user's wallet
+   */
+  signUserOperation: (
+    params: SignUserOperationParameters,
+  ) => Promise<SignUserOperationReturnType>
+
+  /**
+   * Signs an EIP-7702 authorization with the user's wallet
+   */
+  sign7702Authorization: (
+    params: Sign7702AuthorizationParameters,
+  ) => Promise<Sign7702AuthorizationReturnType>
+
   /**
    * Registers a passkey with the user's wallet
    */
@@ -119,6 +153,25 @@ export type ZeroDevWalletActions = {
   loginWithOTP: (
     params: LoginWithOTPParameters,
   ) => Promise<LoginWithOTPReturnType>
+
+  /**
+   * Gets the auth proxy config ID from the backend
+   */
+  getAuthProxyConfigId: () => Promise<GetAuthProxyConfigIdReturnType>
+
+  /**
+   * Gets the Turnkey parent (base) organization ID from the backend
+   */
+  getParentOrgId: () => Promise<GetParentOrgIdReturnType>
+
+  /**
+   * Fetches the Google OAuth authorization URL from the backend.
+   * The caller must verify the URL's `nonce` against `sha256(utf8(publicKey))`
+   * before opening it (audit finding TOB-KMS-1).
+   */
+  getOAuthLoginUrl: (
+    params: GetOAuthLoginUrlParameters,
+  ) => Promise<GetOAuthLoginUrlReturnType>
 }
 
 /**
@@ -149,15 +202,21 @@ export function zeroDevWalletActions(client: Client): ZeroDevWalletActions {
     authenticateWithEmail: (params) => authenticateWithEmail(client, params),
     authenticateWithOAuth: (params) => authenticateWithOAuth(client, params),
     getWhoami: (params) => getWhoami(client, params),
-    getUserEmail: (params) => getUserEmail(client, params),
+    getAuthenticators: (params) => getAuthenticators(client, params),
 
     // Wallet actions
     getUserWallet: (params) => getUserWallet(client, params),
-    signRawPayload: (params) => signRawPayload(client, params),
+    signMessage: (params) => signMessage(client, params),
     signTransaction: (params) => signTransaction(client, params),
+    signTypedDataV4: (params) => signTypedDataV4(client, params),
+    signUserOperation: (params) => signUserOperation(client, params),
+    sign7702Authorization: (params) => sign7702Authorization(client, params),
     registerWithPasskey: (params) => registerWithPasskey(client, params),
     loginWithStamp: (params) => loginWithStamp(client, params),
     registerWithOTP: (params) => registerWithOTP(client, params),
     loginWithOTP: (params) => loginWithOTP(client, params),
+    getAuthProxyConfigId: () => getAuthProxyConfigId(client),
+    getParentOrgId: () => getParentOrgId(client),
+    getOAuthLoginUrl: (params) => getOAuthLoginUrl(client, params),
   }
 }

package/src/client/index.ts

@@ -10,7 +10,10 @@ export {
   createClient,
   type ZeroDevWalletClient,
 } from './createClient.js'
-export { zeroDevWalletTransport } from './transports/createTransport.js'
+export {
+  type CreateTransportOptions,
+  zeroDevWalletTransport,
+} from './transports/createTransport.js'
 export type {
   Client,
   ClientConfig,

package/src/client/transports/createTransport.ts

@@ -10,6 +10,8 @@ export type CreateTransportOptions = {
   key?: string
   /** Transport name */
   name?: string
+  /** Extra options merged into every fetch() call */
+  fetchOptions?: Omit<RequestInit, 'body' | 'method' | 'signal'>
 }
 
 /**
@@ -26,14 +28,15 @@ export function zeroDevWalletTransport(
     name = 'ZeroDev Wallet Transport',
   } = options
 
-  return ({ indexedDbStamper, webauthnStamper }) => {
+  return ({ apiKeyStamper, passkeyStamper }) => {
     // Create REST transport with stamper
     const transport = rest(baseUrl, {
       timeoutMs,
       key,
       name,
-      indexedDbStamper,
-      webauthnStamper,
+      apiKeyStamper,
+      passkeyStamper,
+      ...(options.fetchOptions && { fetchOptions: options.fetchOptions }),
     })
 
     return {
@@ -46,8 +49,8 @@ export function zeroDevWalletTransport(
       },
       request: transport.request,
       value: {
-        indexedDbStamper,
-        webauthnStamper,
+        apiKeyStamper,
+        passkeyStamper,
       },
     }
   }

package/src/client/transports/rest.ts

@@ -1,6 +1,7 @@
 import { canonicalizeEx } from 'json-canonicalize'
 import { RestRequestError, RestTimeoutError } from '../../errors/request.js'
-import type { IndexedDbStamper, WebauthnStamper } from '../../stampers/types.js'
+import type { ApiKeyStamper, PasskeyStamper } from '../../stampers/types.js'
+import type { StamperType } from '../../types/session.js'
 
 export type RestRequestArgs = {
   path: string
@@ -8,8 +9,15 @@ export type RestRequestArgs = {
   body?: any
   headers?: Record<string, string>
   stamp?: boolean
-  stampWith?: 'indexedDb' | 'webAuthn'
-  stampPostion?: 'body' | 'headers'
+  stampWith?: StamperType
+  /**
+   * Where the stamp goes / what it signs:
+   * - `body`/`headers`: sign the canonicalized request body (POST endpoints).
+   * - `timestamp`: GET endpoints behind StampCheckUser — sign the current
+   *   unix-millis string, send it as the `X-Timestamp` header plus the stamp
+   *   header. No request body. Matches the backend's `FormatTimestamp`.
+   */
+  stampPostion?: 'body' | 'headers' | 'timestamp'
   /** Include credentials (cookies) in the request */
   credentials?: RequestCredentials
 }
@@ -32,8 +40,8 @@ export type RestTransportConfig = {
   timeoutMs?: number
   key?: string
   name?: string
-  indexedDbStamper: IndexedDbStamper
-  webauthnStamper: WebauthnStamper
+  apiKeyStamper: ApiKeyStamper
+  passkeyStamper: PasskeyStamper
 }
 
 export function rest(url: string, cfg: RestTransportConfig): RestTransport {
@@ -48,48 +56,63 @@ export function rest(url: string, cfg: RestTransportConfig): RestTransport {
 
     try {
       let requestBody = args.body
-      let requestHeaders = {
-        'content-type': 'application/json',
+      let requestHeaders: Record<string, string> = {
+        ...((cfg.fetchOptions?.headers as Record<string, string>) ?? {}),
         ...(args.headers ?? {}),
-        ...(cfg.fetchOptions?.headers ?? {}),
+        'content-type': 'application/json',
       }
 
       // Handle stamping if requested
       if (args.stamp) {
-        let stamper: IndexedDbStamper | WebauthnStamper
-        if (args.stampWith === 'indexedDb') {
-          stamper = cfg.indexedDbStamper
-        } else if (args.stampWith === 'webAuthn') {
-          stamper = cfg.webauthnStamper
+        let stamper: ApiKeyStamper | PasskeyStamper
+        if (args.stampWith === 'apiKey') {
+          stamper = cfg.apiKeyStamper
+        } else if (args.stampWith === 'passkey') {
+          stamper = cfg.passkeyStamper
         } else {
-          stamper = cfg.indexedDbStamper
+          stamper = cfg.apiKeyStamper
         }
-        const { body, apiUrl } = args.body
-        const bodyString = canonicalizeEx(body ?? args.body)
-        const stamp = await stamper.stamp(bodyString)
 
-        // Restructure request body to match backend expectation
-        if (args.stampPostion === 'headers') {
+        // Timestamped stamp for GET endpoints behind StampCheckUser: the
+        // signed body is the unix-millis string itself (the backend rebuilds
+        // it from the X-Timestamp header via FormatTimestamp). No request body.
+        if (args.stampPostion === 'timestamp') {
+          const ts = Date.now().toString()
+          const stamp = await stamper.stamp(ts)
           requestHeaders = {
             ...requestHeaders,
+            'X-Timestamp': ts,
             [stamp.stampHeaderName]: stamp.stampHeaderValue,
           }
-        } else if (body) {
-          requestBody = {
-            body: bodyString,
-            stamp: {
-              stampHeaderName: stamp.stampHeaderName,
-              stampHeaderValue: stamp.stampHeaderValue,
-            },
-            apiUrl: apiUrl,
-          }
+          requestBody = undefined
         } else {
-          requestBody = {
-            ...args.body,
-            stamp: {
-              stampHeaderName: stamp.stampHeaderName,
-              stampHeaderValue: stamp.stampHeaderValue,
-            },
+          const { body, apiUrl } = args.body
+          const bodyString = canonicalizeEx(body ?? args.body)
+          const stamp = await stamper.stamp(bodyString)
+
+          // Restructure request body to match backend expectation
+          if (args.stampPostion === 'headers') {
+            requestHeaders = {
+              ...requestHeaders,
+              [stamp.stampHeaderName]: stamp.stampHeaderValue,
+            }
+          } else if (body) {
+            requestBody = {
+              body: bodyString,
+              stamp: {
+                stampHeaderName: stamp.stampHeaderName,
+                stampHeaderValue: stamp.stampHeaderValue,
+              },
+              apiUrl: apiUrl,
+            }
+          } else {
+            requestBody = {
+              ...args.body,
+              stamp: {
+                stampHeaderName: stamp.stampHeaderName,
+                stampHeaderValue: stamp.stampHeaderValue,
+              },
+            }
           }
         }
       }

package/src/client/types.ts

@@ -1,4 +1,4 @@
-import type { IndexedDbStamper, WebauthnStamper } from '../stampers/types.js'
+import type { ApiKeyStamper, PasskeyStamper } from '../stampers/types.js'
 import type { RestRequestFn } from './transports/rest.js'
 
 export type TransportConfig = {
@@ -17,8 +17,8 @@ export type TransportConfig = {
 }
 
 export type Transport = (options: {
-  indexedDbStamper: IndexedDbStamper
-  webauthnStamper: WebauthnStamper
+  apiKeyStamper: ApiKeyStamper
+  passkeyStamper: PasskeyStamper
 }) => {
   config: TransportConfig
   request: RestRequestFn
@@ -27,8 +27,8 @@ export type Transport = (options: {
 
 export type ClientConfig = {
   transport: Transport
-  indexedDbStamper: IndexedDbStamper
-  webauthnStamper: WebauthnStamper
+  apiKeyStamper: ApiKeyStamper
+  passkeyStamper: PasskeyStamper
   organizationId?: string
   key?: string
   name?: string
@@ -39,10 +39,10 @@ export type Client<extended extends Extended | undefined = undefined> = {
   transport: TransportConfig & Record<string, unknown>
   /** Request function from transport */
   request: RestRequestFn
-  /** IndexedDB Stamper for authenticated requests */
-  indexedDbStamper: IndexedDbStamper
-  /** WebAuthn Stamper for authenticated requests */
-  webauthnStamper: WebauthnStamper
+  /** API Key Stamper for authenticated requests */
+  apiKeyStamper: ApiKeyStamper
+  /** Passkey Stamper for authenticated requests */
+  passkeyStamper: PasskeyStamper
   /** Organization ID */
   organizationId?: string
   /** A key for the client */

package/src/constants.ts

@@ -1,7 +1,15 @@
 export const DEFAULT_SESSION_EXPIRATION_IN_SECONDS = '900' // default to 15 minutes
 export const DEFAULT_IFRAME_CONTAINER_ID = 'turnkey-auth-iframe-container-id'
 export const DEFAULT_IFRAME_ELEMENT_ID = 'turnkey-default-iframe-element-id'
-export const DEFAULT_ORGANIZATION_ID = '6254bb1d-0d0d-4f7e-96b8-77c94fe0b0c1'
-export const DEFAULT_AUTH_PROXY_CONFIG_ID =
-  'f69f6246-a814-43c6-90e6-2a8d947853d3'
-export const KMS_SERVER_URL = 'https://kms.dev.zerodev.app'
+// Prod parent organization id. Only a fallback — the SDK resolves the parent
+// org at runtime from the KMS `server-info/parent-org-id` endpoint.
+export const DEFAULT_ORGANIZATION_ID = '65028f18-01c6-4ed4-beff-2ed1be5d6bad'
+export const KMS_SERVER_URL = 'https://kms.zerodev.app'
+
+// Pinned ECDSA P-256 public key (uncompressed, 65 bytes hex) of Turnkey's
+// TLS Fetcher Sign enclave. Used to verify the signature on the OTP encryption
+// target bundle returned by /auth/init/otp before HPKE-encrypting the OTP
+// attempt. The bundle's `dataSignature` is verified against this key, so a
+// compromised proxy cannot substitute its own ephemeral key.
+export const TURNKEY_TLS_FETCHER_SIGN_PUBLIC_KEY =
+  '046b4f88421f76b6ba418afc2ea1d8ced671337d7db6b80478a60d8531bf8f17fa9a512f0fef96fc0c9b4cd9dff70b34992e520ce04c79d931f6ff6296b547d201'