@zerodev/wallet-core 0.0.1-alpha.9 → 0.0.1

package/src/core/{createZeroDevWallet.ts → createZeroDevWalletCore.ts}

@@ -1,45 +1,39 @@
-import { getWebAuthnAttestation } from '@turnkey/http'
 import type { LocalAccount } from 'viem/accounts'
-import type { EmailCustomization } from '../actions/auth/index.js'
 import { toViemAccount } from '../adapters/viem.js'
 import {
+  type CreateTransportOptions,
   createAuthProxyClient,
   createClient,
   type ZeroDevWalletClient,
   zeroDevWalletTransport,
 } from '../client/index.js'
 import {
-  DEFAULT_AUTH_PROXY_CONFIG_ID,
   DEFAULT_ORGANIZATION_ID,
   DEFAULT_SESSION_EXPIRATION_IN_SECONDS,
   KMS_SERVER_URL,
 } from '../constants.js'
-import { createIndexedDbStamper } from '../stampers/indexedDbStamper.js'
-import { createWebauthnStamper } from '../stampers/webauthnStamper.js'
-import { createWebStorageAdapter } from '../storage/adapters.js'
+import { createNoopPasskeyStamper } from '../stampers/noopPasskeyStamper.js'
+import type { ApiKeyStamper, PasskeyStamper } from '../stampers/types.js'
 import {
   createStorageManager,
   type StorageAdapter,
 } from '../storage/manager.js'
 import { SessionType, type ZeroDevWalletSession } from '../types/session.js'
 import { buildClientSignature } from '../utils/buildClientSignature.js'
-import {
-  base64UrlEncode,
-  generateCompressedPublicKeyFromKeyPair,
-  generateRandomBuffer,
-  humanReadableDateTime,
-  parseSession,
-} from '../utils/utils.js'
-export interface ZeroDevWalletConfig {
+import { encryptOtpAttempt } from '../utils/encryptOtpAttempt.js'
+import { createOrganizationIdResolver } from '../utils/resolveOrganizationId.js'
+import { humanReadableDateTime, parseSession } from '../utils/utils.js'
+export interface ZeroDevWalletConfigCore {
   organizationId?: string
   proxyBaseUrl?: string
   projectId: string
-  sessionStorage?: StorageAdapter
-  rpId?: string
+  sessionStorage: StorageAdapter
+  rpId: string
+  apiKeyStamper: ApiKeyStamper
+  passkeyStamper?: PasskeyStamper
+  fetchOptions?: CreateTransportOptions['fetchOptions']
 }
 
-// Re-export EmailCustomization for convenience
-export type { EmailCustomization } from '../actions/auth/index.js'
 export type { StorageAdapter, StorageManager } from '../storage/manager.js'
 // Re-export new session types
 export type { StamperType, ZeroDevWalletSession } from '../types/session.js'
@@ -48,10 +42,10 @@ export type AuthParams =
   | {
       type: 'oauth'
       provider: string
+      sessionId: string
     }
   | {
       type: 'passkey'
-      email: string
       mode: 'register' | 'login'
     }
   | {
@@ -62,13 +56,33 @@ export type AuthParams =
         type: 'email' | 'sms'
         contact: string
       }
-      emailCustomization?: EmailCustomization
     }
   | {
       type: 'otp'
       mode: 'verifyOtp'
       otpId: string
       otpCode: string
+      /**
+       * The encryption target bundle returned by the matching `sendOtp` call.
+       * Required — used to HPKE-encrypt the OTP attempt to the enclave.
+       */
+      otpEncryptionTargetBundle: string
+    }
+  | {
+      type: 'magicLink'
+      mode: 'send'
+      email: string
+    }
+  | {
+      type: 'magicLink'
+      mode: 'verify'
+      otpId: string
+      code: string
+      /**
+       * The encryption target bundle returned by the matching `sendMagicLink`
+       * (a.k.a. magicLink `send`) call. Required for the encrypted-OTP flow.
+       */
+      otpEncryptionTargetBundle: string
     }
 
 export interface ZeroDevWalletSDK {
@@ -93,37 +107,41 @@ export interface ZeroDevWalletSDK {
   toAccount: () => Promise<LocalAccount>
 }
 
-export async function createZeroDevWallet(
-  config: ZeroDevWalletConfig,
+export async function createZeroDevWalletCore(
+  config: ZeroDevWalletConfigCore,
 ): Promise<ZeroDevWalletSDK> {
-  const {
-    projectId,
-    sessionStorage,
-    rpId = window.location.hostname,
-    organizationId = DEFAULT_ORGANIZATION_ID,
-  } = config
-
-  const sessionStorageManager = createStorageManager(
-    sessionStorage || createWebStorageAdapter(),
-  )
-
-  const indexedDbStamper = await createIndexedDbStamper()
+  const { projectId, sessionStorage, rpId, apiKeyStamper, organizationId } =
+    config
+  const passkeyStamper = config.passkeyStamper ?? createNoopPasskeyStamper()
 
-  const webauthnStamper = await createWebauthnStamper({ rpId })
+  const sessionStorageManager = createStorageManager(sessionStorage)
 
   const client = createClient({
-    indexedDbStamper,
-    webauthnStamper,
+    apiKeyStamper,
+    passkeyStamper,
     transport: zeroDevWalletTransport({
       baseUrl: config.proxyBaseUrl || `${KMS_SERVER_URL}/api/v1`,
+      ...(config.fetchOptions && { fetchOptions: config.fetchOptions }),
     }),
   })
 
+  let cachedAuthProxyConfigId: string | undefined
+
+  // Resolve the Turnkey parent org that stamp-login is signed against: explicit
+  // override → backend fetch (/server-info/parent-org-id, cached) → hardcoded
+  // fallback if the endpoint is unavailable (older backends). This is why the
+  // org no longer needs to be hardcoded/overridden per environment.
+  const resolveOrganizationId = createOrganizationIdResolver({
+    organizationId,
+    fetchParentOrgId: async () => (await client.getParentOrgId()).parentOrgId,
+    fallback: DEFAULT_ORGANIZATION_ID,
+  })
+
   return {
     client,
     async getPublicKey() {
-      await client.indexedDbStamper.resetKeyPair()
-      const compressedPublicKey = await client.indexedDbStamper.getPublicKey()
+      await client.apiKeyStamper.resetKeyPair()
+      const compressedPublicKey = await client.apiKeyStamper.getPublicKey()
       return compressedPublicKey
     },
 
@@ -162,30 +180,26 @@ export async function createZeroDevWallet(
       if (!activeSession) {
         throw new Error('No active session')
       }
-      if (activeSession.stamperType === 'indexedDb') {
-        const newKeyPair = await crypto.subtle.generateKey(
-          {
-            name: 'ECDSA',
-            namedCurve: 'P-256',
-          },
-          false,
-          ['sign', 'verify'],
-        )
+      if (activeSession.stamperType === 'apiKey') {
         const compressedPublicKeyHex =
-          await generateCompressedPublicKeyFromKeyPair(newKeyPair)
+          await client.apiKeyStamper.prepareKeyRotation()
         const data = await client.loginWithStamp({
           targetPublicKey: compressedPublicKeyHex,
           projectId,
-          organizationId: activeSession.organizationId,
-          stampWith: 'indexedDb',
+          // Stamp-login is signed against the Turnkey parent org; the backend
+          // resolves the sub-org from the stamped credential. Signing the
+          // sub-org here makes the relayed payload's org mismatch the
+          // signature → Turnkey SIGNATURE_INVALID.
+          organizationId: await resolveOrganizationId(),
+          stampWith: 'apiKey',
         })
-        await client.indexedDbStamper.resetKeyPair(newKeyPair)
+        await client.apiKeyStamper.commitKeyRotation()
         const parsedSession = parseSession(data.session)
         const session: ZeroDevWalletSession = {
           id: `session_indexedDb_${Date.now()}`,
           userId: parsedSession.userId,
           organizationId: parsedSession.organizationId,
-          stamperType: 'indexedDb',
+          stamperType: 'apiKey',
           sessionType: SessionType.READ_WRITE,
           token: data.session,
           expiry: parsedSession.expiry,
@@ -202,27 +216,26 @@ export async function createZeroDevWallet(
     async auth(params: AuthParams) {
       switch (params.type) {
         case 'oauth': {
-          // Backend OAuth flow - the backend reads the OAuth session from a cookie
-          // set during the OAuth popup flow via /oauth/google/login
+          const popSignature = await client.apiKeyStamper.sign(params.sessionId)
           const data = await client.authenticateWithOAuth({
             provider: params.provider,
             projectId,
+            sessionId: params.sessionId,
+            popSignature,
           })
 
           if (data.session) {
             // Parse the JWT to get session data
             const parsedSession = parseSession(data.session)
-            const publicKey = await client.indexedDbStamper.getPublicKey()
             const session: ZeroDevWalletSession = {
               id: `session_oauth_${Date.now()}`,
               userId: parsedSession.userId,
               organizationId: parsedSession.organizationId,
-              stamperType: 'indexedDb',
+              stamperType: 'apiKey',
               sessionType: parsedSession.sessionType || SessionType.READ_WRITE,
               token: data.session,
               expiry: parsedSession.expiry,
               createdAt: Date.now(),
-              publicKey: publicKey || '',
             }
             await sessionStorageManager.storeSession(session, session.id)
           }
@@ -235,64 +248,37 @@ export async function createZeroDevWallet(
             'mode' in params &&
             params.mode === 'register'
           ) {
-            const { email } = params
-            await client.indexedDbStamper.resetKeyPair()
-            const tempPublicKey = await client.indexedDbStamper.getPublicKey()
+            await client.apiKeyStamper.resetKeyPair()
+            const tempPublicKey = await client.apiKeyStamper.getPublicKey()
             if (!tempPublicKey) {
               throw new Error('Failed to get public key')
             }
-            const challenge = generateRandomBuffer()
-            const encodedChallenge = base64UrlEncode(challenge)
-            const authenticatorUserId = generateRandomBuffer()
-            const name = `ZeroDevWallet-${humanReadableDateTime()}-${email}`
-            const attestation = await getWebAuthnAttestation({
-              publicKey: {
+            const name = `ZeroDevWallet-${humanReadableDateTime()}`
+            const { attestation, encodedChallenge } =
+              await passkeyStamper.register({
                 rp: { id: rpId, name: '' },
-                challenge,
-                pubKeyCredParams: [
-                  {
-                    type: 'public-key',
-                    alg: -7,
-                  },
-                  {
-                    type: 'public-key',
-                    alg: -257,
-                  },
-                ],
-                user: {
-                  id: authenticatorUserId,
-                  name,
-                  displayName: name,
-                },
-              },
-            })
+                userName: name,
+              })
             const data = await client.registerWithPasskey({
-              email,
               attestation,
               challenge: encodedChallenge,
               projectId,
               encodedPublicKey: tempPublicKey,
             })
-            const newKeyPair = await crypto.subtle.generateKey(
-              {
-                name: 'ECDSA',
-                namedCurve: 'P-256',
-              },
-              false,
-              ['sign', 'verify'],
-            )
             const compressedPublicKeyHex =
-              await generateCompressedPublicKeyFromKeyPair(newKeyPair)
+              await client.apiKeyStamper.prepareKeyRotation()
             const loginData = await client.loginWithStamp({
               projectId,
               targetPublicKey: compressedPublicKeyHex,
-              organizationId: data.subOrganizationId,
+              // Sign against the parent org (see refreshSession note) — the
+              // backend derives the sub-org from the stamped credential.
+              organizationId: await resolveOrganizationId(),
             })
-            await client.indexedDbStamper.resetKeyPair(newKeyPair)
+            await client.apiKeyStamper.commitKeyRotation()
             const parsedSession = parseSession(loginData.session)
             const session: ZeroDevWalletSession = {
               id: `session_indexedDb_${Date.now()}`,
-              stamperType: 'indexedDb',
+              stamperType: 'apiKey',
               createdAt: Date.now(),
               sessionType: SessionType.READ_WRITE,
               userId: parsedSession.userId,
@@ -310,22 +296,24 @@ export async function createZeroDevWallet(
             'mode' in params &&
             params.mode === 'login'
           ) {
-            await client.indexedDbStamper.resetKeyPair()
-            const generatedPublicKey =
-              await client.indexedDbStamper.getPublicKey()
+            await client.apiKeyStamper.resetKeyPair()
+            const generatedPublicKey = await client.apiKeyStamper.getPublicKey()
             if (!generatedPublicKey) {
               throw new Error('Failed to get public key')
             }
             const loginData = await client.loginWithStamp({
               targetPublicKey: generatedPublicKey,
               projectId,
-              organizationId,
-              stampWith: 'webauthn',
+              // Sign against the parent org, not the user's sub-org (see the
+              // refreshSession note). The backend derives the sub-org from the
+              // stamped passkey credential.
+              organizationId: await resolveOrganizationId(),
+              stampWith: 'passkey',
             })
             const parsedSession = parseSession(loginData.session)
             const session: ZeroDevWalletSession = {
               id: `session_indexedDb_${Date.now()}`,
-              stamperType: 'indexedDb',
+              stamperType: 'apiKey',
               createdAt: Date.now(),
               sessionType: SessionType.READ_WRITE,
               userId: parsedSession.userId,
@@ -340,49 +328,84 @@ export async function createZeroDevWallet(
           }
           throw new Error('Passkey authentication requires passkey parameter')
         }
-        case 'otp': {
-          const { type, mode } = params
+        case 'otp':
+        case 'magicLink': {
+          // Normalize magicLink params into OTP params
+          let otpParams: Extract<AuthParams, { type: 'otp' }>
+          if (params.type === 'magicLink') {
+            if (params.mode === 'send') {
+              // Magic-link vs plain-OTP delivery and the link URL template are
+              // configured per-project on the backend (`wallet.otp_configs`);
+              // the client just initiates OTP and the backend decides.
+              otpParams = {
+                type: 'otp',
+                mode: 'sendOtp',
+                email: params.email,
+                contact: { type: 'email', contact: params.email },
+              }
+            } else {
+              otpParams = {
+                type: 'otp',
+                mode: 'verifyOtp',
+                otpId: params.otpId,
+                otpCode: params.code,
+                otpEncryptionTargetBundle: params.otpEncryptionTargetBundle,
+              }
+            }
+          } else {
+            otpParams = params
+          }
 
-          if (type === 'otp' && mode === 'sendOtp') {
-            const { email, contact, emailCustomization } = params
+          if (otpParams.mode === 'sendOtp') {
+            const { email, contact } = otpParams
 
             const data = await client.registerWithOTP({
               email,
               contact,
               projectId,
-              ...(emailCustomization && { emailCustomization }),
             })
 
             return data
           }
 
-          if (type === 'otp' && mode === 'verifyOtp') {
-            const { otpId, otpCode } = params
+          if (otpParams.mode === 'verifyOtp') {
+            const { otpId, otpCode, otpEncryptionTargetBundle } = otpParams
 
             // Step 1: Generate new key pair
-            await client.indexedDbStamper.resetKeyPair()
-            const targetPublicKey = await client.indexedDbStamper.getPublicKey()
+            await client.apiKeyStamper.resetKeyPair()
+            const targetPublicKey = await client.apiKeyStamper.getPublicKey()
 
             if (!targetPublicKey) {
               throw new Error('Failed to get public key')
             }
 
-            // Step 2: Verify OTP via Auth Proxy
+            // Step 2a: HPKE-seal the OTP attempt to the enclave's per-session
+            // target key. The auth proxy never sees the plaintext OTP code.
+            const encryptedOtpBundle = await encryptOtpAttempt({
+              otpCode,
+              publicKey: targetPublicKey,
+              encryptionTargetBundle: otpEncryptionTargetBundle,
+            })
+
+            // Step 2b: Verify OTP via Auth Proxy
+            if (!cachedAuthProxyConfigId) {
+              const { authProxyConfigId } = await client.getAuthProxyConfigId()
+              cachedAuthProxyConfigId = authProxyConfigId
+            }
             const authProxyClient = createAuthProxyClient({
-              authProxyConfigId: DEFAULT_AUTH_PROXY_CONFIG_ID,
+              authProxyConfigId: cachedAuthProxyConfigId,
             })
 
             const { verificationToken } = await authProxyClient.verifyOtp({
               otpId,
-              otpCode,
-              public_key: targetPublicKey,
+              encryptedOtpBundle,
             })
 
             // Step 3: Build client signature
             const clientSignature = await buildClientSignature({
               verificationToken,
               publicKey: targetPublicKey,
-              stamper: client.indexedDbStamper,
+              stamper: client.apiKeyStamper,
             })
 
             // Step 4: Login via backend (not Auth Proxy!)
@@ -399,13 +422,12 @@ export async function createZeroDevWallet(
                 id: `session_otp_${Date.now()}`,
                 userId: parsedSession.userId,
                 organizationId: parsedSession.organizationId,
-                stamperType: 'indexedDb',
+                stamperType: 'apiKey',
                 sessionType:
                   parsedSession.sessionType || SessionType.READ_WRITE,
                 token: data.session,
                 expiry: parsedSession.expiry,
                 createdAt: Date.now(),
-                publicKey: targetPublicKey,
               }
               await sessionStorageManager.storeSession(session, session.id)
             }
@@ -421,7 +443,7 @@ export async function createZeroDevWallet(
 
     async logout() {
       await sessionStorageManager.clearAllSessions()
-      await client.indexedDbStamper.resetKeyPair()
+      await client.apiKeyStamper.resetKeyPair()
       return true
     },
 
@@ -435,7 +457,10 @@ export async function createZeroDevWallet(
         client,
         organizationId: session.organizationId,
         projectId,
-        token: session.token ?? '',
+        getToken: async () => {
+          const activeSession = await sessionStorageManager.getActiveSession()
+          return activeSession?.token ?? ''
+        },
       })
     },
   }

package/src/index.native.ts

@@ -0,0 +1,102 @@
+import { isReactNative } from './utils/platform.js'
+
+if (!isReactNative()) {
+  // biome-ignore lint/suspicious/noConsole: Warning users if they try to use the web entry on React Native.
+  console.warn(
+    '@zerodev/wallet-core/react-native: the React Native entry was loaded outside a React Native runtime. If this is a non-RN context, import `@zerodev/wallet-core` (the bare specifier) instead.',
+  )
+}
+
+// Re-export shared API surface. Note: we intentionally do NOT re-export the
+// web stamper factories (createIndexedDbStamper, createWebauthnStamper,
+// createIframeStamper) here — they're web-only. The native adapter factories
+// live behind their own granular subpaths so consumers using alternative
+// adapters (Keychain, MMKV, custom) skip the unused peer-dep installs.
+export type {
+  ApiKeyAuthenticator,
+  AuthenticateWithEmailParameters,
+  AuthenticateWithEmailReturnType,
+  AuthenticateWithOAuthParameters,
+  AuthenticateWithOAuthReturnType,
+  EmailContact,
+  GetAuthenticatorsParameters,
+  GetAuthenticatorsReturnType,
+  GetUserWalletParameters,
+  GetUserWalletReturnType,
+  GetWhoamiParameters,
+  GetWhoamiReturnType,
+  LoginWithOTPParameters,
+  LoginWithOTPReturnType,
+  OAuthAuthenticator,
+  OtpContact,
+  PasskeyAuthenticator,
+  RegisterWithOTPParameters,
+  RegisterWithOTPReturnType,
+  Sign7702AuthorizationParameters,
+  Sign7702AuthorizationReturnType,
+  SignMessageParameters,
+  SignMessageReturnType,
+  SignTransactionParameters,
+  SignTransactionReturnType,
+  SignTypedDataV4Parameters,
+  SignTypedDataV4ReturnType,
+  SignUserOperationParameters,
+  SignUserOperationReturnType,
+} from './actions/index.js'
+export {
+  authenticateWithEmail,
+  authenticateWithOAuth,
+  getAuthenticators,
+  getUserWallet,
+  getWhoami,
+  loginWithOTP,
+  registerWithOTP,
+  sign7702Authorization,
+  signMessage,
+  signTransaction,
+  signTypedDataV4,
+  signUserOperation,
+} from './actions/index.js'
+export type { ToViemAccountParams } from './adapters/viem.js'
+export { toViemAccount } from './adapters/viem.js'
+export type { ZeroDevWalletActions } from './client/decorators/client.js'
+export { zeroDevWalletActions } from './client/decorators/client.js'
+export type {
+  Client,
+  ClientConfig,
+  CreateTransportOptions,
+  Transport,
+} from './client/index.js'
+export {
+  createBaseClient,
+  createClient,
+  type ZeroDevWalletClient,
+  zeroDevWalletTransport,
+} from './client/index.js'
+export { KMS_SERVER_URL } from './constants.js'
+export type {
+  AuthParams,
+  ZeroDevWalletSDK,
+} from './core/createZeroDevWalletCore.js'
+// RN entry re-exports through a thin wrapper that auto-injects the
+// `Origin: https://${rpId}` header on Turnkey requests. `ZeroDevWalletConfig`
+// matches the strict `ZeroDevWalletConfigCore` shape, so RN consumers still
+// get compile-time enforcement of the four required adapter fields.
+export {
+  createZeroDevWallet,
+  type ZeroDevWalletConfig,
+} from './native/createZeroDevWallet.js'
+export type {
+  ApiKeyStamper,
+  Attestation,
+  IframeStamper,
+  PasskeyRegistrationOptions,
+  PasskeyRegistrationResult,
+  PasskeyStamper,
+} from './stampers/types.js'
+export type { StorageAdapter, StorageManager } from './storage/manager.js'
+export type { StamperType, ZeroDevWalletSession } from './types/session.js'
+export type { KeyFormat } from './utils/exportPrivateKey.js'
+export { exportPrivateKey } from './utils/exportPrivateKey.js'
+export { exportWallet } from './utils/exportWallet.js'
+export { normalizeTimestamp } from './utils/utils.js'