@zerodev/wallet-core 0.0.1-alpha.9 → 0.0.1

package/src/utils/encryptOtpAttempt.ts

@@ -0,0 +1,142 @@
+/**
+ * Wraps the OTP code + client public key in a Turnkey-compatible HPKE bundle
+ * for the `/v1/otp_verify_v2` auth-proxy endpoint.
+ *
+ * Bundle flow (RFC 9180 mode_base over Turnkey's TLS Fetcher enclave):
+ *   1. The backend's /init/otp returns a signed envelope that contains an
+ *      ephemeral HPKE public key (`targetPublic`) generated fresh by the
+ *      enclave for this OTP attempt.
+ *   2. We verify the envelope's ECDSA signature against a pinned production
+ *      key (`TURNKEY_TLS_FETCHER_SIGN_PUBLIC_KEY`) so a compromised proxy
+ *      cannot substitute its own ephemeral key.
+ *   3. We HPKE-seal `{otp_code, public_key}` to `targetPublic`. The auth proxy
+ *      forwards the ciphertext to the enclave; only the enclave can decrypt
+ *      it. The enclave then issues a `verificationToken` bound to the public
+ *      key embedded in the plaintext.
+ *
+ * See: tkhq/go-sdk `examples/email_otp` and `pkg/enclave_encrypt`.
+ */
+
+import { p256 } from '@noble/curves/nist.js'
+import { bytesToHex, hexToBytes } from '@noble/hashes/utils.js'
+import { TURNKEY_TLS_FETCHER_SIGN_PUBLIC_KEY } from '../constants.js'
+import { hpkeSealP256 } from './hpke.js'
+
+const BUNDLE_DATA_VERSION = 'v1.0.0'
+
+type EncryptionTargetEnvelope = {
+  version: string
+  /** Hex-encoded JSON: `{ targetPublic, organizationId, userId? }` */
+  data: string
+  /** Hex-encoded ECDSA-P256 signature over the raw `data` bytes (DER). */
+  dataSignature: string
+  /** Hex-encoded uncompressed P-256 pubkey of the signing enclave. */
+  enclaveQuorumPublic: string
+}
+
+type SignedTargetData = {
+  targetPublic: string
+  organizationId?: string
+  userId?: string
+}
+
+export type EncryptOtpAttemptParams = {
+  /** The OTP code the user entered. */
+  otpCode: string
+  /**
+   * The client's session public key (compressed P-256 hex). The enclave binds
+   * this key into the `verificationToken` it issues.
+   */
+  publicKey: string
+  /** The signed envelope returned by `/auth/init/otp`. */
+  encryptionTargetBundle: string
+  /**
+   * Test-only override for the pinned signing key. Production callers should
+   * leave this undefined; it exists so tests don't have to use the real key.
+   */
+  dangerouslyOverrideSignerPublicKey?: string
+}
+
+/**
+ * Returns a JSON string ready to be sent as `encryptedOtpBundle` on
+ * `POST /v1/otp_verify_v2`.
+ */
+export async function encryptOtpAttempt({
+  otpCode,
+  publicKey,
+  encryptionTargetBundle,
+  dangerouslyOverrideSignerPublicKey,
+}: EncryptOtpAttemptParams): Promise<string> {
+  const expectedSignerHex =
+    dangerouslyOverrideSignerPublicKey ?? TURNKEY_TLS_FETCHER_SIGN_PUBLIC_KEY
+
+  let envelope: EncryptionTargetEnvelope
+  try {
+    envelope = JSON.parse(encryptionTargetBundle)
+  } catch (err) {
+    throw new Error(
+      `encryptOtpAttempt: failed to parse encryption target bundle: ${(err as Error).message}`,
+    )
+  }
+
+  if (envelope.version !== BUNDLE_DATA_VERSION) {
+    throw new Error(
+      `encryptOtpAttempt: unsupported bundle version ${envelope.version}`,
+    )
+  }
+
+  if (
+    envelope.enclaveQuorumPublic.toLowerCase() !==
+    expectedSignerHex.toLowerCase()
+  ) {
+    throw new Error(
+      'encryptOtpAttempt: enclave quorum public key does not match pinned signing key',
+    )
+  }
+
+  const dataBytes = hexToBytes(envelope.data)
+  const signatureBytes = hexToBytes(envelope.dataSignature)
+  const signerPublicKeyBytes = hexToBytes(envelope.enclaveQuorumPublic)
+
+  // The Go side does sha256(data) then ASN.1 DER ECDSA verify, without
+  // enforcing low-S. Match that here.
+  const valid = p256.verify(signatureBytes, dataBytes, signerPublicKeyBytes, {
+    prehash: true,
+    format: 'der',
+    lowS: false,
+  })
+  if (!valid) {
+    throw new Error('encryptOtpAttempt: invalid enclave signature on bundle')
+  }
+
+  let signedData: SignedTargetData
+  try {
+    signedData = JSON.parse(new TextDecoder().decode(dataBytes))
+  } catch (err) {
+    throw new Error(
+      `encryptOtpAttempt: failed to parse signed bundle data: ${(err as Error).message}`,
+    )
+  }
+  if (!signedData.targetPublic) {
+    throw new Error('encryptOtpAttempt: missing targetPublic in signed data')
+  }
+
+  const targetPublicKey = hexToBytes(signedData.targetPublic)
+
+  // Plaintext shape matches what the Go example marshals:
+  //   { otp_code: string, public_key: string }
+  const plaintext = new TextEncoder().encode(
+    JSON.stringify({ otp_code: otpCode, public_key: publicKey }),
+  )
+
+  const { encappedPublic, ciphertext } = await hpkeSealP256({
+    receiverPublicKey: targetPublicKey,
+    plaintext,
+  })
+
+  // Wire format = the Go SDK's `ClientSendMsg`: Bytes fields hex-encoded.
+  return JSON.stringify({
+    encappedPublic: bytesToHex(encappedPublic),
+    ciphertext: bytesToHex(ciphertext),
+  })
+}

package/src/utils/exportPrivateKey.ts

@@ -1,4 +1,4 @@
-import type { ZeroDevWalletSDK } from '../core/createZeroDevWallet.js'
+import type { ZeroDevWalletSDK } from '../core/createZeroDevWalletCore.js'
 import type { KeyFormat } from '../stampers/types.js'
 
 export type ExportPrivateKeyParameters = {
@@ -72,7 +72,7 @@ export async function exportPrivateKey(
   })
 
   const stamperKey =
-    session.stamperType === 'indexedDb' ? 'indexedDbStamper' : 'webauthnStamper'
+    session.stamperType === 'apiKey' ? 'apiKeyStamper' : 'passkeyStamper'
   const stamper = wallet.client[stamperKey]
   if (!stamper) {
     throw new Error(`Stamper '${stamperKey}' not found on wallet.client`)

package/src/utils/exportWallet.ts

@@ -1,4 +1,4 @@
-import type { ZeroDevWalletSDK } from '../core/createZeroDevWallet.js'
+import type { ZeroDevWalletSDK } from '../core/createZeroDevWalletCore.js'
 
 export type ExportWalletParameters = {
   /** Wallet to use for the export */
@@ -43,88 +43,79 @@ export async function exportWallet(
 ): Promise<{ exportBundle: string; walletId: string; organizationId: string }> {
   const { targetPublicKey, wallet } = params
 
-  try {
-    const session = await wallet.getSession()
-    if (!session) {
-      throw new Error('Session not found')
-    }
-    const { organizationId } = session
+  const session = await wallet.getSession()
+  if (!session) {
+    throw new Error('Session not found')
+  }
+  const { organizationId } = session
 
-    const listWalletsBody = JSON.stringify({
-      organizationId,
-    })
+  const listWalletsBody = JSON.stringify({
+    organizationId,
+  })
 
-    const listWalletsStamp =
-      await wallet.client[
-        session.stamperType === 'indexedDb'
-          ? 'indexedDbStamper'
-          : 'webauthnStamper'
-      ].stamp(listWalletsBody)
-    if (!listWalletsStamp) {
-      throw new Error('Failed to stamp list wallets body')
-    }
+  const listWalletsStamp =
+    await wallet.client[
+      session.stamperType === 'apiKey' ? 'apiKeyStamper' : 'passkeyStamper'
+    ].stamp(listWalletsBody)
+  if (!listWalletsStamp) {
+    throw new Error('Failed to stamp list wallets body')
+  }
 
-    const listWalletsResponse = await fetch(
-      'https://api.turnkey.com/public/v1/query/list_wallets',
-      {
-        method: 'POST',
-        body: listWalletsBody,
-        headers: {
-          [listWalletsStamp.stampHeaderName]: listWalletsStamp.stampHeaderValue,
-        },
+  const listWalletsResponse = await fetch(
+    'https://api.turnkey.com/public/v1/query/list_wallets',
+    {
+      method: 'POST',
+      body: listWalletsBody,
+      headers: {
+        [listWalletsStamp.stampHeaderName]: listWalletsStamp.stampHeaderValue,
       },
-    )
-    if (!listWalletsResponse.ok) {
-      throw new Error('Failed to list wallets')
-    }
-    const listWalletsData = await listWalletsResponse.json()
+    },
+  )
+  if (!listWalletsResponse.ok) {
+    throw new Error('Failed to list wallets')
+  }
+  const listWalletsData = await listWalletsResponse.json()
 
-    const walletId = listWalletsData.wallets[0].walletId
+  const walletId = listWalletsData.wallets[0].walletId
 
-    const exportWalletBody = JSON.stringify({
-      type: 'ACTIVITY_TYPE_EXPORT_WALLET',
-      timestampMs: Date.now().toString(),
-      organizationId: organizationId,
-      parameters: {
-        walletId: walletId,
-        targetPublicKey,
-        language: 'MNEMONIC_LANGUAGE_ENGLISH',
-      },
-    })
-    const exportWalletStamp =
-      await wallet.client[
-        session.stamperType === 'indexedDb'
-          ? 'indexedDbStamper'
-          : 'webauthnStamper'
-      ].stamp(exportWalletBody)
-    if (!exportWalletStamp) {
-      throw new Error('Failed to stamp export wallet body')
-    }
-    const exportWalletResponse = await fetch(
-      'https://api.turnkey.com/public/v1/submit/export_wallet',
-      {
-        method: 'POST',
-        body: exportWalletBody,
-        headers: {
-          [exportWalletStamp.stampHeaderName]:
-            exportWalletStamp.stampHeaderValue,
-        },
+  const exportWalletBody = JSON.stringify({
+    type: 'ACTIVITY_TYPE_EXPORT_WALLET',
+    timestampMs: Date.now().toString(),
+    organizationId: organizationId,
+    parameters: {
+      walletId: walletId,
+      targetPublicKey,
+      language: 'MNEMONIC_LANGUAGE_ENGLISH',
+    },
+  })
+  const exportWalletStamp =
+    await wallet.client[
+      session.stamperType === 'apiKey' ? 'apiKeyStamper' : 'passkeyStamper'
+    ].stamp(exportWalletBody)
+  if (!exportWalletStamp) {
+    throw new Error('Failed to stamp export wallet body')
+  }
+  const exportWalletResponse = await fetch(
+    'https://api.turnkey.com/public/v1/submit/export_wallet',
+    {
+      method: 'POST',
+      body: exportWalletBody,
+      headers: {
+        [exportWalletStamp.stampHeaderName]: exportWalletStamp.stampHeaderValue,
       },
-    )
-    if (!exportWalletResponse.ok) {
-      throw new Error('Failed to export wallet')
-    }
-    const exportWalletData = await exportWalletResponse.json()
-
-    const exportBundle =
-      exportWalletData?.activity?.result?.exportWalletResult?.exportBundle
+    },
+  )
+  if (!exportWalletResponse.ok) {
+    throw new Error('Failed to export wallet')
+  }
+  const exportWalletData = await exportWalletResponse.json()
 
-    if (!exportBundle) {
-      throw new Error('Export bundle not found in response')
-    }
+  const exportBundle =
+    exportWalletData?.activity?.result?.exportWalletResult?.exportBundle
 
-    return { exportBundle, walletId, organizationId }
-  } catch (_) {
-    throw new Error('Error exporting wallet')
+  if (!exportBundle) {
+    throw new Error('Export bundle not found in response')
   }
+
+  return { exportBundle, walletId, organizationId }
 }

package/src/utils/hpke.ts

@@ -0,0 +1,219 @@
+/**
+ * HPKE (RFC 9180) seal for Turnkey enclave-encrypted requests.
+ *
+ * Suite: DHKEM(P-256, HKDF-SHA256) / HKDF-SHA256 / AES-256-GCM
+ *   - KEM ID  = 0x0010 (DHKEM-P256-HKDF-SHA256)
+ *   - KDF ID  = 0x0001 (HKDF-SHA256)
+ *   - AEAD ID = 0x0002 (AES-256-GCM)
+ *
+ * Wire format and AAD construction match Turnkey's enclave_encrypt Go package:
+ *   info = "turnkey_hpke"
+ *   aad  = enc || pkR  (both 65-byte uncompressed P-256 points)
+ *
+ * References:
+ *   - RFC 9180 §4 / §5
+ *   - tkhq/go-sdk/pkg/enclave_encrypt
+ */
+
+import { gcm } from '@noble/ciphers/aes.js'
+import { p256 } from '@noble/curves/nist.js'
+import { expand, extract } from '@noble/hashes/hkdf.js'
+import { sha256 } from '@noble/hashes/sha2.js'
+
+const KEM_ID = 0x0010
+const KDF_ID = 0x0001
+const AEAD_ID = 0x0002
+
+// Output sizes for the chosen primitives.
+const NH = 32 // SHA-256 output
+const NK = 32 // AES-256 key
+const NN = 12 // AES-GCM nonce
+const NPK = 65 // uncompressed P-256 point: 0x04 || X || Y
+
+const TURNKEY_HPKE_INFO = new TextEncoder().encode('turnkey_hpke')
+
+const HPKE_VERSION = new TextEncoder().encode('HPKE-v1')
+
+// suite_id for the HPKE context: "HPKE" || I2OSP(KEM,2) || I2OSP(KDF,2) || I2OSP(AEAD,2)
+const HPKE_SUITE_ID = concat(
+  new TextEncoder().encode('HPKE'),
+  i2osp(KEM_ID, 2),
+  i2osp(KDF_ID, 2),
+  i2osp(AEAD_ID, 2),
+)
+
+// suite_id for the KEM scope: "KEM" || I2OSP(KEM,2)
+const KEM_SUITE_ID = concat(new TextEncoder().encode('KEM'), i2osp(KEM_ID, 2))
+
+function concat(...parts: Uint8Array[]): Uint8Array {
+  const total = parts.reduce((sum, p) => sum + p.length, 0)
+  const out = new Uint8Array(total)
+  let offset = 0
+  for (const p of parts) {
+    out.set(p, offset)
+    offset += p.length
+  }
+  return out
+}
+
+function i2osp(n: number, len: number): Uint8Array {
+  const out = new Uint8Array(len)
+  for (let i = len - 1; i >= 0; i--) {
+    out[i] = n & 0xff
+    n >>>= 8
+  }
+  return out
+}
+
+// LabeledExtract(salt, label, ikm, suite_id) =
+//   HKDF-Extract(salt, "HPKE-v1" || suite_id || label || ikm)
+function labeledExtract(
+  salt: Uint8Array,
+  label: string,
+  ikm: Uint8Array,
+  suiteId: Uint8Array,
+): Uint8Array {
+  const labeledIkm = concat(
+    HPKE_VERSION,
+    suiteId,
+    new TextEncoder().encode(label),
+    ikm,
+  )
+  return extract(sha256, labeledIkm, salt)
+}
+
+// LabeledExpand(prk, label, info, L, suite_id) =
+//   HKDF-Expand(prk, I2OSP(L,2) || "HPKE-v1" || suite_id || label || info, L)
+function labeledExpand(
+  prk: Uint8Array,
+  label: string,
+  info: Uint8Array,
+  length: number,
+  suiteId: Uint8Array,
+): Uint8Array {
+  const labeledInfo = concat(
+    i2osp(length, 2),
+    HPKE_VERSION,
+    suiteId,
+    new TextEncoder().encode(label),
+    info,
+  )
+  return expand(sha256, prk, labeledInfo, length)
+}
+
+// DHKEM Encap: returns (sharedSecret, enc)
+// sharedSecret is 32 bytes; enc is the serialized ephemeral pubkey (65 bytes uncompressed).
+function encap(receiverPublicKey: Uint8Array): {
+  sharedSecret: Uint8Array
+  enc: Uint8Array
+} {
+  const ephSk = p256.utils.randomSecretKey()
+  const ephPkUncompressed = p256.getPublicKey(ephSk, false)
+
+  // ECDH: returns the serialized shared point. Pass isCompressed=true so the
+  // first byte is the SEC1 prefix and bytes [1, 33) are the x-coordinate.
+  const sharedPoint = p256.getSharedSecret(
+    ephSk,
+    receiverPublicKey,
+    /* isCompressed */ true,
+  )
+  const dh = sharedPoint.slice(1, 33)
+
+  const kemContext = concat(ephPkUncompressed, receiverPublicKey)
+
+  const eaePrk = labeledExtract(new Uint8Array(0), 'eae_prk', dh, KEM_SUITE_ID)
+  const sharedSecret = labeledExpand(
+    eaePrk,
+    'shared_secret',
+    kemContext,
+    NH,
+    KEM_SUITE_ID,
+  )
+
+  return { sharedSecret, enc: ephPkUncompressed }
+}
+
+// KeySchedule for mode_base: returns (key, base_nonce).
+function keySchedule(
+  sharedSecret: Uint8Array,
+  info: Uint8Array,
+): { key: Uint8Array; baseNonce: Uint8Array } {
+  const empty = new Uint8Array(0)
+
+  const pskIdHash = labeledExtract(empty, 'psk_id_hash', empty, HPKE_SUITE_ID)
+  const infoHash = labeledExtract(empty, 'info_hash', info, HPKE_SUITE_ID)
+
+  // mode_base = 0x00 prepended to (psk_id_hash || info_hash)
+  const keyScheduleContext = concat(new Uint8Array([0]), pskIdHash, infoHash)
+
+  const secret = labeledExtract(sharedSecret, 'secret', empty, HPKE_SUITE_ID)
+
+  const key = labeledExpand(
+    secret,
+    'key',
+    keyScheduleContext,
+    NK,
+    HPKE_SUITE_ID,
+  )
+  const baseNonce = labeledExpand(
+    secret,
+    'base_nonce',
+    keyScheduleContext,
+    NN,
+    HPKE_SUITE_ID,
+  )
+
+  return { key, baseNonce }
+}
+
+function aesGcmSeal(
+  key: Uint8Array,
+  nonce: Uint8Array,
+  aad: Uint8Array,
+  plaintext: Uint8Array,
+): Uint8Array {
+  // Returns ciphertext || tag (16 bytes appended) — matches the single-blob
+  // format Turnkey's `Sealer.Seal` and Web Crypto's AES-GCM produce.
+  return gcm(key, nonce, aad).encrypt(plaintext)
+}
+
+export type HpkeSealResult = {
+  /** Ephemeral sender public key (uncompressed P-256, 65 bytes). */
+  encappedPublic: Uint8Array
+  /** AES-256-GCM ciphertext with a 16-byte authentication tag appended. */
+  ciphertext: Uint8Array
+}
+
+/**
+ * Single-shot HPKE seal in mode_base for Turnkey's TLS Fetcher enclave.
+ *
+ * Uses the fixed Turnkey `info = "turnkey_hpke"` and the AAD shape
+ * `enc || receiverPublicKey` so the resulting bundle is decryptable by
+ * `enclave_encrypt.EnclaveEncryptServer.Decrypt`.
+ *
+ * @param receiverPublicKey - The enclave's ephemeral target public key
+ *   (uncompressed P-256, 65 bytes), extracted from the encryption target bundle.
+ * @param plaintext - The bytes to encrypt (e.g. the JSON-encoded OTP attempt).
+ */
+export async function hpkeSealP256({
+  receiverPublicKey,
+  plaintext,
+}: {
+  receiverPublicKey: Uint8Array
+  plaintext: Uint8Array
+}): Promise<HpkeSealResult> {
+  if (receiverPublicKey.length !== NPK) {
+    throw new Error(
+      `hpkeSealP256: receiverPublicKey must be ${NPK} bytes (uncompressed P-256), got ${receiverPublicKey.length}`,
+    )
+  }
+
+  const { sharedSecret, enc } = encap(receiverPublicKey)
+  const { key, baseNonce } = keySchedule(sharedSecret, TURNKEY_HPKE_INFO)
+
+  // First message of the context, sequence 0 → nonce = base_nonce.
+  const aad = concat(enc, receiverPublicKey)
+  const ciphertext = aesGcmSeal(key, baseNonce, aad, plaintext)
+
+  return { encappedPublic: enc, ciphertext }
+}

package/src/utils/platform.ts

@@ -0,0 +1,21 @@
+export function isReactNative(): boolean {
+  if (
+    typeof navigator !== 'undefined' &&
+    (navigator as { product?: string }).product === 'ReactNative'
+  ) {
+    return true
+  }
+  if (
+    typeof window !== 'undefined' &&
+    Object.hasOwn(window, 'ReactNativeWebView')
+  ) {
+    return true
+  }
+  if (
+    typeof globalThis !== 'undefined' &&
+    Object.hasOwn(globalThis, 'HermesEngine')
+  ) {
+    return true
+  }
+  return false
+}

package/src/utils/resolveOrganizationId.ts

@@ -0,0 +1,28 @@
+/**
+ * Builds a memoized resolver for the Turnkey parent org that stamp-login is
+ * signed against. Resolution order:
+ *   1. explicit override (self-hosted / local backends)
+ *   2. value fetched from the backend, cached after the first success
+ *   3. fallback (the known prod parent org) if the fetch fails
+ *
+ * The fetch is only attempted when there's no override, and only once — a
+ * failure is cached as the fallback so we don't refetch on every login.
+ */
+export function createOrganizationIdResolver(opts: {
+  organizationId?: string | undefined
+  fetchParentOrgId: () => Promise<string>
+  fallback: string
+}): () => Promise<string> {
+  let cached: string | undefined
+  return async function resolveOrganizationId(): Promise<string> {
+    if (opts.organizationId) return opts.organizationId
+    if (cached === undefined) {
+      try {
+        cached = await opts.fetchParentOrgId()
+      } catch {
+        cached = opts.fallback
+      }
+    }
+    return cached
+  }
+}

package/src/utils/utils.ts

@@ -18,7 +18,8 @@ export function parseSession(
     throw new Error('Invalid JWT: Missing payload')
   }
 
-  const decoded = JSON.parse(Buffer.from(payload, 'base64').toString())
+  const base64 = payload.replace(/-/g, '+').replace(/_/g, '/')
+  const decoded = JSON.parse(atob(base64))
   const {
     exp,
     public_key: publicKey,
@@ -68,11 +69,9 @@ export const generateRandomBuffer = (): ArrayBuffer => {
  * @returns {string} - The encoded challenge.
  */
 export const base64UrlEncode = (challenge: ArrayBuffer): string => {
-  return Buffer.from(challenge)
-    .toString('base64')
-    .replace(/\+/g, '-')
-    .replace(/\//g, '_')
-    .replace(/=/g, '')
+  const bytes = new Uint8Array(challenge)
+  const binary = String.fromCharCode(...bytes)
+  return btoa(binary).replace(/\+/g, '-').replace(/\//g, '_').replace(/=/g, '')
 }
 
 /**

package/src/web/createZeroDevWallet.ts

@@ -0,0 +1,45 @@
+import {
+  createZeroDevWalletCore,
+  type ZeroDevWalletConfigCore,
+  type ZeroDevWalletSDK,
+} from '../core/createZeroDevWalletCore.js'
+import { createIndexedDbStamper } from '../stampers/indexedDbStamper.js'
+import type { ApiKeyStamper, PasskeyStamper } from '../stampers/types.js'
+import { createWebauthnStamper } from '../stampers/webauthnStamper.js'
+import { createWebStorageAdapter } from '../storage/adapters.js'
+import type { StorageAdapter } from '../storage/manager.js'
+
+/**
+ * Web config: all four web-defaulted fields are optional overrides.
+ * `rpId` falls back to `window.location.hostname`; the others fall back to
+ * IndexedDB / WebAuthn / sessionStorage-backed implementations. RN consumers
+ * go through `@zerodev/wallet-core/react-native`, which exposes the strict
+ * `ZeroDevWalletConfigCore` shape directly.
+ */
+export type ZeroDevWalletConfig = Omit<
+  ZeroDevWalletConfigCore,
+  'apiKeyStamper' | 'passkeyStamper' | 'rpId' | 'sessionStorage'
+> & {
+  rpId?: string
+  sessionStorage?: StorageAdapter
+  apiKeyStamper?: ApiKeyStamper
+  passkeyStamper?: PasskeyStamper
+}
+
+export async function createZeroDevWallet(
+  config: ZeroDevWalletConfig,
+): Promise<ZeroDevWalletSDK> {
+  const rpId = config.rpId ?? window.location.hostname
+  const apiKeyStamper = config.apiKeyStamper ?? (await createIndexedDbStamper())
+  const passkeyStamper =
+    config.passkeyStamper ?? (await createWebauthnStamper({ rpId }))
+  const sessionStorage = config.sessionStorage ?? createWebStorageAdapter()
+
+  return createZeroDevWalletCore({
+    ...config,
+    rpId,
+    apiKeyStamper,
+    passkeyStamper,
+    sessionStorage,
+  })
+}

package/dist/_cjs/actions/auth/getUserEmail.js

@@ -1,19 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.getUserEmail = getUserEmail;
-async function getUserEmail(client, params) {
-    const { organizationId, projectId, token } = params;
-    return await client.request({
-        path: `${projectId}/user-email`,
-        method: 'POST',
-        body: {
-            organizationId,
-        },
-        headers: {
-            Authorization: `Bearer ${token}`,
-        },
-        stamp: true,
-        stampPostion: 'headers',
-    });
-}
-//# sourceMappingURL=getUserEmail.js.map

package/dist/_cjs/actions/auth/getUserEmail.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"getUserEmail.js","sourceRoot":"","sources":["../../../../src/actions/auth/getUserEmail.ts"],"names":[],"mappings":";;AAiCA,oCAkBC;AAlBM,KAAK,UAAU,YAAY,CAChC,MAAc,EACd,MAA8B;IAE9B,MAAM,EAAE,cAAc,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,MAAM,CAAA;IAEnD,OAAO,MAAM,MAAM,CAAC,OAAO,CAAC;QAC1B,IAAI,EAAE,GAAG,SAAS,aAAa;QAC/B,MAAM,EAAE,MAAM;QACd,IAAI,EAAE;YACJ,cAAc;SACf;QACD,OAAO,EAAE;YACP,aAAa,EAAE,UAAU,KAAK,EAAE;SACjC;QACD,KAAK,EAAE,IAAI;QACX,YAAY,EAAE,SAAS;KACxB,CAAC,CAAA;AACJ,CAAC"}