@zerodev/wallet-core 0.0.1-alpha.9 → 0.0.1

package/dist/_esm/native/storage/asyncStorage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"asyncStorage.js","sourceRoot":"","sources":["../../../../src/native/storage/asyncStorage.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,cAAc,MAAM,2CAA2C,CAAA;AAG3E,iFAAiF;AACjF,gFAAgF;AAChF,4EAA4E;AAC5E,8EAA8E;AAC9E,iDAAiD;AACjD,MAAM,YAAY,GAChB,cACD,CAAC,OAAO,CAAA;AAET,MAAM,CAAC,MAAM,mBAAmB,GAAmB;IACjD,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC;IAC3C,OAAO,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC;IACzD,UAAU,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,UAAU,CAAC,GAAG,CAAC;CAClD,CAAA"}

package/dist/_esm/stampers/iframeStamper.js

@@ -27,6 +27,9 @@ export async function createIframeStamper(cfg) {
         async injectKeyExportBundle(bundle, organizationId, keyFormat) {
             return await inner.injectKeyExportBundle(bundle, organizationId, keyFormat ? KeyFormat[keyFormat] : KeyFormat.Hexadecimal);
         },
+        async applySettings(settings) {
+            return await inner.applySettings(settings);
+        },
     };
 }
 //# sourceMappingURL=iframeStamper.js.map

package/dist/_esm/stampers/iframeStamper.js.map

@@ -1 +1 @@
-{"version":3,"file":"iframeStamper.js","sourceRoot":"","sources":["../../../src/stampers/iframeStamper.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,SAAS,EACT,aAAa,IAAI,oBAAoB,GACtC,MAAM,yBAAyB,CAAA;AAGhC,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,GAIzC;IACC,MAAM,KAAK,GAAG,IAAI,oBAAoB,CAAC;QACrC,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,eAAe,EAAE,GAAG,CAAC,eAAe;QACpC,eAAe,EAAE,GAAG,CAAC,eAAe;KACrC,CAAC,CAAA;IAEF,OAAO;QACL,KAAK,CAAC,IAAI;YACR,OAAO,MAAM,KAAK,CAAC,IAAI,EAAE,CAAA;QAC3B,CAAC;QACD,KAAK,CAAC,sBAAsB,CAAC,MAAc;YACzC,OAAO,MAAM,KAAK,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAA;QACnD,CAAC;QACD,KAAK,CAAC,YAAY;YAChB,OAAO,MAAM,KAAK,CAAC,oBAAoB,EAAE,CAAA;QAC3C,CAAC;QACD,KAAK,CAAC,KAAK,CAAC,OAAe;YACzB,OAAO,MAAM,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QACnC,CAAC;QACD,KAAK,CAAC,KAAK;YACT,MAAM,KAAK,CAAC,KAAK,EAAE,CAAA;QACrB,CAAC;QACD,KAAK,CAAC,wBAAwB,CAAC,MAAc,EAAE,cAAsB;YACnE,OAAO,MAAM,KAAK,CAAC,wBAAwB,CAAC,MAAM,EAAE,cAAc,CAAC,CAAA;QACrE,CAAC;QACD,KAAK,CAAC,qBAAqB,CACzB,MAAc,EACd,cAAsB,EACtB,SAAyB;YAEzB,OAAO,MAAM,KAAK,CAAC,qBAAqB,CACtC,MAAM,EACN,cAAc,EACd,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,WAAW,CACzD,CAAA;QACH,CAAC;KACF,CAAA;AACH,CAAC"}
+{"version":3,"file":"iframeStamper.js","sourceRoot":"","sources":["../../../src/stampers/iframeStamper.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,SAAS,EACT,aAAa,IAAI,oBAAoB,GACtC,MAAM,yBAAyB,CAAA;AAGhC,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,GAIzC;IACC,MAAM,KAAK,GAAG,IAAI,oBAAoB,CAAC;QACrC,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,eAAe,EAAE,GAAG,CAAC,eAAe;QACpC,eAAe,EAAE,GAAG,CAAC,eAAe;KACrC,CAAC,CAAA;IAEF,OAAO;QACL,KAAK,CAAC,IAAI;YACR,OAAO,MAAM,KAAK,CAAC,IAAI,EAAE,CAAA;QAC3B,CAAC;QACD,KAAK,CAAC,sBAAsB,CAAC,MAAc;YACzC,OAAO,MAAM,KAAK,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAA;QACnD,CAAC;QACD,KAAK,CAAC,YAAY;YAChB,OAAO,MAAM,KAAK,CAAC,oBAAoB,EAAE,CAAA;QAC3C,CAAC;QACD,KAAK,CAAC,KAAK,CAAC,OAAe;YACzB,OAAO,MAAM,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QACnC,CAAC;QACD,KAAK,CAAC,KAAK;YACT,MAAM,KAAK,CAAC,KAAK,EAAE,CAAA;QACrB,CAAC;QACD,KAAK,CAAC,wBAAwB,CAAC,MAAc,EAAE,cAAsB;YACnE,OAAO,MAAM,KAAK,CAAC,wBAAwB,CAAC,MAAM,EAAE,cAAc,CAAC,CAAA;QACrE,CAAC;QACD,KAAK,CAAC,qBAAqB,CACzB,MAAc,EACd,cAAsB,EACtB,SAAyB;YAEzB,OAAO,MAAM,KAAK,CAAC,qBAAqB,CACtC,MAAM,EACN,cAAc,EACd,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,WAAW,CACzD,CAAA;QACH,CAAC;QACD,KAAK,CAAC,aAAa,CAAC,QAA6C;YAC/D,OAAO,MAAM,KAAK,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAA;QAC5C,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/_esm/stampers/indexedDbStamper.js

@@ -1,7 +1,9 @@
 import { IndexedDbStamper as TurnkeyIndexedDbStamper } from '@turnkey/indexed-db-stamper';
+import { generateCompressedPublicKeyFromKeyPair } from '../utils/utils.js';
 export async function createIndexedDbStamper() {
     const inner = new TurnkeyIndexedDbStamper();
     await inner.init();
+    let pendingKeyPair = null;
     return {
         async getPublicKey() {
             return await inner.getPublicKey();
@@ -9,11 +11,27 @@ export async function createIndexedDbStamper() {
         async stamp(payload) {
             return await inner.stamp(payload);
         },
+        async sign(payload) {
+            return await inner.sign(payload);
+        },
         async clear() {
             await inner.clear();
         },
-        async resetKeyPair(externalKeyPair) {
-            await inner.resetKeyPair(externalKeyPair);
+        async resetKeyPair() {
+            pendingKeyPair = null;
+            await inner.resetKeyPair();
+        },
+        async prepareKeyRotation() {
+            const keyPair = await crypto.subtle.generateKey({ name: 'ECDSA', namedCurve: 'P-256' }, false, ['sign', 'verify']);
+            pendingKeyPair = keyPair;
+            return await generateCompressedPublicKeyFromKeyPair(keyPair);
+        },
+        async commitKeyRotation() {
+            if (!pendingKeyPair) {
+                throw new Error('No pending key rotation to commit');
+            }
+            await inner.resetKeyPair(pendingKeyPair);
+            pendingKeyPair = null;
         },
     };
 }

package/dist/_esm/stampers/indexedDbStamper.js.map

@@ -1 +1 @@
-{"version":3,"file":"indexedDbStamper.js","sourceRoot":"","sources":["../../../src/stampers/indexedDbStamper.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,IAAI,uBAAuB,EAAE,MAAM,6BAA6B,CAAA;AAGzF,MAAM,CAAC,KAAK,UAAU,sBAAsB;IAC1C,MAAM,KAAK,GAAG,IAAI,uBAAuB,EAAE,CAAA;IAC3C,MAAM,KAAK,CAAC,IAAI,EAAE,CAAA;IAElB,OAAO;QACL,KAAK,CAAC,YAAY;YAChB,OAAO,MAAM,KAAK,CAAC,YAAY,EAAE,CAAA;QACnC,CAAC;QACD,KAAK,CAAC,KAAK,CAAC,OAAe;YACzB,OAAO,MAAM,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QACnC,CAAC;QACD,KAAK,CAAC,KAAK;YACT,MAAM,KAAK,CAAC,KAAK,EAAE,CAAA;QACrB,CAAC;QACD,KAAK,CAAC,YAAY,CAAC,eAA+B;YAChD,MAAM,KAAK,CAAC,YAAY,CAAC,eAAe,CAAC,CAAA;QAC3C,CAAC;KACF,CAAA;AACH,CAAC"}
+{"version":3,"file":"indexedDbStamper.js","sourceRoot":"","sources":["../../../src/stampers/indexedDbStamper.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,IAAI,uBAAuB,EAAE,MAAM,6BAA6B,CAAA;AACzF,OAAO,EAAE,sCAAsC,EAAE,MAAM,mBAAmB,CAAA;AAG1E,MAAM,CAAC,KAAK,UAAU,sBAAsB;IAC1C,MAAM,KAAK,GAAG,IAAI,uBAAuB,EAAE,CAAA;IAC3C,MAAM,KAAK,CAAC,IAAI,EAAE,CAAA;IAElB,IAAI,cAAc,GAAyB,IAAI,CAAA;IAE/C,OAAO;QACL,KAAK,CAAC,YAAY;YAChB,OAAO,MAAM,KAAK,CAAC,YAAY,EAAE,CAAA;QACnC,CAAC;QACD,KAAK,CAAC,KAAK,CAAC,OAAe;YACzB,OAAO,MAAM,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QACnC,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,OAAe;YACxB,OAAO,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QAClC,CAAC;QACD,KAAK,CAAC,KAAK;YACT,MAAM,KAAK,CAAC,KAAK,EAAE,CAAA;QACrB,CAAC;QACD,KAAK,CAAC,YAAY;YAChB,cAAc,GAAG,IAAI,CAAA;YACrB,MAAM,KAAK,CAAC,YAAY,EAAE,CAAA;QAC5B,CAAC;QACD,KAAK,CAAC,kBAAkB;YACtB,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,WAAW,CAC7C,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,EACtC,KAAK,EACL,CAAC,MAAM,EAAE,QAAQ,CAAC,CACnB,CAAA;YACD,cAAc,GAAG,OAAO,CAAA;YACxB,OAAO,MAAM,sCAAsC,CAAC,OAAO,CAAC,CAAA;QAC9D,CAAC;QACD,KAAK,CAAC,iBAAiB;YACrB,IAAI,CAAC,cAAc,EAAE,CAAC;gBACpB,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAA;YACtD,CAAC;YACD,MAAM,KAAK,CAAC,YAAY,CAAC,cAAc,CAAC,CAAA;YACxC,cAAc,GAAG,IAAI,CAAA;QACvB,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/_esm/stampers/noopPasskeyStamper.js

@@ -0,0 +1,18 @@
+const NOT_CONFIGURED_MESSAGE = 'passkeyStamper is not configured. Pass passkeyStamper to zeroDevWallet({ ... }) — use createReactNativePasskeyStamper({ rpId }) on React Native or createWebauthnStamper({ rpId }) on web.';
+/**
+ * Internal fallback used when a consumer doesn't supply a `passkeyStamper`.
+ * Methods throw on use, so passkey register/login fails with an actionable
+ * message — all other flows (apiKey signing, OAuth, OTP) are unaffected.
+ */
+export function createNoopPasskeyStamper() {
+    return {
+        async stamp() {
+            throw new Error(NOT_CONFIGURED_MESSAGE);
+        },
+        async register() {
+            throw new Error(NOT_CONFIGURED_MESSAGE);
+        },
+        async clear() { },
+    };
+}
+//# sourceMappingURL=noopPasskeyStamper.js.map

package/dist/_esm/stampers/noopPasskeyStamper.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"noopPasskeyStamper.js","sourceRoot":"","sources":["../../../src/stampers/noopPasskeyStamper.ts"],"names":[],"mappings":"AAEA,MAAM,sBAAsB,GAC1B,4LAA4L,CAAA;AAE9L;;;;GAIG;AACH,MAAM,UAAU,wBAAwB;IACtC,OAAO;QACL,KAAK,CAAC,KAAK;YACT,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAA;QACzC,CAAC;QACD,KAAK,CAAC,QAAQ;YACZ,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAA;QACzC,CAAC;QACD,KAAK,CAAC,KAAK,KAAI,CAAC;KACjB,CAAA;AACH,CAAC"}

package/dist/_esm/stampers/webauthnStamper.js

@@ -1,15 +1,34 @@
+import { getWebAuthnAttestation } from '@turnkey/http';
 import { WebauthnStamper as TurnkeyWebauthnStamper } from '@turnkey/webauthn-stamper';
+import { base64UrlEncode, generateRandomBuffer } from '../utils/utils.js';
 export async function createWebauthnStamper({ rpId, }) {
     const inner = new TurnkeyWebauthnStamper({ rpId });
     return {
-        async getPublicKey() {
-            //   return await inner.();
-            return null;
-        },
         async stamp(payload) {
             return await inner.stamp(payload);
         },
         async clear() { },
+        async register(options) {
+            const challenge = generateRandomBuffer();
+            const encodedChallenge = base64UrlEncode(challenge);
+            const authenticatorUserId = generateRandomBuffer();
+            const attestation = await getWebAuthnAttestation({
+                publicKey: {
+                    rp: options.rp,
+                    challenge,
+                    pubKeyCredParams: [
+                        { type: 'public-key', alg: -7 },
+                        { type: 'public-key', alg: -257 },
+                    ],
+                    user: {
+                        id: authenticatorUserId,
+                        name: options.userName,
+                        displayName: options.userName,
+                    },
+                },
+            });
+            return { attestation, encodedChallenge };
+        },
     };
 }
 //# sourceMappingURL=webauthnStamper.js.map

package/dist/_esm/stampers/webauthnStamper.js.map

@@ -1 +1 @@
-{"version":3,"file":"webauthnStamper.js","sourceRoot":"","sources":["../../../src/stampers/webauthnStamper.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,IAAI,sBAAsB,EAAE,MAAM,2BAA2B,CAAA;AAGrF,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,EAC1C,IAAI,GAGL;IACC,MAAM,KAAK,GAAG,IAAI,sBAAsB,CAAC,EAAE,IAAI,EAAE,CAAC,CAAA;IAElD,OAAO;QACL,KAAK,CAAC,YAAY;YAChB,2BAA2B;YAC3B,OAAO,IAAI,CAAA;QACb,CAAC;QACD,KAAK,CAAC,KAAK,CAAC,OAAe;YACzB,OAAO,MAAM,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QACnC,CAAC;QACD,KAAK,CAAC,KAAK,KAAI,CAAC;KACjB,CAAA;AACH,CAAC"}
+{"version":3,"file":"webauthnStamper.js","sourceRoot":"","sources":["../../../src/stampers/webauthnStamper.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAA;AACtD,OAAO,EAAE,eAAe,IAAI,sBAAsB,EAAE,MAAM,2BAA2B,CAAA;AACrF,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAA;AAGzE,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,EAC1C,IAAI,GAGL;IACC,MAAM,KAAK,GAAG,IAAI,sBAAsB,CAAC,EAAE,IAAI,EAAE,CAAC,CAAA;IAElD,OAAO;QACL,KAAK,CAAC,KAAK,CAAC,OAAe;YACzB,OAAO,MAAM,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QACnC,CAAC;QACD,KAAK,CAAC,KAAK,KAAI,CAAC;QAChB,KAAK,CAAC,QAAQ,CAAC,OAAmC;YAChD,MAAM,SAAS,GAAG,oBAAoB,EAAE,CAAA;YACxC,MAAM,gBAAgB,GAAG,eAAe,CAAC,SAAS,CAAC,CAAA;YACnD,MAAM,mBAAmB,GAAG,oBAAoB,EAAE,CAAA;YAElD,MAAM,WAAW,GAAG,MAAM,sBAAsB,CAAC;gBAC/C,SAAS,EAAE;oBACT,EAAE,EAAE,OAAO,CAAC,EAAE;oBACd,SAAS;oBACT,gBAAgB,EAAE;wBAChB,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE;wBAC/B,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,GAAG,EAAE;qBAClC;oBACD,IAAI,EAAE;wBACJ,EAAE,EAAE,mBAAmB;wBACvB,IAAI,EAAE,OAAO,CAAC,QAAQ;wBACtB,WAAW,EAAE,OAAO,CAAC,QAAQ;qBAC9B;iBACF;aACF,CAAC,CAAA;YAEF,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,CAAA;QAC1C,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/_esm/stubs/native-on-web.js

@@ -0,0 +1,25 @@
+// Catch-all stub used by every `./react-native/*` subpath in this package
+// under the `browser` and `node` exports conditions. Both are needed for
+// Expo web: the client bundle resolves with `browser` active, while Expo
+// Router's SSR/RSC route render drops platform conditions (no `browser`)
+// and turns on `node` instead — so the web stub has to be gated on both or
+// the SSR pass falls through to the native impl. Imports must be safe on web
+// (some route files are bundled even when they aren't rendered) so we expose
+// the RN-only symbols as throw-on-use functions instead of throwing at
+// module-init time.
+//
+// Anyone who *uses* these on web gets a clear actionable error; anyone who
+// merely imports them (typically because their universal app bundles the
+// native variant too) is unaffected.
+const message = '@zerodev/wallet-core react-native subpaths cannot be imported in a web environment. Use the bare specifier (`import { ... } from "@zerodev/wallet-core"`) instead.';
+function throwOnUse() {
+    throw new Error(message);
+}
+export const createSecureStoreStamper = throwOnUse;
+export const createReactNativePasskeyStamper = throwOnUse;
+export const asyncStorageAdapter = throwOnUse;
+// For the broad `./react-native` entry: any consumer reaching it on web is
+// already off-pattern (they should use the bare specifier). Default export
+// covers `import X from '...'`.
+export default throwOnUse;
+//# sourceMappingURL=native-on-web.js.map

package/dist/_esm/stubs/native-on-web.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"native-on-web.js","sourceRoot":"","sources":["../../../src/stubs/native-on-web.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAC1E,yEAAyE;AACzE,yEAAyE;AACzE,yEAAyE;AACzE,2EAA2E;AAC3E,6EAA6E;AAC7E,6EAA6E;AAC7E,uEAAuE;AACvE,oBAAoB;AACpB,EAAE;AACF,2EAA2E;AAC3E,yEAAyE;AACzE,qCAAqC;AAErC,MAAM,OAAO,GACX,oKAAoK,CAAA;AAEtK,SAAS,UAAU;IACjB,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAA;AAC1B,CAAC;AAED,MAAM,CAAC,MAAM,wBAAwB,GAAG,UAAU,CAAA;AAClD,MAAM,CAAC,MAAM,+BAA+B,GAAG,UAAU,CAAA;AACzD,MAAM,CAAC,MAAM,mBAAmB,GAAG,UAAU,CAAA;AAE7C,2EAA2E;AAC3E,2EAA2E;AAC3E,gCAAgC;AAChC,eAAe,UAAU,CAAA"}

package/dist/_esm/utils/encryptOtpAttempt.js

@@ -0,0 +1,81 @@
+/**
+ * Wraps the OTP code + client public key in a Turnkey-compatible HPKE bundle
+ * for the `/v1/otp_verify_v2` auth-proxy endpoint.
+ *
+ * Bundle flow (RFC 9180 mode_base over Turnkey's TLS Fetcher enclave):
+ *   1. The backend's /init/otp returns a signed envelope that contains an
+ *      ephemeral HPKE public key (`targetPublic`) generated fresh by the
+ *      enclave for this OTP attempt.
+ *   2. We verify the envelope's ECDSA signature against a pinned production
+ *      key (`TURNKEY_TLS_FETCHER_SIGN_PUBLIC_KEY`) so a compromised proxy
+ *      cannot substitute its own ephemeral key.
+ *   3. We HPKE-seal `{otp_code, public_key}` to `targetPublic`. The auth proxy
+ *      forwards the ciphertext to the enclave; only the enclave can decrypt
+ *      it. The enclave then issues a `verificationToken` bound to the public
+ *      key embedded in the plaintext.
+ *
+ * See: tkhq/go-sdk `examples/email_otp` and `pkg/enclave_encrypt`.
+ */
+import { p256 } from '@noble/curves/nist.js';
+import { bytesToHex, hexToBytes } from '@noble/hashes/utils.js';
+import { TURNKEY_TLS_FETCHER_SIGN_PUBLIC_KEY } from '../constants.js';
+import { hpkeSealP256 } from './hpke.js';
+const BUNDLE_DATA_VERSION = 'v1.0.0';
+/**
+ * Returns a JSON string ready to be sent as `encryptedOtpBundle` on
+ * `POST /v1/otp_verify_v2`.
+ */
+export async function encryptOtpAttempt({ otpCode, publicKey, encryptionTargetBundle, dangerouslyOverrideSignerPublicKey, }) {
+    const expectedSignerHex = dangerouslyOverrideSignerPublicKey ?? TURNKEY_TLS_FETCHER_SIGN_PUBLIC_KEY;
+    let envelope;
+    try {
+        envelope = JSON.parse(encryptionTargetBundle);
+    }
+    catch (err) {
+        throw new Error(`encryptOtpAttempt: failed to parse encryption target bundle: ${err.message}`);
+    }
+    if (envelope.version !== BUNDLE_DATA_VERSION) {
+        throw new Error(`encryptOtpAttempt: unsupported bundle version ${envelope.version}`);
+    }
+    if (envelope.enclaveQuorumPublic.toLowerCase() !==
+        expectedSignerHex.toLowerCase()) {
+        throw new Error('encryptOtpAttempt: enclave quorum public key does not match pinned signing key');
+    }
+    const dataBytes = hexToBytes(envelope.data);
+    const signatureBytes = hexToBytes(envelope.dataSignature);
+    const signerPublicKeyBytes = hexToBytes(envelope.enclaveQuorumPublic);
+    // The Go side does sha256(data) then ASN.1 DER ECDSA verify, without
+    // enforcing low-S. Match that here.
+    const valid = p256.verify(signatureBytes, dataBytes, signerPublicKeyBytes, {
+        prehash: true,
+        format: 'der',
+        lowS: false,
+    });
+    if (!valid) {
+        throw new Error('encryptOtpAttempt: invalid enclave signature on bundle');
+    }
+    let signedData;
+    try {
+        signedData = JSON.parse(new TextDecoder().decode(dataBytes));
+    }
+    catch (err) {
+        throw new Error(`encryptOtpAttempt: failed to parse signed bundle data: ${err.message}`);
+    }
+    if (!signedData.targetPublic) {
+        throw new Error('encryptOtpAttempt: missing targetPublic in signed data');
+    }
+    const targetPublicKey = hexToBytes(signedData.targetPublic);
+    // Plaintext shape matches what the Go example marshals:
+    //   { otp_code: string, public_key: string }
+    const plaintext = new TextEncoder().encode(JSON.stringify({ otp_code: otpCode, public_key: publicKey }));
+    const { encappedPublic, ciphertext } = await hpkeSealP256({
+        receiverPublicKey: targetPublicKey,
+        plaintext,
+    });
+    // Wire format = the Go SDK's `ClientSendMsg`: Bytes fields hex-encoded.
+    return JSON.stringify({
+        encappedPublic: bytesToHex(encappedPublic),
+        ciphertext: bytesToHex(ciphertext),
+    });
+}
+//# sourceMappingURL=encryptOtpAttempt.js.map

package/dist/_esm/utils/encryptOtpAttempt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"encryptOtpAttempt.js","sourceRoot":"","sources":["../../../src/utils/encryptOtpAttempt.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,uBAAuB,CAAA;AAC5C,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAA;AAC/D,OAAO,EAAE,mCAAmC,EAAE,MAAM,iBAAiB,CAAA;AACrE,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAA;AAExC,MAAM,mBAAmB,GAAG,QAAQ,CAAA;AAmCpC;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,EACtC,OAAO,EACP,SAAS,EACT,sBAAsB,EACtB,kCAAkC,GACV;IACxB,MAAM,iBAAiB,GACrB,kCAAkC,IAAI,mCAAmC,CAAA;IAE3E,IAAI,QAAkC,CAAA;IACtC,IAAI,CAAC;QACH,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAA;IAC/C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CACb,gEAAiE,GAAa,CAAC,OAAO,EAAE,CACzF,CAAA;IACH,CAAC;IAED,IAAI,QAAQ,CAAC,OAAO,KAAK,mBAAmB,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CACb,iDAAiD,QAAQ,CAAC,OAAO,EAAE,CACpE,CAAA;IACH,CAAC;IAED,IACE,QAAQ,CAAC,mBAAmB,CAAC,WAAW,EAAE;QAC1C,iBAAiB,CAAC,WAAW,EAAE,EAC/B,CAAC;QACD,MAAM,IAAI,KAAK,CACb,gFAAgF,CACjF,CAAA;IACH,CAAC;IAED,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;IAC3C,MAAM,cAAc,GAAG,UAAU,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAA;IACzD,MAAM,oBAAoB,GAAG,UAAU,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAA;IAErE,qEAAqE;IACrE,oCAAoC;IACpC,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,SAAS,EAAE,oBAAoB,EAAE;QACzE,OAAO,EAAE,IAAI;QACb,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,KAAK;KACZ,CAAC,CAAA;IACF,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAA;IAC3E,CAAC;IAED,IAAI,UAA4B,CAAA;IAChC,IAAI,CAAC;QACH,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAA;IAC9D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CACb,0DAA2D,GAAa,CAAC,OAAO,EAAE,CACnF,CAAA;IACH,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,YAAY,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAA;IAC3E,CAAC;IAED,MAAM,eAAe,GAAG,UAAU,CAAC,UAAU,CAAC,YAAY,CAAC,CAAA;IAE3D,wDAAwD;IACxD,6CAA6C;IAC7C,MAAM,SAAS,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CACxC,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAC7D,CAAA;IAED,MAAM,EAAE,cAAc,EAAE,UAAU,EAAE,GAAG,MAAM,YAAY,CAAC;QACxD,iBAAiB,EAAE,eAAe;QAClC,SAAS;KACV,CAAC,CAAA;IAEF,wEAAwE;IACxE,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,cAAc,EAAE,UAAU,CAAC,cAAc,CAAC;QAC1C,UAAU,EAAE,UAAU,CAAC,UAAU,CAAC;KACnC,CAAC,CAAA;AACJ,CAAC"}

package/dist/_esm/utils/exportPrivateKey.js

@@ -53,7 +53,7 @@ export async function exportPrivateKey(params) {
             targetPublicKey,
         },
     });
-    const stamperKey = session.stamperType === 'indexedDb' ? 'indexedDbStamper' : 'webauthnStamper';
+    const stamperKey = session.stamperType === 'apiKey' ? 'apiKeyStamper' : 'passkeyStamper';
     const stamper = wallet.client[stamperKey];
     if (!stamper) {
         throw new Error(`Stamper '${stamperKey}' not found on wallet.client`);

package/dist/_esm/utils/exportPrivateKey.js.map

@@ -1 +1 @@
-{"version":3,"file":"exportPrivateKey.js","sourceRoot":"","sources":["../../../src/utils/exportPrivateKey.ts"],"names":[],"mappings":"AAYA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,MAAkC;IAElC,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,MAAM,CAAA;IAEjE,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,UAAU,EAAE,CAAA;IACzC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAA;IACtC,CAAC;IACD,MAAM,EAAE,cAAc,EAAE,GAAG,OAAO,CAAA;IAElC,4DAA4D;IAC5D,IAAI,OAAO,GAAG,YAAY,CAAA;IAC1B,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,SAAS,EAAE,CAAA;QACxC,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAA;QAC9D,CAAC;QACD,OAAO,GAAG,OAAO,CAAC,OAAO,CAAA;IAC3B,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC;QAChC,IAAI,EAAE,qCAAqC;QAC3C,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;QAClC,cAAc,EAAE,cAAc;QAC9B,UAAU,EAAE;YACV,OAAO,EAAE,OAAO;YAChB,eAAe;SAChB;KACF,CAAC,CAAA;IAEF,MAAM,UAAU,GACd,OAAO,CAAC,WAAW,KAAK,WAAW,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,iBAAiB,CAAA;IAC9E,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;IACzC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,YAAY,UAAU,8BAA8B,CAAC,CAAA;IACvE,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,CAAA;IACnD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAA;IAChD,CAAC;IAED,MAAM,cAAc,GAAG,MAAM,KAAK,CAChC,gEAAgE,EAChE;QACE,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,UAAU;QAChB,OAAO,EAAE;YACP,CAAC,WAAW,CAAC,eAAe,CAAC,EAAE,WAAW,CAAC,gBAAgB;SAC5D;KACF,CACF,CAAA;IACD,IAAI,CAAC,cAAc,CAAC,EAAE,EAAE,CAAC;QACvB,MAAM,SAAS,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,CAAA;QAC7C,MAAM,IAAI,KAAK,CACb,oCAAoC,cAAc,CAAC,MAAM,IAAI,SAAS,EAAE,CACzE,CAAA;IACH,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,CAAA;IAE9C,MAAM,YAAY,GAChB,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,yBAAyB,EAAE,YAAY,CAAA;IAEvE,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CACb,wCAAwC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CACrE,CAAA;IACH,CAAC;IAED,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,OAAQ,EAAE,cAAc,EAAE,CAAA;AAC5D,CAAC"}
+{"version":3,"file":"exportPrivateKey.js","sourceRoot":"","sources":["../../../src/utils/exportPrivateKey.ts"],"names":[],"mappings":"AAYA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,MAAkC;IAElC,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,MAAM,CAAA;IAEjE,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,UAAU,EAAE,CAAA;IACzC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAA;IACtC,CAAC;IACD,MAAM,EAAE,cAAc,EAAE,GAAG,OAAO,CAAA;IAElC,4DAA4D;IAC5D,IAAI,OAAO,GAAG,YAAY,CAAA;IAC1B,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,SAAS,EAAE,CAAA;QACxC,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAA;QAC9D,CAAC;QACD,OAAO,GAAG,OAAO,CAAC,OAAO,CAAA;IAC3B,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC;QAChC,IAAI,EAAE,qCAAqC;QAC3C,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;QAClC,cAAc,EAAE,cAAc;QAC9B,UAAU,EAAE;YACV,OAAO,EAAE,OAAO;YAChB,eAAe;SAChB;KACF,CAAC,CAAA;IAEF,MAAM,UAAU,GACd,OAAO,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,gBAAgB,CAAA;IACvE,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;IACzC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,YAAY,UAAU,8BAA8B,CAAC,CAAA;IACvE,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,CAAA;IACnD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAA;IAChD,CAAC;IAED,MAAM,cAAc,GAAG,MAAM,KAAK,CAChC,gEAAgE,EAChE;QACE,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,UAAU;QAChB,OAAO,EAAE;YACP,CAAC,WAAW,CAAC,eAAe,CAAC,EAAE,WAAW,CAAC,gBAAgB;SAC5D;KACF,CACF,CAAA;IACD,IAAI,CAAC,cAAc,CAAC,EAAE,EAAE,CAAC;QACvB,MAAM,SAAS,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,CAAA;QAC7C,MAAM,IAAI,KAAK,CACb,oCAAoC,cAAc,CAAC,MAAM,IAAI,SAAS,EAAE,CACzE,CAAA;IACH,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,CAAA;IAE9C,MAAM,YAAY,GAChB,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,yBAAyB,EAAE,YAAY,CAAA;IAEvE,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CACb,wCAAwC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CACrE,CAAA;IACH,CAAC;IAED,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,OAAQ,EAAE,cAAc,EAAE,CAAA;AAC5D,CAAC"}

package/dist/_esm/utils/exportWallet.js

@@ -31,68 +31,59 @@
  */
 export async function exportWallet(params) {
     const { targetPublicKey, wallet } = params;
-    try {
-        const session = await wallet.getSession();
-        if (!session) {
-            throw new Error('Session not found');
-        }
-        const { organizationId } = session;
-        const listWalletsBody = JSON.stringify({
-            organizationId,
-        });
-        const listWalletsStamp = await wallet.client[session.stamperType === 'indexedDb'
-            ? 'indexedDbStamper'
-            : 'webauthnStamper'].stamp(listWalletsBody);
-        if (!listWalletsStamp) {
-            throw new Error('Failed to stamp list wallets body');
-        }
-        const listWalletsResponse = await fetch('https://api.turnkey.com/public/v1/query/list_wallets', {
-            method: 'POST',
-            body: listWalletsBody,
-            headers: {
-                [listWalletsStamp.stampHeaderName]: listWalletsStamp.stampHeaderValue,
-            },
-        });
-        if (!listWalletsResponse.ok) {
-            throw new Error('Failed to list wallets');
-        }
-        const listWalletsData = await listWalletsResponse.json();
-        const walletId = listWalletsData.wallets[0].walletId;
-        const exportWalletBody = JSON.stringify({
-            type: 'ACTIVITY_TYPE_EXPORT_WALLET',
-            timestampMs: Date.now().toString(),
-            organizationId: organizationId,
-            parameters: {
-                walletId: walletId,
-                targetPublicKey,
-                language: 'MNEMONIC_LANGUAGE_ENGLISH',
-            },
-        });
-        const exportWalletStamp = await wallet.client[session.stamperType === 'indexedDb'
-            ? 'indexedDbStamper'
-            : 'webauthnStamper'].stamp(exportWalletBody);
-        if (!exportWalletStamp) {
-            throw new Error('Failed to stamp export wallet body');
-        }
-        const exportWalletResponse = await fetch('https://api.turnkey.com/public/v1/submit/export_wallet', {
-            method: 'POST',
-            body: exportWalletBody,
-            headers: {
-                [exportWalletStamp.stampHeaderName]: exportWalletStamp.stampHeaderValue,
-            },
-        });
-        if (!exportWalletResponse.ok) {
-            throw new Error('Failed to export wallet');
-        }
-        const exportWalletData = await exportWalletResponse.json();
-        const exportBundle = exportWalletData?.activity?.result?.exportWalletResult?.exportBundle;
-        if (!exportBundle) {
-            throw new Error('Export bundle not found in response');
-        }
-        return { exportBundle, walletId, organizationId };
+    const session = await wallet.getSession();
+    if (!session) {
+        throw new Error('Session not found');
     }
-    catch (_) {
-        throw new Error('Error exporting wallet');
+    const { organizationId } = session;
+    const listWalletsBody = JSON.stringify({
+        organizationId,
+    });
+    const listWalletsStamp = await wallet.client[session.stamperType === 'apiKey' ? 'apiKeyStamper' : 'passkeyStamper'].stamp(listWalletsBody);
+    if (!listWalletsStamp) {
+        throw new Error('Failed to stamp list wallets body');
     }
+    const listWalletsResponse = await fetch('https://api.turnkey.com/public/v1/query/list_wallets', {
+        method: 'POST',
+        body: listWalletsBody,
+        headers: {
+            [listWalletsStamp.stampHeaderName]: listWalletsStamp.stampHeaderValue,
+        },
+    });
+    if (!listWalletsResponse.ok) {
+        throw new Error('Failed to list wallets');
+    }
+    const listWalletsData = await listWalletsResponse.json();
+    const walletId = listWalletsData.wallets[0].walletId;
+    const exportWalletBody = JSON.stringify({
+        type: 'ACTIVITY_TYPE_EXPORT_WALLET',
+        timestampMs: Date.now().toString(),
+        organizationId: organizationId,
+        parameters: {
+            walletId: walletId,
+            targetPublicKey,
+            language: 'MNEMONIC_LANGUAGE_ENGLISH',
+        },
+    });
+    const exportWalletStamp = await wallet.client[session.stamperType === 'apiKey' ? 'apiKeyStamper' : 'passkeyStamper'].stamp(exportWalletBody);
+    if (!exportWalletStamp) {
+        throw new Error('Failed to stamp export wallet body');
+    }
+    const exportWalletResponse = await fetch('https://api.turnkey.com/public/v1/submit/export_wallet', {
+        method: 'POST',
+        body: exportWalletBody,
+        headers: {
+            [exportWalletStamp.stampHeaderName]: exportWalletStamp.stampHeaderValue,
+        },
+    });
+    if (!exportWalletResponse.ok) {
+        throw new Error('Failed to export wallet');
+    }
+    const exportWalletData = await exportWalletResponse.json();
+    const exportBundle = exportWalletData?.activity?.result?.exportWalletResult?.exportBundle;
+    if (!exportBundle) {
+        throw new Error('Export bundle not found in response');
+    }
+    return { exportBundle, walletId, organizationId };
 }
 //# sourceMappingURL=exportWallet.js.map

package/dist/_esm/utils/exportWallet.js.map

@@ -1 +1 @@
-{"version":3,"file":"exportWallet.js","sourceRoot":"","sources":["../../../src/utils/exportWallet.ts"],"names":[],"mappings":"AASA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,MAA8B;IAE9B,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,GAAG,MAAM,CAAA;IAE1C,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,UAAU,EAAE,CAAA;QACzC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAA;QACtC,CAAC;QACD,MAAM,EAAE,cAAc,EAAE,GAAG,OAAO,CAAA;QAElC,MAAM,eAAe,GAAG,IAAI,CAAC,SAAS,CAAC;YACrC,cAAc;SACf,CAAC,CAAA;QAEF,MAAM,gBAAgB,GACpB,MAAM,MAAM,CAAC,MAAM,CACjB,OAAO,CAAC,WAAW,KAAK,WAAW;YACjC,CAAC,CAAC,kBAAkB;YACpB,CAAC,CAAC,iBAAiB,CACtB,CAAC,KAAK,CAAC,eAAe,CAAC,CAAA;QAC1B,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAA;QACtD,CAAC;QAED,MAAM,mBAAmB,GAAG,MAAM,KAAK,CACrC,sDAAsD,EACtD;YACE,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,eAAe;YACrB,OAAO,EAAE;gBACP,CAAC,gBAAgB,CAAC,eAAe,CAAC,EAAE,gBAAgB,CAAC,gBAAgB;aACtE;SACF,CACF,CAAA;QACD,IAAI,CAAC,mBAAmB,CAAC,EAAE,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAA;QAC3C,CAAC;QACD,MAAM,eAAe,GAAG,MAAM,mBAAmB,CAAC,IAAI,EAAE,CAAA;QAExD,MAAM,QAAQ,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAA;QAEpD,MAAM,gBAAgB,GAAG,IAAI,CAAC,SAAS,CAAC;YACtC,IAAI,EAAE,6BAA6B;YACnC,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;YAClC,cAAc,EAAE,cAAc;YAC9B,UAAU,EAAE;gBACV,QAAQ,EAAE,QAAQ;gBAClB,eAAe;gBACf,QAAQ,EAAE,2BAA2B;aACtC;SACF,CAAC,CAAA;QACF,MAAM,iBAAiB,GACrB,MAAM,MAAM,CAAC,MAAM,CACjB,OAAO,CAAC,WAAW,KAAK,WAAW;YACjC,CAAC,CAAC,kBAAkB;YACpB,CAAC,CAAC,iBAAiB,CACtB,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAA;QAC3B,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAA;QACvD,CAAC;QACD,MAAM,oBAAoB,GAAG,MAAM,KAAK,CACtC,wDAAwD,EACxD;YACE,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,gBAAgB;YACtB,OAAO,EAAE;gBACP,CAAC,iBAAiB,CAAC,eAAe,CAAC,EACjC,iBAAiB,CAAC,gBAAgB;aACrC;SACF,CACF,CAAA;QACD,IAAI,CAAC,oBAAoB,CAAC,EAAE,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAA;QAC5C,CAAC;QACD,MAAM,gBAAgB,GAAG,MAAM,oBAAoB,CAAC,IAAI,EAAE,CAAA;QAE1D,MAAM,YAAY,GAChB,gBAAgB,EAAE,QAAQ,EAAE,MAAM,EAAE,kBAAkB,EAAE,YAAY,CAAA;QAEtE,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAA;QACxD,CAAC;QAED,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAA;IACnD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAA;IAC3C,CAAC;AACH,CAAC"}
+{"version":3,"file":"exportWallet.js","sourceRoot":"","sources":["../../../src/utils/exportWallet.ts"],"names":[],"mappings":"AASA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,MAA8B;IAE9B,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,GAAG,MAAM,CAAA;IAE1C,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,UAAU,EAAE,CAAA;IACzC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAA;IACtC,CAAC;IACD,MAAM,EAAE,cAAc,EAAE,GAAG,OAAO,CAAA;IAElC,MAAM,eAAe,GAAG,IAAI,CAAC,SAAS,CAAC;QACrC,cAAc;KACf,CAAC,CAAA;IAEF,MAAM,gBAAgB,GACpB,MAAM,MAAM,CAAC,MAAM,CACjB,OAAO,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,gBAAgB,CACtE,CAAC,KAAK,CAAC,eAAe,CAAC,CAAA;IAC1B,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAA;IACtD,CAAC;IAED,MAAM,mBAAmB,GAAG,MAAM,KAAK,CACrC,sDAAsD,EACtD;QACE,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,eAAe;QACrB,OAAO,EAAE;YACP,CAAC,gBAAgB,CAAC,eAAe,CAAC,EAAE,gBAAgB,CAAC,gBAAgB;SACtE;KACF,CACF,CAAA;IACD,IAAI,CAAC,mBAAmB,CAAC,EAAE,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAA;IAC3C,CAAC;IACD,MAAM,eAAe,GAAG,MAAM,mBAAmB,CAAC,IAAI,EAAE,CAAA;IAExD,MAAM,QAAQ,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAA;IAEpD,MAAM,gBAAgB,GAAG,IAAI,CAAC,SAAS,CAAC;QACtC,IAAI,EAAE,6BAA6B;QACnC,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;QAClC,cAAc,EAAE,cAAc;QAC9B,UAAU,EAAE;YACV,QAAQ,EAAE,QAAQ;YAClB,eAAe;YACf,QAAQ,EAAE,2BAA2B;SACtC;KACF,CAAC,CAAA;IACF,MAAM,iBAAiB,GACrB,MAAM,MAAM,CAAC,MAAM,CACjB,OAAO,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,gBAAgB,CACtE,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAA;IAC3B,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAA;IACvD,CAAC;IACD,MAAM,oBAAoB,GAAG,MAAM,KAAK,CACtC,wDAAwD,EACxD;QACE,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,gBAAgB;QACtB,OAAO,EAAE;YACP,CAAC,iBAAiB,CAAC,eAAe,CAAC,EAAE,iBAAiB,CAAC,gBAAgB;SACxE;KACF,CACF,CAAA;IACD,IAAI,CAAC,oBAAoB,CAAC,EAAE,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAA;IAC5C,CAAC;IACD,MAAM,gBAAgB,GAAG,MAAM,oBAAoB,CAAC,IAAI,EAAE,CAAA;IAE1D,MAAM,YAAY,GAChB,gBAAgB,EAAE,QAAQ,EAAE,MAAM,EAAE,kBAAkB,EAAE,YAAY,CAAA;IAEtE,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAA;IACxD,CAAC;IAED,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAA;AACnD,CAAC"}

package/dist/_esm/utils/hpke.js

@@ -0,0 +1,119 @@
+/**
+ * HPKE (RFC 9180) seal for Turnkey enclave-encrypted requests.
+ *
+ * Suite: DHKEM(P-256, HKDF-SHA256) / HKDF-SHA256 / AES-256-GCM
+ *   - KEM ID  = 0x0010 (DHKEM-P256-HKDF-SHA256)
+ *   - KDF ID  = 0x0001 (HKDF-SHA256)
+ *   - AEAD ID = 0x0002 (AES-256-GCM)
+ *
+ * Wire format and AAD construction match Turnkey's enclave_encrypt Go package:
+ *   info = "turnkey_hpke"
+ *   aad  = enc || pkR  (both 65-byte uncompressed P-256 points)
+ *
+ * References:
+ *   - RFC 9180 §4 / §5
+ *   - tkhq/go-sdk/pkg/enclave_encrypt
+ */
+import { gcm } from '@noble/ciphers/aes.js';
+import { p256 } from '@noble/curves/nist.js';
+import { expand, extract } from '@noble/hashes/hkdf.js';
+import { sha256 } from '@noble/hashes/sha2.js';
+const KEM_ID = 0x0010;
+const KDF_ID = 0x0001;
+const AEAD_ID = 0x0002;
+// Output sizes for the chosen primitives.
+const NH = 32; // SHA-256 output
+const NK = 32; // AES-256 key
+const NN = 12; // AES-GCM nonce
+const NPK = 65; // uncompressed P-256 point: 0x04 || X || Y
+const TURNKEY_HPKE_INFO = new TextEncoder().encode('turnkey_hpke');
+const HPKE_VERSION = new TextEncoder().encode('HPKE-v1');
+// suite_id for the HPKE context: "HPKE" || I2OSP(KEM,2) || I2OSP(KDF,2) || I2OSP(AEAD,2)
+const HPKE_SUITE_ID = concat(new TextEncoder().encode('HPKE'), i2osp(KEM_ID, 2), i2osp(KDF_ID, 2), i2osp(AEAD_ID, 2));
+// suite_id for the KEM scope: "KEM" || I2OSP(KEM,2)
+const KEM_SUITE_ID = concat(new TextEncoder().encode('KEM'), i2osp(KEM_ID, 2));
+function concat(...parts) {
+    const total = parts.reduce((sum, p) => sum + p.length, 0);
+    const out = new Uint8Array(total);
+    let offset = 0;
+    for (const p of parts) {
+        out.set(p, offset);
+        offset += p.length;
+    }
+    return out;
+}
+function i2osp(n, len) {
+    const out = new Uint8Array(len);
+    for (let i = len - 1; i >= 0; i--) {
+        out[i] = n & 0xff;
+        n >>>= 8;
+    }
+    return out;
+}
+// LabeledExtract(salt, label, ikm, suite_id) =
+//   HKDF-Extract(salt, "HPKE-v1" || suite_id || label || ikm)
+function labeledExtract(salt, label, ikm, suiteId) {
+    const labeledIkm = concat(HPKE_VERSION, suiteId, new TextEncoder().encode(label), ikm);
+    return extract(sha256, labeledIkm, salt);
+}
+// LabeledExpand(prk, label, info, L, suite_id) =
+//   HKDF-Expand(prk, I2OSP(L,2) || "HPKE-v1" || suite_id || label || info, L)
+function labeledExpand(prk, label, info, length, suiteId) {
+    const labeledInfo = concat(i2osp(length, 2), HPKE_VERSION, suiteId, new TextEncoder().encode(label), info);
+    return expand(sha256, prk, labeledInfo, length);
+}
+// DHKEM Encap: returns (sharedSecret, enc)
+// sharedSecret is 32 bytes; enc is the serialized ephemeral pubkey (65 bytes uncompressed).
+function encap(receiverPublicKey) {
+    const ephSk = p256.utils.randomSecretKey();
+    const ephPkUncompressed = p256.getPublicKey(ephSk, false);
+    // ECDH: returns the serialized shared point. Pass isCompressed=true so the
+    // first byte is the SEC1 prefix and bytes [1, 33) are the x-coordinate.
+    const sharedPoint = p256.getSharedSecret(ephSk, receiverPublicKey, 
+    /* isCompressed */ true);
+    const dh = sharedPoint.slice(1, 33);
+    const kemContext = concat(ephPkUncompressed, receiverPublicKey);
+    const eaePrk = labeledExtract(new Uint8Array(0), 'eae_prk', dh, KEM_SUITE_ID);
+    const sharedSecret = labeledExpand(eaePrk, 'shared_secret', kemContext, NH, KEM_SUITE_ID);
+    return { sharedSecret, enc: ephPkUncompressed };
+}
+// KeySchedule for mode_base: returns (key, base_nonce).
+function keySchedule(sharedSecret, info) {
+    const empty = new Uint8Array(0);
+    const pskIdHash = labeledExtract(empty, 'psk_id_hash', empty, HPKE_SUITE_ID);
+    const infoHash = labeledExtract(empty, 'info_hash', info, HPKE_SUITE_ID);
+    // mode_base = 0x00 prepended to (psk_id_hash || info_hash)
+    const keyScheduleContext = concat(new Uint8Array([0]), pskIdHash, infoHash);
+    const secret = labeledExtract(sharedSecret, 'secret', empty, HPKE_SUITE_ID);
+    const key = labeledExpand(secret, 'key', keyScheduleContext, NK, HPKE_SUITE_ID);
+    const baseNonce = labeledExpand(secret, 'base_nonce', keyScheduleContext, NN, HPKE_SUITE_ID);
+    return { key, baseNonce };
+}
+function aesGcmSeal(key, nonce, aad, plaintext) {
+    // Returns ciphertext || tag (16 bytes appended) — matches the single-blob
+    // format Turnkey's `Sealer.Seal` and Web Crypto's AES-GCM produce.
+    return gcm(key, nonce, aad).encrypt(plaintext);
+}
+/**
+ * Single-shot HPKE seal in mode_base for Turnkey's TLS Fetcher enclave.
+ *
+ * Uses the fixed Turnkey `info = "turnkey_hpke"` and the AAD shape
+ * `enc || receiverPublicKey` so the resulting bundle is decryptable by
+ * `enclave_encrypt.EnclaveEncryptServer.Decrypt`.
+ *
+ * @param receiverPublicKey - The enclave's ephemeral target public key
+ *   (uncompressed P-256, 65 bytes), extracted from the encryption target bundle.
+ * @param plaintext - The bytes to encrypt (e.g. the JSON-encoded OTP attempt).
+ */
+export async function hpkeSealP256({ receiverPublicKey, plaintext, }) {
+    if (receiverPublicKey.length !== NPK) {
+        throw new Error(`hpkeSealP256: receiverPublicKey must be ${NPK} bytes (uncompressed P-256), got ${receiverPublicKey.length}`);
+    }
+    const { sharedSecret, enc } = encap(receiverPublicKey);
+    const { key, baseNonce } = keySchedule(sharedSecret, TURNKEY_HPKE_INFO);
+    // First message of the context, sequence 0 → nonce = base_nonce.
+    const aad = concat(enc, receiverPublicKey);
+    const ciphertext = aesGcmSeal(key, baseNonce, aad, plaintext);
+    return { encappedPublic: enc, ciphertext };
+}
+//# sourceMappingURL=hpke.js.map

package/dist/_esm/utils/hpke.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hpke.js","sourceRoot":"","sources":["../../../src/utils/hpke.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,GAAG,EAAE,MAAM,uBAAuB,CAAA;AAC3C,OAAO,EAAE,IAAI,EAAE,MAAM,uBAAuB,CAAA;AAC5C,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAA;AACvD,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAA;AAE9C,MAAM,MAAM,GAAG,MAAM,CAAA;AACrB,MAAM,MAAM,GAAG,MAAM,CAAA;AACrB,MAAM,OAAO,GAAG,MAAM,CAAA;AAEtB,0CAA0C;AAC1C,MAAM,EAAE,GAAG,EAAE,CAAA,CAAC,iBAAiB;AAC/B,MAAM,EAAE,GAAG,EAAE,CAAA,CAAC,cAAc;AAC5B,MAAM,EAAE,GAAG,EAAE,CAAA,CAAC,gBAAgB;AAC9B,MAAM,GAAG,GAAG,EAAE,CAAA,CAAC,2CAA2C;AAE1D,MAAM,iBAAiB,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,CAAA;AAElE,MAAM,YAAY,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;AAExD,yFAAyF;AACzF,MAAM,aAAa,GAAG,MAAM,CAC1B,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,EAChC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,EAChB,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,EAChB,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAClB,CAAA;AAED,oDAAoD;AACpD,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAA;AAE9E,SAAS,MAAM,CAAC,GAAG,KAAmB;IACpC,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAA;IACzD,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,CAAA;IACjC,IAAI,MAAM,GAAG,CAAC,CAAA;IACd,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAA;QAClB,MAAM,IAAI,CAAC,CAAC,MAAM,CAAA;IACpB,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,SAAS,KAAK,CAAC,CAAS,EAAE,GAAW;IACnC,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,CAAA;IAC/B,KAAK,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,IAAI,CAAA;QACjB,CAAC,MAAM,CAAC,CAAA;IACV,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,+CAA+C;AAC/C,8DAA8D;AAC9D,SAAS,cAAc,CACrB,IAAgB,EAChB,KAAa,EACb,GAAe,EACf,OAAmB;IAEnB,MAAM,UAAU,GAAG,MAAM,CACvB,YAAY,EACZ,OAAO,EACP,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,EAC/B,GAAG,CACJ,CAAA;IACD,OAAO,OAAO,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC,CAAA;AAC1C,CAAC;AAED,iDAAiD;AACjD,8EAA8E;AAC9E,SAAS,aAAa,CACpB,GAAe,EACf,KAAa,EACb,IAAgB,EAChB,MAAc,EACd,OAAmB;IAEnB,MAAM,WAAW,GAAG,MAAM,CACxB,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,EAChB,YAAY,EACZ,OAAO,EACP,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,EAC/B,IAAI,CACL,CAAA;IACD,OAAO,MAAM,CAAC,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,MAAM,CAAC,CAAA;AACjD,CAAC;AAED,2CAA2C;AAC3C,4FAA4F;AAC5F,SAAS,KAAK,CAAC,iBAA6B;IAI1C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,EAAE,CAAA;IAC1C,MAAM,iBAAiB,GAAG,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;IAEzD,2EAA2E;IAC3E,wEAAwE;IACxE,MAAM,WAAW,GAAG,IAAI,CAAC,eAAe,CACtC,KAAK,EACL,iBAAiB;IACjB,kBAAkB,CAAC,IAAI,CACxB,CAAA;IACD,MAAM,EAAE,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;IAEnC,MAAM,UAAU,GAAG,MAAM,CAAC,iBAAiB,EAAE,iBAAiB,CAAC,CAAA;IAE/D,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,YAAY,CAAC,CAAA;IAC7E,MAAM,YAAY,GAAG,aAAa,CAChC,MAAM,EACN,eAAe,EACf,UAAU,EACV,EAAE,EACF,YAAY,CACb,CAAA;IAED,OAAO,EAAE,YAAY,EAAE,GAAG,EAAE,iBAAiB,EAAE,CAAA;AACjD,CAAC;AAED,wDAAwD;AACxD,SAAS,WAAW,CAClB,YAAwB,EACxB,IAAgB;IAEhB,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,CAAA;IAE/B,MAAM,SAAS,GAAG,cAAc,CAAC,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE,aAAa,CAAC,CAAA;IAC5E,MAAM,QAAQ,GAAG,cAAc,CAAC,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,aAAa,CAAC,CAAA;IAExE,2DAA2D;IAC3D,MAAM,kBAAkB,GAAG,MAAM,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAA;IAE3E,MAAM,MAAM,GAAG,cAAc,CAAC,YAAY,EAAE,QAAQ,EAAE,KAAK,EAAE,aAAa,CAAC,CAAA;IAE3E,MAAM,GAAG,GAAG,aAAa,CACvB,MAAM,EACN,KAAK,EACL,kBAAkB,EAClB,EAAE,EACF,aAAa,CACd,CAAA;IACD,MAAM,SAAS,GAAG,aAAa,CAC7B,MAAM,EACN,YAAY,EACZ,kBAAkB,EAClB,EAAE,EACF,aAAa,CACd,CAAA;IAED,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,CAAA;AAC3B,CAAC;AAED,SAAS,UAAU,CACjB,GAAe,EACf,KAAiB,EACjB,GAAe,EACf,SAAqB;IAErB,0EAA0E;IAC1E,mEAAmE;IACnE,OAAO,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;AAChD,CAAC;AASD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,EACjC,iBAAiB,EACjB,SAAS,GAIV;IACC,IAAI,iBAAiB,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CACb,2CAA2C,GAAG,oCAAoC,iBAAiB,CAAC,MAAM,EAAE,CAC7G,CAAA;IACH,CAAC;IAED,MAAM,EAAE,YAAY,EAAE,GAAG,EAAE,GAAG,KAAK,CAAC,iBAAiB,CAAC,CAAA;IACtD,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,WAAW,CAAC,YAAY,EAAE,iBAAiB,CAAC,CAAA;IAEvE,iEAAiE;IACjE,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAA;IAC1C,MAAM,UAAU,GAAG,UAAU,CAAC,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,CAAC,CAAA;IAE7D,OAAO,EAAE,cAAc,EAAE,GAAG,EAAE,UAAU,EAAE,CAAA;AAC5C,CAAC"}

package/dist/_esm/utils/platform.js

@@ -0,0 +1,16 @@
+export function isReactNative() {
+    if (typeof navigator !== 'undefined' &&
+        navigator.product === 'ReactNative') {
+        return true;
+    }
+    if (typeof window !== 'undefined' &&
+        Object.hasOwn(window, 'ReactNativeWebView')) {
+        return true;
+    }
+    if (typeof globalThis !== 'undefined' &&
+        Object.hasOwn(globalThis, 'HermesEngine')) {
+        return true;
+    }
+    return false;
+}
+//# sourceMappingURL=platform.js.map

package/dist/_esm/utils/platform.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform.js","sourceRoot":"","sources":["../../../src/utils/platform.ts"],"names":[],"mappings":"AAAA,MAAM,UAAU,aAAa;IAC3B,IACE,OAAO,SAAS,KAAK,WAAW;QAC/B,SAAkC,CAAC,OAAO,KAAK,aAAa,EAC7D,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IACD,IACE,OAAO,MAAM,KAAK,WAAW;QAC7B,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,EAC3C,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IACD,IACE,OAAO,UAAU,KAAK,WAAW;QACjC,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,cAAc,CAAC,EACzC,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC"}

package/dist/_esm/utils/resolveOrganizationId.js

@@ -0,0 +1,27 @@
+/**
+ * Builds a memoized resolver for the Turnkey parent org that stamp-login is
+ * signed against. Resolution order:
+ *   1. explicit override (self-hosted / local backends)
+ *   2. value fetched from the backend, cached after the first success
+ *   3. fallback (the known prod parent org) if the fetch fails
+ *
+ * The fetch is only attempted when there's no override, and only once — a
+ * failure is cached as the fallback so we don't refetch on every login.
+ */
+export function createOrganizationIdResolver(opts) {
+    let cached;
+    return async function resolveOrganizationId() {
+        if (opts.organizationId)
+            return opts.organizationId;
+        if (cached === undefined) {
+            try {
+                cached = await opts.fetchParentOrgId();
+            }
+            catch {
+                cached = opts.fallback;
+            }
+        }
+        return cached;
+    };
+}
+//# sourceMappingURL=resolveOrganizationId.js.map

package/dist/_esm/utils/resolveOrganizationId.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolveOrganizationId.js","sourceRoot":"","sources":["../../../src/utils/resolveOrganizationId.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,MAAM,UAAU,4BAA4B,CAAC,IAI5C;IACC,IAAI,MAA0B,CAAA;IAC9B,OAAO,KAAK,UAAU,qBAAqB;QACzC,IAAI,IAAI,CAAC,cAAc;YAAE,OAAO,IAAI,CAAC,cAAc,CAAA;QACnD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,IAAI,CAAC;gBACH,MAAM,GAAG,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAA;YACxC,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAA;YACxB,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAA;IACf,CAAC,CAAA;AACH,CAAC"}

package/dist/_esm/utils/utils.js

@@ -12,7 +12,8 @@ export function parseSession(token) {
     if (!payload) {
         throw new Error('Invalid JWT: Missing payload');
     }
-    const decoded = JSON.parse(Buffer.from(payload, 'base64').toString());
+    const base64 = payload.replace(/-/g, '+').replace(/_/g, '/');
+    const decoded = JSON.parse(atob(base64));
     const { exp, public_key: publicKey, session_type: sessionType, user_id: userId, organization_id: organizationId, } = decoded;
     if (!exp || !publicKey || !sessionType || !userId || !organizationId) {
         throw new Error('JWT payload missing required fields');
@@ -51,11 +52,9 @@ export const generateRandomBuffer = () => {
  * @returns {string} - The encoded challenge.
  */
 export const base64UrlEncode = (challenge) => {
-    return Buffer.from(challenge)
-        .toString('base64')
-        .replace(/\+/g, '-')
-        .replace(/\//g, '_')
-        .replace(/=/g, '');
+    const bytes = new Uint8Array(challenge);
+    const binary = String.fromCharCode(...bytes);
+    return btoa(binary).replace(/\+/g, '-').replace(/\//g, '_').replace(/=/g, '');
 };
 /**
  * Compresses an uncompressed P-256 public key into its 33-byte compressed form.