@zerodev/wallet-core 0.0.2 → 0.0.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zerodev/wallet-core",
-  "version": "0.0.2",
+  "version": "0.0.4",
   "description": "ZeroDev Wallet SDK built on Turnkey",
   "repository": {
     "type": "git",

package/src/actions/auth/getAuthenticators.ts

@@ -37,6 +37,21 @@ export type ApiKeyAuthenticator = {
   [key: string]: unknown
 }
 
+/** A temporary session key registered for an authenticated SDK session. */
+export type SessionKeyAuthenticator = {
+  /** Current backend wire casing (the Go model has no JSON tags). */
+  ApiKey?: string
+  KeyType?: string
+  ExpiresAt?: string
+  TurnkeyId?: string
+  /** Forward-compatible casing if the backend adds JSON tags. */
+  apiKey?: string
+  keyType?: string
+  expiresAt?: string
+  turnkeyId?: string
+  [key: string]: unknown
+}
+
 export type GetAuthenticatorsReturnType = {
   /** OAuth providers linked to the user (null if none) */
   oauths: OAuthAuthenticator[] | null
@@ -46,13 +61,16 @@ export type GetAuthenticatorsReturnType = {
   emailContacts: EmailContact[] | null
   /** API keys associated with the user (null if none) */
   apiKeys: ApiKeyAuthenticator[] | null
+  /** Temporary session keys associated with the user (null if none) */
+  sessionKeys: SessionKeyAuthenticator[] | null
 }
 
 /**
- * Fetches all authenticators (oauths, passkeys, emailContacts, apiKeys) for
+ * Fetches all authenticators (oauths, passkeys, emailContacts, apiKeys,
+ * sessionKeys) for
  * the authenticated user within the given project/sub-organization.
  *
- * Corresponds to `POST /api/v1/{projectId}/authenticators`.
+ * Corresponds to `GET /api/v1/{projectId}/authenticators`.
  *
  * @param client - The ZeroDev Wallet client
  * @param params - The parameters for the authenticators request

package/src/actions/auth/index.ts

@@ -17,6 +17,7 @@ export {
   getAuthenticators,
   type OAuthAuthenticator,
   type PasskeyAuthenticator,
+  type SessionKeyAuthenticator,
 } from './getAuthenticators.js'
 export {
   type GetAuthProxyConfigIdReturnType,
@@ -46,6 +47,11 @@ export {
   type LoginWithStampReturnType,
   loginWithStamp,
 } from './loginWithStamp.js'
+export {
+  type LogoutParameters,
+  type LogoutReturnType,
+  logout,
+} from './logout.js'
 export {
   type OtpContact,
   type RegisterWithOTPParameters,

package/src/actions/auth/logout.ts

@@ -0,0 +1,35 @@
+import type { Client } from '../../client/types.js'
+
+export type LogoutParameters = {
+  projectId: string
+  organizationId: string
+  userId: string
+  apiKeyId: string
+}
+
+export type LogoutReturnType = Record<string, never>
+
+/** Revokes the caller's current Turnkey session key. */
+export async function logout(
+  client: Client,
+  params: LogoutParameters,
+): Promise<LogoutReturnType> {
+  const body = {
+    organizationId: params.organizationId,
+    parameters: {
+      apiKeyIds: [params.apiKeyId],
+      userId: params.userId,
+    },
+    timestampMs: Date.now().toString(),
+    type: 'ACTIVITY_TYPE_DELETE_API_KEYS',
+  }
+
+  return await client.request({
+    path: `${params.projectId}/auth/logout`,
+    method: 'POST',
+    body,
+    stamp: true,
+    stampWith: 'apiKey',
+    stampPostion: 'headers',
+  })
+}

package/src/actions/index.ts

@@ -23,7 +23,10 @@ export {
   getWhoami,
   type LoginWithOTPParameters,
   type LoginWithOTPReturnType,
+  type LogoutParameters,
+  type LogoutReturnType,
   loginWithOTP,
+  logout,
   type OAuthAuthenticator,
   type OtpContact,
   type PasskeyAuthenticator,
@@ -33,6 +36,7 @@ export {
   type RegisterWithPasskeyReturnType,
   registerWithOTP,
   registerWithPasskey,
+  type SessionKeyAuthenticator,
 } from './auth/index.js'
 
 // Wallet actions

package/src/actions/wallet/signingUtils.ts

@@ -1,6 +1,14 @@
 import { canonicalizeEx } from 'json-canonicalize'
 import type { Hex } from 'viem'
-import { hashMessage, keccak256, toHex } from 'viem'
+import {
+  hashMessage,
+  isAddress,
+  isAddressEqual,
+  keccak256,
+  recoverAddress,
+  toHex,
+  zeroAddress,
+} from 'viem'
 import type { Client } from '../../client/types.js'
 
 export type TurnkeyPayload = {
@@ -20,13 +28,25 @@ export function buildTurnkeyPayload(
   address: Hex,
   payloadHash: string,
 ): TurnkeyPayload {
+  if (
+    !isAddress(address, { strict: false }) ||
+    isAddressEqual(address, zeroAddress)
+  ) {
+    throw new Error(
+      `Refusing to sign with an invalid or zero address: ${address}`,
+    )
+  }
+  const normalizedPayloadHash = payloadHash.replace(/^0x/, '')
+  if (!/^[0-9a-fA-F]{64}$/.test(normalizedPayloadHash)) {
+    throw new Error('Refusing to sign a payload that is not a 32-byte hex hash')
+  }
   return {
     type: 'ACTIVITY_TYPE_SIGN_RAW_PAYLOAD_V2',
     timestampMs: Date.now().toString(),
     organizationId,
     parameters: {
       signWith: address,
-      payload: payloadHash,
+      payload: normalizedPayloadHash,
       encoding: 'PAYLOAD_ENCODING_HEXADECIMAL',
       hashFunction: 'HASH_FUNCTION_NO_OP',
     },
@@ -63,7 +83,7 @@ export async function sendSigningRequest(
   const fullBodyString = canonicalizeEx(fullBody)
   const outerStamp = await client.apiKeyStamper.stamp(fullBodyString)
 
-  const { signature } = await client.request({
+  const response = await client.request({
     path: `${projectId}/${path}`,
     method: 'POST',
     body: fullBody,
@@ -72,8 +92,27 @@ export async function sendSigningRequest(
       Authorization: `Bearer ${token}`,
     },
   })
+  const signature = response?.signature
+  if (typeof signature !== 'string' || !signature) {
+    throw new Error('Signing response did not contain a valid signature')
+  }
+
+  const normalizedSignature = (
+    signature.startsWith('0x') ? signature : `0x${signature}`
+  ) as Hex
+  const recoveredAddress = await recoverAddress({
+    hash: `0x${turnkeyPayload.parameters.payload}`,
+    signature: normalizedSignature,
+  })
+  if (
+    !isAddressEqual(recoveredAddress, turnkeyPayload.parameters.signWith as Hex)
+  ) {
+    throw new Error(
+      `Signing response did not recover to expected owner ${turnkeyPayload.parameters.signWith}.`,
+    )
+  }
 
-  return (signature.startsWith('0x') ? signature : `0x${signature}`) as Hex
+  return normalizedSignature
 }
 
 /**

package/src/adapters/viem.ts

@@ -6,9 +6,12 @@ import {
   hashTypedData,
   isAddress,
   isAddressEqual,
+  keccak256,
   type LocalAccount,
   numberToHex,
   parseSignature,
+  recoverAddress,
+  recoverMessageAddress,
   type SerializeTransactionFn,
   type SignableMessage,
   serializeTransaction,
@@ -36,11 +39,12 @@ export async function toViemAccount(
   params: ToViemAccountParams,
 ): Promise<LocalAccount> {
   const { client, organizationId, projectId, getToken } = params
+  const token = await getToken()
 
   const walletResponse = await client.getUserWallet({
     organizationId,
     projectId,
-    token: await getToken(),
+    token,
   })
   const address = walletResponse.walletAddresses[0]
   if (
@@ -53,6 +57,15 @@ export async function toViemAccount(
     )
   }
 
+  const assertOwner = async (recovered: Promise<Hex>) => {
+    const recoveredAddress = await recovered
+    if (!isAddressEqual(address, recoveredAddress)) {
+      throw new Error(
+        `Signing response did not recover to wallet owner ${address}.`,
+      )
+    }
+  }
+
   // Modified from: https://github.com/tkhq/sdk/blob/4e439bf2973ea13b51d981d7c24a4841d4e5fd5f/packages/viem/src/index.ts#L419-L461
   const signTransactionInternal = async <
     TTransactionSerializable extends TransactionSerializable,
@@ -76,9 +89,12 @@ export async function toViemAccount(
       address,
       unsignedTransaction: nonHexPrefixedSerializedTx,
     })
+    await assertOwner(
+      recoverAddress({ hash: keccak256(serializedTx), signature }),
+    )
 
     const { r, s, v, yParity } = parseSignature(signature)
-    return serializeTransaction(transaction, { r, s, v, yParity })
+    return serializer(transaction, { r, s, v, yParity })
   }
 
   return toAccount({
@@ -86,7 +102,7 @@ export async function toViemAccount(
 
     async signMessage({ message }: { message: SignableMessage }): Promise<Hex> {
       if (typeof message === 'string') {
-        return client.signMessage({
+        const signature = await client.signMessage({
           organizationId,
           projectId,
           token: await getToken(),
@@ -94,13 +110,15 @@ export async function toViemAccount(
           message,
           encoding: 'utf8',
         })
+        await assertOwner(recoverMessageAddress({ message, signature }))
+        return signature
       }
       // Raw message (Hex or ByteArray)
       const raw =
         typeof message.raw === 'string'
           ? message.raw.replace(/^0x/, '')
           : bytesToHex(message.raw).slice(2)
-      return client.signMessage({
+      const signature = await client.signMessage({
         organizationId,
         projectId,
         token: await getToken(),
@@ -108,6 +126,13 @@ export async function toViemAccount(
         message: raw,
         encoding: 'hex',
       })
+      await assertOwner(
+        recoverMessageAddress({
+          message: { raw: `0x${raw}` as Hex },
+          signature,
+        }),
+      )
+      return signature
     },
 
     signTransaction: async <
@@ -137,17 +162,20 @@ export async function toViemAccount(
           }),
         },
       } as Parameters<typeof serializeTypedData>[0])
-      return client.signTypedDataV4({
+      const typedDataHash = hashTypedData(
+        typedData as Parameters<typeof hashTypedData>[0],
+      )
+      const signature = await client.signTypedDataV4({
         organizationId,
         projectId,
         token: await getToken(),
         address,
         unsignedTypedDataV4: serializedTypedData,
         encoding: 'utf8',
-        typedDataHash: hashTypedData(
-          typedData as Parameters<typeof hashTypedData>[0],
-        ).slice(2),
+        typedDataHash: typedDataHash.slice(2),
       })
+      await assertOwner(recoverAddress({ hash: typedDataHash, signature }))
+      return signature
     },
 
     async signAuthorization(
@@ -184,15 +212,15 @@ export async function toViemAccount(
         unsignedTransaction,
         hashedAuthorization: hashedAuthorization.slice(2),
       })
-
-      const parsedSignature = parseSignature(signature)
+      await assertOwner(
+        recoverAddress({ hash: hashedAuthorization, signature }),
+      )
 
       return {
         address: authAddress,
         chainId,
         nonce,
-        ...parsedSignature,
-        yParity: parsedSignature.v === BigInt(27) ? 0 : 1,
+        ...parseSignature(signature),
       } as SignAuthorizationReturnType
     },
   })

package/src/client/decorators/client.ts

@@ -28,7 +28,10 @@ import {
   getWhoami,
   type LoginWithOTPParameters,
   type LoginWithOTPReturnType,
+  type LogoutParameters,
+  type LogoutReturnType,
   loginWithOTP,
+  logout,
   type RegisterWithOTPParameters,
   type RegisterWithOTPReturnType,
   type RegisterWithPasskeyParameters,
@@ -85,6 +88,9 @@ export type ZeroDevWalletActions = {
     params: GetAuthenticatorsParameters,
   ) => Promise<GetAuthenticatorsReturnType>
 
+  /** Revokes the caller's current Turnkey session key. */
+  logout: (params: LogoutParameters) => Promise<LogoutReturnType>
+
   // Wallet actions
   /**
    * Gets the user's wallet information
@@ -203,6 +209,7 @@ export function zeroDevWalletActions(client: Client): ZeroDevWalletActions {
     authenticateWithOAuth: (params) => authenticateWithOAuth(client, params),
     getWhoami: (params) => getWhoami(client, params),
     getAuthenticators: (params) => getAuthenticators(client, params),
+    logout: (params) => logout(client, params),
 
     // Wallet actions
     getUserWallet: (params) => getUserWallet(client, params),

package/src/client/transports/rest.ts

@@ -1,6 +1,6 @@
 import { canonicalizeEx } from 'json-canonicalize'
 import { RestRequestError, RestTimeoutError } from '../../errors/request.js'
-import type { ApiKeyStamper, PasskeyStamper } from '../../stampers/types.js'
+import type { Stamper } from '../../stampers/types.js'
 import type { StamperType } from '../../types/session.js'
 
 export type RestRequestArgs = {
@@ -40,8 +40,8 @@ export type RestTransportConfig = {
   timeoutMs?: number
   key?: string
   name?: string
-  apiKeyStamper: ApiKeyStamper
-  passkeyStamper: PasskeyStamper
+  apiKeyStamper: Stamper
+  passkeyStamper: Stamper
 }
 
 export function rest(url: string, cfg: RestTransportConfig): RestTransport {
@@ -64,7 +64,7 @@ export function rest(url: string, cfg: RestTransportConfig): RestTransport {
 
       // Handle stamping if requested
       if (args.stamp) {
-        let stamper: ApiKeyStamper | PasskeyStamper
+        let stamper: Stamper
         if (args.stampWith === 'apiKey') {
           stamper = cfg.apiKeyStamper
         } else if (args.stampWith === 'passkey') {