@agent-shield/custody-crossmint 0.1.0

package/dist/adapter.d.ts

@@ -0,0 +1,104 @@
+/**
+ * CrossmintWallet — WalletLike adapter for Crossmint TEE-backed signing.
+ *
+ * The private key lives in Crossmint's hardware enclave (Intel TDX).
+ * The agent only gets a signing interface — it never sees or touches the key.
+ *
+ * Works with shield() out of the box:
+ *   const wallet = shield(await crossmint({ apiKey }), { maxSpend: '500 USDC/day' });
+ */
+import { PublicKey, Transaction, VersionedTransaction } from "@solana/web3.js";
+import { CrossmintWalletConfig } from "./config";
+/**
+ * Minimal wallet interface — identical to the one in @agent-shield/solana.
+ * Duplicated here to avoid a hard dependency on the wrapper package.
+ */
+export interface WalletLike {
+    publicKey: PublicKey;
+    signTransaction<T extends Transaction | VersionedTransaction>(tx: T): Promise<T>;
+    signAllTransactions?<T extends Transaction | VersionedTransaction>(txs: T[]): Promise<T[]>;
+}
+/**
+ * Abstraction over the Crossmint SDK client for testability.
+ * In production, this wraps @crossmint/wallets-sdk.
+ * In tests, a mock implementation is injected.
+ */
+export interface CrossmintSDKClient {
+    /** Create a new wallet and return its address + locator. */
+    createWallet(params: {
+        chain: string;
+        signer: {
+            type: string;
+        };
+        linkedUser?: string;
+    }): Promise<{
+        address: string;
+        locator: string;
+    }>;
+    /** Get an existing wallet's address by locator. */
+    getWallet(locator: string): Promise<{
+        address: string;
+    }>;
+    /** Sign a serialized transaction. Returns the signed transaction bytes (base64). */
+    signTransaction(locator: string, transaction: string, encoding: "base58" | "base64"): Promise<{
+        signedTransaction: string;
+    }>;
+}
+/**
+ * Default SDK client that calls Crossmint's REST API directly.
+ * This avoids a hard dependency on @crossmint/wallets-sdk at runtime,
+ * making it easy to swap, mock, or use the REST API directly.
+ */
+export declare class CrossmintRESTClient implements CrossmintSDKClient {
+    private readonly apiKey;
+    private readonly baseUrl;
+    constructor(apiKey: string, baseUrl: string);
+    createWallet(params: {
+        chain: string;
+        signer: {
+            type: string;
+        };
+        linkedUser?: string;
+    }): Promise<{
+        address: string;
+        locator: string;
+    }>;
+    getWallet(locator: string): Promise<{
+        address: string;
+    }>;
+    signTransaction(locator: string, transaction: string, encoding: "base58" | "base64"): Promise<{
+        signedTransaction: string;
+    }>;
+}
+/**
+ * CrossmintWallet — a WalletLike that signs transactions via Crossmint's TEE.
+ *
+ * Use the static `create()` method to instantiate:
+ *   const wallet = await CrossmintWallet.create({ apiKey: '...' });
+ *   const shielded = shield(wallet, { maxSpend: '500 USDC/day' });
+ */
+export declare class CrossmintWallet implements WalletLike {
+    readonly publicKey: PublicKey;
+    readonly locator: string;
+    readonly provider: string;
+    private readonly client;
+    private constructor();
+    /**
+     * Create a CrossmintWallet. If no locator is provided, a new wallet is created
+     * via the Crossmint API. The private key never leaves the TEE.
+     */
+    static create(config: CrossmintWalletConfig, 
+    /** Injectable SDK client for testing. Uses REST client by default. */
+    client?: CrossmintSDKClient): Promise<CrossmintWallet>;
+    /**
+     * Sign a transaction via Crossmint's TEE.
+     * The transaction is serialized, sent to Crossmint, signed in hardware,
+     * and the signed result is deserialized back.
+     */
+    signTransaction<T extends Transaction | VersionedTransaction>(tx: T): Promise<T>;
+    /**
+     * Sign multiple transactions sequentially via the TEE.
+     */
+    signAllTransactions<T extends Transaction | VersionedTransaction>(txs: T[]): Promise<T[]>;
+}
+//# sourceMappingURL=adapter.d.ts.map

package/dist/adapter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"adapter.d.ts","sourceRoot":"","sources":["../src/adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAC/E,OAAO,EAAE,qBAAqB,EAAkB,MAAM,UAAU,CAAC;AAEjE;;;GAGG;AACH,MAAM,WAAW,UAAU;IACzB,SAAS,EAAE,SAAS,CAAC;IACrB,eAAe,CAAC,CAAC,SAAS,WAAW,GAAG,oBAAoB,EAC1D,EAAE,EAAE,CAAC,GACJ,OAAO,CAAC,CAAC,CAAC,CAAC;IACd,mBAAmB,CAAC,CAAC,CAAC,SAAS,WAAW,GAAG,oBAAoB,EAC/D,GAAG,EAAE,CAAC,EAAE,GACP,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC;CACjB;AAED;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,4DAA4D;IAC5D,YAAY,CAAC,MAAM,EAAE;QACnB,KAAK,EAAE,MAAM,CAAC;QACd,MAAM,EAAE;YAAE,IAAI,EAAE,MAAM,CAAA;SAAE,CAAC;QACzB,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAElD,mDAAmD;IACnD,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAEzD,oFAAoF;IACpF,eAAe,CACb,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,QAAQ,GAAG,QAAQ,GAC5B,OAAO,CAAC;QAAE,iBAAiB,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC3C;AAED;;;;GAIG;AACH,qBAAa,mBAAoB,YAAW,kBAAkB;IAC5D,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;gBAErB,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;IAKrC,YAAY,CAAC,MAAM,EAAE;QACzB,KAAK,EAAE,MAAM,CAAC;QACd,MAAM,EAAE;YAAE,IAAI,EAAE,MAAM,CAAA;SAAE,CAAC;QACzB,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAwC3C,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IA6BxD,eAAe,CACnB,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,QAAQ,GAAG,QAAQ,GAC5B,OAAO,CAAC;QAAE,iBAAiB,EAAE,MAAM,CAAA;KAAE,CAAC;CAqC1C;AAED;;;;;;GAMG;AACH,qBAAa,eAAgB,YAAW,UAAU;IAChD,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAe;IAExC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAqB;IAE5C,OAAO;IAUP;;;OAGG;WACU,MAAM,CACjB,MAAM,EAAE,qBAAqB;IAC7B,sEAAsE;IACtE,MAAM,CAAC,EAAE,kBAAkB,GAC1B,OAAO,CAAC,eAAe,CAAC;IA+B3B;;;;OAIG;IACG,eAAe,CAAC,CAAC,SAAS,WAAW,GAAG,oBAAoB,EAChE,EAAE,EAAE,CAAC,GACJ,OAAO,CAAC,CAAC,CAAC;IAoBb;;OAEG;IACG,mBAAmB,CAAC,CAAC,SAAS,WAAW,GAAG,oBAAoB,EACpE,GAAG,EAAE,CAAC,EAAE,GACP,OAAO,CAAC,CAAC,EAAE,CAAC;CAOhB"}

package/dist/adapter.js

@@ -0,0 +1,180 @@
+"use strict";
+/**
+ * CrossmintWallet — WalletLike adapter for Crossmint TEE-backed signing.
+ *
+ * The private key lives in Crossmint's hardware enclave (Intel TDX).
+ * The agent only gets a signing interface — it never sees or touches the key.
+ *
+ * Works with shield() out of the box:
+ *   const wallet = shield(await crossmint({ apiKey }), { maxSpend: '500 USDC/day' });
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CrossmintWallet = exports.CrossmintRESTClient = void 0;
+const web3_js_1 = require("@solana/web3.js");
+const config_1 = require("./config");
+/**
+ * Default SDK client that calls Crossmint's REST API directly.
+ * This avoids a hard dependency on @crossmint/wallets-sdk at runtime,
+ * making it easy to swap, mock, or use the REST API directly.
+ */
+class CrossmintRESTClient {
+    constructor(apiKey, baseUrl) {
+        this.apiKey = apiKey;
+        this.baseUrl = baseUrl.replace(/\/$/, "");
+    }
+    async createWallet(params) {
+        const body = {
+            type: "solana-mpc-wallet",
+            config: {
+                adminSigner: { type: params.signer.type },
+            },
+        };
+        if (params.linkedUser) {
+            body.linkedUser = params.linkedUser;
+        }
+        const res = await fetch(`${this.baseUrl}/api/2022-06-09/wallets`, {
+            method: "POST",
+            headers: {
+                "X-API-KEY": this.apiKey,
+                "Content-Type": "application/json",
+            },
+            body: JSON.stringify(body),
+        });
+        if (!res.ok) {
+            const text = await res.text();
+            throw new Error(`Crossmint wallet creation failed (${res.status}): ${text}`);
+        }
+        const data = (await res.json());
+        const address = data.address;
+        if (!address) {
+            throw new Error("Crossmint wallet creation returned no address. Response: " +
+                JSON.stringify(data));
+        }
+        const locator = data.locator || `wallet:${address}`;
+        return { address, locator };
+    }
+    async getWallet(locator) {
+        const encodedLocator = encodeURIComponent(locator);
+        const res = await fetch(`${this.baseUrl}/api/2022-06-09/wallets/${encodedLocator}`, {
+            method: "GET",
+            headers: {
+                "X-API-KEY": this.apiKey,
+            },
+        });
+        if (!res.ok) {
+            const text = await res.text();
+            throw new Error(`Crossmint get wallet failed (${res.status}): ${text}`);
+        }
+        const data = (await res.json());
+        const address = data.address;
+        if (!address) {
+            throw new Error("Crossmint wallet lookup returned no address. Response: " +
+                JSON.stringify(data));
+        }
+        return { address };
+    }
+    async signTransaction(locator, transaction, encoding) {
+        const encodedLocator = encodeURIComponent(locator);
+        const res = await fetch(`${this.baseUrl}/api/2022-06-09/wallets/${encodedLocator}/transactions`, {
+            method: "POST",
+            headers: {
+                "X-API-KEY": this.apiKey,
+                "Content-Type": "application/json",
+            },
+            body: JSON.stringify({
+                params: {
+                    transaction,
+                    encoding,
+                },
+            }),
+        });
+        if (!res.ok) {
+            const text = await res.text();
+            throw new Error(`Crossmint transaction signing failed (${res.status}): ${text}`);
+        }
+        const data = (await res.json());
+        const signedTransaction = data.signedTransaction;
+        if (!signedTransaction) {
+            throw new Error("Crossmint signing returned no signedTransaction. Response: " +
+                JSON.stringify(data));
+        }
+        return { signedTransaction };
+    }
+}
+exports.CrossmintRESTClient = CrossmintRESTClient;
+/**
+ * CrossmintWallet — a WalletLike that signs transactions via Crossmint's TEE.
+ *
+ * Use the static `create()` method to instantiate:
+ *   const wallet = await CrossmintWallet.create({ apiKey: '...' });
+ *   const shielded = shield(wallet, { maxSpend: '500 USDC/day' });
+ */
+class CrossmintWallet {
+    constructor(publicKey, locator, client) {
+        this.provider = "crossmint";
+        this.publicKey = publicKey;
+        this.locator = locator;
+        this.client = client;
+    }
+    /**
+     * Create a CrossmintWallet. If no locator is provided, a new wallet is created
+     * via the Crossmint API. The private key never leaves the TEE.
+     */
+    static async create(config, 
+    /** Injectable SDK client for testing. Uses REST client by default. */
+    client) {
+        (0, config_1.validateConfig)(config);
+        const baseUrl = config.baseUrl || "https://www.crossmint.com";
+        const sdkClient = client || new CrossmintRESTClient(config.apiKey, baseUrl);
+        const chain = config.chain || "solana";
+        const signerType = config.signerType || "api-key";
+        let address;
+        let locator;
+        if (config.locator) {
+            // Use existing wallet
+            locator = config.locator;
+            const wallet = await sdkClient.getWallet(locator);
+            address = wallet.address;
+        }
+        else {
+            // Create new wallet
+            const result = await sdkClient.createWallet({
+                chain,
+                signer: { type: signerType },
+                linkedUser: config.linkedUser,
+            });
+            address = result.address;
+            locator = result.locator;
+        }
+        const publicKey = new web3_js_1.PublicKey(address);
+        return new CrossmintWallet(publicKey, locator, sdkClient);
+    }
+    /**
+     * Sign a transaction via Crossmint's TEE.
+     * The transaction is serialized, sent to Crossmint, signed in hardware,
+     * and the signed result is deserialized back.
+     */
+    async signTransaction(tx) {
+        const serialized = Buffer.from(tx.serialize({ requireAllSignatures: false, verifySignatures: false })).toString("base64");
+        const { signedTransaction } = await this.client.signTransaction(this.locator, serialized, "base64");
+        const signedBytes = Buffer.from(signedTransaction, "base64");
+        if (tx instanceof web3_js_1.Transaction) {
+            return web3_js_1.Transaction.from(signedBytes);
+        }
+        else {
+            return web3_js_1.VersionedTransaction.deserialize(signedBytes);
+        }
+    }
+    /**
+     * Sign multiple transactions sequentially via the TEE.
+     */
+    async signAllTransactions(txs) {
+        const results = [];
+        for (const tx of txs) {
+            results.push(await this.signTransaction(tx));
+        }
+        return results;
+    }
+}
+exports.CrossmintWallet = CrossmintWallet;
+//# sourceMappingURL=adapter.js.map

package/dist/adapter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"adapter.js","sourceRoot":"","sources":["../src/adapter.ts"],"names":[],"mappings":";AAAA;;;;;;;;GAQG;;;AAEH,6CAA+E;AAC/E,qCAAiE;AAwCjE;;;;GAIG;AACH,MAAa,mBAAmB;IAI9B,YAAY,MAAc,EAAE,OAAe;QACzC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC5C,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,MAIlB;QACC,MAAM,IAAI,GAA4B;YACpC,IAAI,EAAE,mBAAmB;YACzB,MAAM,EAAE;gBACN,WAAW,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE;aAC1C;SACF,CAAC;QACF,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;YACtB,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;QACtC,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,OAAO,yBAAyB,EAAE;YAChE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,WAAW,EAAE,IAAI,CAAC,MAAM;gBACxB,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;SAC3B,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CACb,qCAAqC,GAAG,CAAC,MAAM,MAAM,IAAI,EAAE,CAC5D,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA4B,CAAC;QAC3D,MAAM,OAAO,GAAG,IAAI,CAAC,OAAiB,CAAC;QACvC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CACb,2DAA2D;gBACzD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CACvB,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAAI,IAAI,CAAC,OAAkB,IAAI,UAAU,OAAO,EAAE,CAAC;QAChE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IAC9B,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,OAAe;QAC7B,MAAM,cAAc,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;QACnD,MAAM,GAAG,GAAG,MAAM,KAAK,CACrB,GAAG,IAAI,CAAC,OAAO,2BAA2B,cAAc,EAAE,EAC1D;YACE,MAAM,EAAE,KAAK;YACb,OAAO,EAAE;gBACP,WAAW,EAAE,IAAI,CAAC,MAAM;aACzB;SACF,CACF,CAAC;QAEF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,gCAAgC,GAAG,CAAC,MAAM,MAAM,IAAI,EAAE,CAAC,CAAC;QAC1E,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA4B,CAAC;QAC3D,MAAM,OAAO,GAAG,IAAI,CAAC,OAAiB,CAAC;QACvC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CACb,yDAAyD;gBACvD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CACvB,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,CAAC;IACrB,CAAC;IAED,KAAK,CAAC,eAAe,CACnB,OAAe,EACf,WAAmB,EACnB,QAA6B;QAE7B,MAAM,cAAc,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;QACnD,MAAM,GAAG,GAAG,MAAM,KAAK,CACrB,GAAG,IAAI,CAAC,OAAO,2BAA2B,cAAc,eAAe,EACvE;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,WAAW,EAAE,IAAI,CAAC,MAAM;gBACxB,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,MAAM,EAAE;oBACN,WAAW;oBACX,QAAQ;iBACT;aACF,CAAC;SACH,CACF,CAAC;QAEF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CACb,yCAAyC,GAAG,CAAC,MAAM,MAAM,IAAI,EAAE,CAChE,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA4B,CAAC;QAC3D,MAAM,iBAAiB,GAAG,IAAI,CAAC,iBAA2B,CAAC;QAC3D,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CACb,6DAA6D;gBAC3D,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CACvB,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,iBAAiB,EAAE,CAAC;IAC/B,CAAC;CACF;AA3HD,kDA2HC;AAED;;;;;;GAMG;AACH,MAAa,eAAe;IAO1B,YACE,SAAoB,EACpB,OAAe,EACf,MAA0B;QAPnB,aAAQ,GAAW,WAAW,CAAC;QAStC,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,KAAK,CAAC,MAAM,CACjB,MAA6B;IAC7B,sEAAsE;IACtE,MAA2B;QAE3B,IAAA,uBAAc,EAAC,MAAM,CAAC,CAAC;QAEvB,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,2BAA2B,CAAC;QAC9D,MAAM,SAAS,GAAG,MAAM,IAAI,IAAI,mBAAmB,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC5E,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,QAAQ,CAAC;QACvC,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,IAAI,SAAS,CAAC;QAElD,IAAI,OAAe,CAAC;QACpB,IAAI,OAAe,CAAC;QAEpB,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,sBAAsB;YACtB,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;YACzB,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;YAClD,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAC3B,CAAC;aAAM,CAAC;YACN,oBAAoB;YACpB,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,YAAY,CAAC;gBAC1C,KAAK;gBACL,MAAM,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE;gBAC5B,UAAU,EAAE,MAAM,CAAC,UAAU;aAC9B,CAAC,CAAC;YACH,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;YACzB,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAC3B,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,mBAAS,CAAC,OAAO,CAAC,CAAC;QACzC,OAAO,IAAI,eAAe,CAAC,SAAS,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IAC5D,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,eAAe,CACnB,EAAK;QAEL,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAC5B,EAAE,CAAC,SAAS,CAAC,EAAE,oBAAoB,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE,CAAC,CACvE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAErB,MAAM,EAAE,iBAAiB,EAAE,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,eAAe,CAC7D,IAAI,CAAC,OAAO,EACZ,UAAU,EACV,QAAQ,CACT,CAAC;QAEF,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,QAAQ,CAAC,CAAC;QAE7D,IAAI,EAAE,YAAY,qBAAW,EAAE,CAAC;YAC9B,OAAO,qBAAW,CAAC,IAAI,CAAC,WAAW,CAAM,CAAC;QAC5C,CAAC;aAAM,CAAC;YACN,OAAO,8BAAoB,CAAC,WAAW,CAAC,WAAW,CAAM,CAAC;QAC5D,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,mBAAmB,CACvB,GAAQ;QAER,MAAM,OAAO,GAAQ,EAAE,CAAC;QACxB,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;YACrB,OAAO,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC,CAAC;QAC/C,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;CACF;AA/FD,0CA+FC"}

package/dist/config.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Configuration and environment variable parsing for Crossmint custody adapter.
+ */
+/** Signer type for the Crossmint wallet. */
+export type CrossmintSignerType = "api-key" | "evm-keypair";
+/**
+ * Configuration for creating a CrossmintWallet.
+ */
+export interface CrossmintWalletConfig {
+    /** Crossmint server-side API key (requires wallets.create + wallets:transactions.sign scopes) */
+    apiKey: string;
+    /** Existing wallet locator (e.g. "wallet:<address>" or "email:<user>"). Creates new wallet if omitted. */
+    locator?: string;
+    /** Chain to use. Default: "solana" */
+    chain?: string;
+    /** Signer type for wallet creation. Default: "api-key" (custodial, fully headless) */
+    signerType?: CrossmintSignerType;
+    /** Crossmint API base URL. Default: "https://www.crossmint.com" */
+    baseUrl?: string;
+    /** Linked user identifier for wallet association (e.g. "email:agent@example.com") */
+    linkedUser?: string;
+}
+/** Environment variable keys for Crossmint custody configuration. */
+export declare const CROSSMINT_ENV_KEYS: {
+    /** Crossmint server-side API key */
+    readonly API_KEY: "CROSSMINT_API_KEY";
+    /** Existing wallet locator (optional — creates new wallet if omitted) */
+    readonly LOCATOR: "CROSSMINT_WALLET_LOCATOR";
+    /** Signer type: "api-key" or "evm-keypair" */
+    readonly SIGNER_TYPE: "CROSSMINT_SIGNER_TYPE";
+    /** Crossmint API base URL override */
+    readonly BASE_URL: "CROSSMINT_BASE_URL";
+    /** Linked user for wallet association */
+    readonly LINKED_USER: "CROSSMINT_LINKED_USER";
+};
+/**
+ * Parse CrossmintWalletConfig from environment variables.
+ * Throws if CROSSMINT_API_KEY is not set.
+ */
+export declare function configFromEnv(): CrossmintWalletConfig;
+/**
+ * Validate a CrossmintWalletConfig. Throws descriptive errors for missing/invalid fields.
+ */
+export declare function validateConfig(config: CrossmintWalletConfig): void;
+//# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,4CAA4C;AAC5C,MAAM,MAAM,mBAAmB,GAAG,SAAS,GAAG,aAAa,CAAC;AAE5D;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,iGAAiG;IACjG,MAAM,EAAE,MAAM,CAAC;IACf,0GAA0G;IAC1G,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,sCAAsC;IACtC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,sFAAsF;IACtF,UAAU,CAAC,EAAE,mBAAmB,CAAC;IACjC,mEAAmE;IACnE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,qFAAqF;IACrF,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,qEAAqE;AACrE,eAAO,MAAM,kBAAkB;IAC7B,oCAAoC;;IAEpC,yEAAyE;;IAEzE,8CAA8C;;IAE9C,sCAAsC;;IAEtC,yCAAyC;;CAEjC,CAAC;AAEX;;;GAGG;AACH,wBAAgB,aAAa,IAAI,qBAAqB,CA6BrD;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,qBAAqB,GAAG,IAAI,CAMlE"}

package/dist/config.js

@@ -0,0 +1,58 @@
+"use strict";
+/**
+ * Configuration and environment variable parsing for Crossmint custody adapter.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CROSSMINT_ENV_KEYS = void 0;
+exports.configFromEnv = configFromEnv;
+exports.validateConfig = validateConfig;
+/** Environment variable keys for Crossmint custody configuration. */
+exports.CROSSMINT_ENV_KEYS = {
+    /** Crossmint server-side API key */
+    API_KEY: "CROSSMINT_API_KEY",
+    /** Existing wallet locator (optional — creates new wallet if omitted) */
+    LOCATOR: "CROSSMINT_WALLET_LOCATOR",
+    /** Signer type: "api-key" or "evm-keypair" */
+    SIGNER_TYPE: "CROSSMINT_SIGNER_TYPE",
+    /** Crossmint API base URL override */
+    BASE_URL: "CROSSMINT_BASE_URL",
+    /** Linked user for wallet association */
+    LINKED_USER: "CROSSMINT_LINKED_USER",
+};
+/**
+ * Parse CrossmintWalletConfig from environment variables.
+ * Throws if CROSSMINT_API_KEY is not set.
+ */
+function configFromEnv() {
+    const apiKey = process.env[exports.CROSSMINT_ENV_KEYS.API_KEY];
+    if (!apiKey) {
+        throw new Error(`Crossmint custody: ${exports.CROSSMINT_ENV_KEYS.API_KEY} environment variable is required. ` +
+            "Get a server-side API key from https://crossmint.com/console with " +
+            "wallets.create and wallets:transactions.sign scopes.");
+    }
+    const signerTypeRaw = process.env[exports.CROSSMINT_ENV_KEYS.SIGNER_TYPE];
+    let signerType;
+    if (signerTypeRaw) {
+        if (signerTypeRaw !== "api-key" && signerTypeRaw !== "evm-keypair") {
+            throw new Error(`Crossmint custody: invalid ${exports.CROSSMINT_ENV_KEYS.SIGNER_TYPE}="${signerTypeRaw}". ` +
+                'Expected "api-key" or "evm-keypair".');
+        }
+        signerType = signerTypeRaw;
+    }
+    return {
+        apiKey,
+        locator: process.env[exports.CROSSMINT_ENV_KEYS.LOCATOR] || undefined,
+        signerType,
+        baseUrl: process.env[exports.CROSSMINT_ENV_KEYS.BASE_URL] || undefined,
+        linkedUser: process.env[exports.CROSSMINT_ENV_KEYS.LINKED_USER] || undefined,
+    };
+}
+/**
+ * Validate a CrossmintWalletConfig. Throws descriptive errors for missing/invalid fields.
+ */
+function validateConfig(config) {
+    if (!config.apiKey || config.apiKey.trim() === "") {
+        throw new Error("Crossmint custody: apiKey is required and cannot be empty.");
+    }
+}
+//# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":";AAAA;;GAEG;;;AAyCH,sCA6BC;AAKD,wCAMC;AA1DD,qEAAqE;AACxD,QAAA,kBAAkB,GAAG;IAChC,oCAAoC;IACpC,OAAO,EAAE,mBAAmB;IAC5B,yEAAyE;IACzE,OAAO,EAAE,0BAA0B;IACnC,8CAA8C;IAC9C,WAAW,EAAE,uBAAuB;IACpC,sCAAsC;IACtC,QAAQ,EAAE,oBAAoB;IAC9B,yCAAyC;IACzC,WAAW,EAAE,uBAAuB;CAC5B,CAAC;AAEX;;;GAGG;AACH,SAAgB,aAAa;IAC3B,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,0BAAkB,CAAC,OAAO,CAAC,CAAC;IACvD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,sBAAsB,0BAAkB,CAAC,OAAO,qCAAqC;YACnF,oEAAoE;YACpE,sDAAsD,CACzD,CAAC;IACJ,CAAC;IAED,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,0BAAkB,CAAC,WAAW,CAAC,CAAC;IAClE,IAAI,UAA2C,CAAC;IAChD,IAAI,aAAa,EAAE,CAAC;QAClB,IAAI,aAAa,KAAK,SAAS,IAAI,aAAa,KAAK,aAAa,EAAE,CAAC;YACnE,MAAM,IAAI,KAAK,CACb,8BAA8B,0BAAkB,CAAC,WAAW,KAAK,aAAa,KAAK;gBACjF,sCAAsC,CACzC,CAAC;QACJ,CAAC;QACD,UAAU,GAAG,aAAa,CAAC;IAC7B,CAAC;IAED,OAAO;QACL,MAAM;QACN,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,0BAAkB,CAAC,OAAO,CAAC,IAAI,SAAS;QAC7D,UAAU;QACV,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,0BAAkB,CAAC,QAAQ,CAAC,IAAI,SAAS;QAC9D,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,0BAAkB,CAAC,WAAW,CAAC,IAAI,SAAS;KACrE,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAgB,cAAc,CAAC,MAA6B;IAC1D,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CACb,4DAA4D,CAC7D,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,57 @@
+/**
+ * @agent-shield/custody-crossmint
+ *
+ * Crossmint TEE custody adapter for AgentShield.
+ * Hardware-enclave signing — the private key never leaves the TEE.
+ *
+ * @example One-liner with shield():
+ * ```typescript
+ * import { shield } from '@agent-shield/solana';
+ * import { crossmint } from '@agent-shield/custody-crossmint';
+ *
+ * const wallet = shield(
+ *   await crossmint({ apiKey: 'sk_...' }),
+ *   { maxSpend: '500 USDC/day' }
+ * );
+ * ```
+ *
+ * @example Zero-config from environment:
+ * ```typescript
+ * import { shield } from '@agent-shield/solana';
+ * import { crossmintFromEnv } from '@agent-shield/custody-crossmint';
+ *
+ * // Reads CROSSMINT_API_KEY (+ optional CROSSMINT_WALLET_LOCATOR) from env
+ * const wallet = shield(await crossmintFromEnv(), { maxSpend: '500 USDC/day' });
+ * ```
+ */
+export { CrossmintWallet, CrossmintRESTClient, type CrossmintSDKClient, type WalletLike, } from "./adapter";
+export { type CrossmintWalletConfig, type CrossmintSignerType, CROSSMINT_ENV_KEYS, configFromEnv, validateConfig, } from "./config";
+import { CrossmintWallet, CrossmintSDKClient } from "./adapter";
+import { CrossmintWalletConfig } from "./config";
+/**
+ * Create a CrossmintWallet from explicit configuration.
+ *
+ * If no `locator` is provided, a new wallet is created via the Crossmint API.
+ * The private key lives in Crossmint's Intel TDX enclave — the agent never sees it.
+ *
+ * @example
+ * ```typescript
+ * const wallet = await crossmint({ apiKey: 'sk_production_...' });
+ * console.log(wallet.publicKey.toBase58()); // Solana address
+ * ```
+ */
+export declare function crossmint(config: CrossmintWalletConfig, client?: CrossmintSDKClient): Promise<CrossmintWallet>;
+/**
+ * Create a CrossmintWallet from environment variables.
+ *
+ * Required: CROSSMINT_API_KEY
+ * Optional: CROSSMINT_WALLET_LOCATOR, CROSSMINT_SIGNER_TYPE, CROSSMINT_BASE_URL
+ *
+ * @example
+ * ```typescript
+ * // Set CROSSMINT_API_KEY=sk_production_... in .env
+ * const wallet = await crossmintFromEnv();
+ * ```
+ */
+export declare function crossmintFromEnv(client?: CrossmintSDKClient): Promise<CrossmintWallet>;
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EACL,eAAe,EACf,mBAAmB,EACnB,KAAK,kBAAkB,EACvB,KAAK,UAAU,GAChB,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,EACxB,kBAAkB,EAClB,aAAa,EACb,cAAc,GACf,MAAM,UAAU,CAAC;AAElB,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAChE,OAAO,EAAE,qBAAqB,EAAiB,MAAM,UAAU,CAAC;AAEhE;;;;;;;;;;;GAWG;AACH,wBAAsB,SAAS,CAC7B,MAAM,EAAE,qBAAqB,EAC7B,MAAM,CAAC,EAAE,kBAAkB,GAC1B,OAAO,CAAC,eAAe,CAAC,CAE1B;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,gBAAgB,CACpC,MAAM,CAAC,EAAE,kBAAkB,GAC1B,OAAO,CAAC,eAAe,CAAC,CAG1B"}

package/dist/index.js

@@ -0,0 +1,72 @@
+"use strict";
+/**
+ * @agent-shield/custody-crossmint
+ *
+ * Crossmint TEE custody adapter for AgentShield.
+ * Hardware-enclave signing — the private key never leaves the TEE.
+ *
+ * @example One-liner with shield():
+ * ```typescript
+ * import { shield } from '@agent-shield/solana';
+ * import { crossmint } from '@agent-shield/custody-crossmint';
+ *
+ * const wallet = shield(
+ *   await crossmint({ apiKey: 'sk_...' }),
+ *   { maxSpend: '500 USDC/day' }
+ * );
+ * ```
+ *
+ * @example Zero-config from environment:
+ * ```typescript
+ * import { shield } from '@agent-shield/solana';
+ * import { crossmintFromEnv } from '@agent-shield/custody-crossmint';
+ *
+ * // Reads CROSSMINT_API_KEY (+ optional CROSSMINT_WALLET_LOCATOR) from env
+ * const wallet = shield(await crossmintFromEnv(), { maxSpend: '500 USDC/day' });
+ * ```
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.validateConfig = exports.configFromEnv = exports.CROSSMINT_ENV_KEYS = exports.CrossmintRESTClient = exports.CrossmintWallet = void 0;
+exports.crossmint = crossmint;
+exports.crossmintFromEnv = crossmintFromEnv;
+var adapter_1 = require("./adapter");
+Object.defineProperty(exports, "CrossmintWallet", { enumerable: true, get: function () { return adapter_1.CrossmintWallet; } });
+Object.defineProperty(exports, "CrossmintRESTClient", { enumerable: true, get: function () { return adapter_1.CrossmintRESTClient; } });
+var config_1 = require("./config");
+Object.defineProperty(exports, "CROSSMINT_ENV_KEYS", { enumerable: true, get: function () { return config_1.CROSSMINT_ENV_KEYS; } });
+Object.defineProperty(exports, "configFromEnv", { enumerable: true, get: function () { return config_1.configFromEnv; } });
+Object.defineProperty(exports, "validateConfig", { enumerable: true, get: function () { return config_1.validateConfig; } });
+const adapter_2 = require("./adapter");
+const config_2 = require("./config");
+/**
+ * Create a CrossmintWallet from explicit configuration.
+ *
+ * If no `locator` is provided, a new wallet is created via the Crossmint API.
+ * The private key lives in Crossmint's Intel TDX enclave — the agent never sees it.
+ *
+ * @example
+ * ```typescript
+ * const wallet = await crossmint({ apiKey: 'sk_production_...' });
+ * console.log(wallet.publicKey.toBase58()); // Solana address
+ * ```
+ */
+async function crossmint(config, client) {
+    return adapter_2.CrossmintWallet.create(config, client);
+}
+/**
+ * Create a CrossmintWallet from environment variables.
+ *
+ * Required: CROSSMINT_API_KEY
+ * Optional: CROSSMINT_WALLET_LOCATOR, CROSSMINT_SIGNER_TYPE, CROSSMINT_BASE_URL
+ *
+ * @example
+ * ```typescript
+ * // Set CROSSMINT_API_KEY=sk_production_... in .env
+ * const wallet = await crossmintFromEnv();
+ * ```
+ */
+async function crossmintFromEnv(client) {
+    const config = (0, config_2.configFromEnv)();
+    return adapter_2.CrossmintWallet.create(config, client);
+}
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;;;AAgCH,8BAKC;AAcD,4CAKC;AAtDD,qCAKmB;AAJjB,0GAAA,eAAe,OAAA;AACf,8GAAA,mBAAmB,OAAA;AAKrB,mCAMkB;AAHhB,4GAAA,kBAAkB,OAAA;AAClB,uGAAA,aAAa,OAAA;AACb,wGAAA,cAAc,OAAA;AAGhB,uCAAgE;AAChE,qCAAgE;AAEhE;;;;;;;;;;;GAWG;AACI,KAAK,UAAU,SAAS,CAC7B,MAA6B,EAC7B,MAA2B;IAE3B,OAAO,yBAAe,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAChD,CAAC;AAED;;;;;;;;;;;GAWG;AACI,KAAK,UAAU,gBAAgB,CACpC,MAA2B;IAE3B,MAAM,MAAM,GAAG,IAAA,sBAAa,GAAE,CAAC;IAC/B,OAAO,yBAAe,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAChD,CAAC"}

package/package.json

@@ -0,0 +1,58 @@
+{
+  "name": "@agent-shield/custody-crossmint",
+  "version": "0.1.0",
+  "description": "Crossmint TEE custody adapter for AgentShield — hardware-enclave signing for AI agents",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "sideEffects": false,
+  "engines": {
+    "node": ">=18.0.0"
+  },
+  "scripts": {
+    "build": "tsc",
+    "clean": "rm -rf dist",
+    "prepublishOnly": "npm run clean && npm run build",
+    "test": "TS_NODE_PROJECT=tsconfig.test.json mocha --require ts-node/register tests/**/*.test.ts --timeout 30000"
+  },
+  "dependencies": {
+    "@crossmint/wallets-sdk": "^0.2.0",
+    "@solana/web3.js": "^1.95.0"
+  },
+  "peerDependencies": {
+    "@agent-shield/solana": ">=0.1.0"
+  },
+  "peerDependenciesMeta": {
+    "@agent-shield/solana": {
+      "optional": true
+    }
+  },
+  "devDependencies": {
+    "@agent-shield/solana": "workspace:*",
+    "@types/chai": "^4.3.11",
+    "@types/mocha": "^10.0.6",
+    "@types/node": "^20.11.0",
+    "chai": "^4.4.1",
+    "mocha": "^10.3.0",
+    "ts-node": "^10.9.2",
+    "typescript": "^5.3.3"
+  },
+  "keywords": [
+    "solana",
+    "ai-agent",
+    "tee",
+    "custody",
+    "crossmint",
+    "hardware-enclave",
+    "wallet"
+  ],
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/agent-shield/agent-shield",
+    "directory": "sdk/custody/crossmint"
+  }
+}