@cubist-labs/cubesigner-sdk 0.4.229 → 0.4.236

package/src/org.ts

@@ -292,6 +292,12 @@ export class Org {
     return (data.policy ?? []) as unknown as OrgPolicy[];
   }
 
+  /** @returns the sign policy for the org. */
+  async signPolicy(): Promise<RolePolicy> {
+    const data = await this.fetch();
+    return (data.sign_policy ?? []) as unknown as RolePolicy;
+  }
+
   /**
    * Set the policy for the org.
    *
@@ -302,6 +308,18 @@ export class Org {
     await this.update({ policy: p });
   }
 
+  /**
+   * Set the sign policy for the org.
+   *
+   * This is a global sign policy that applies to every sign operation (every key, every role) in the org.
+   * It is analogous to how role policies apply to all sign requests performed by the corresponding role sessions.
+   *
+   * @param policy The new policy for the org.
+   */
+  async setSignPolicy(policy: RolePolicy) {
+    await this.update({ sign_policy: policy });
+  }
+
   /**
    * Retrieve the organization's extended properties (uncommon features not used by most users).
    *

package/src/role.ts

@@ -29,6 +29,9 @@ import type { RoleAttestationClaims, RoleAttestationQuery } from "./schema_types
 
 type NameOrAddressOrNull = string | null;
 
+/** Only allow the following operations */
+export type OperationAllowlist = { OperationAllowlist: OperationKind[] };
+
 /**
  * Restrict the receiver for EVM transactions.
  *
@@ -310,6 +313,13 @@ export type BtcSegwitValueLimitWindow = {
  */
 export type SourceIpAllowlist = { SourceIpAllowlist: string[] };
 
+/**
+ * Disallow signing until the specified Unix timestamp (in seconds since epoch).
+ *
+ * @example { TimeLock: 1750000000 }
+ */
+export type TimeLock = { TimeLock: number };
+
 export type HttpRequestComparer = "Eq" | { EvmTx: EvmTxCmp } | { SolanaTx: SolanaTxCmp };
 
 /**
@@ -476,6 +486,7 @@ export type NamedPolicyReference = {
 
 /** Key policies that restrict the requests that the signing endpoints accept */
 export type KeyDenyPolicy =
+  | OperationAllowlist
   | TxReceiver
   | TxDeposit
   | TxValueLimit
@@ -487,6 +498,7 @@ export type KeyDenyPolicy =
   | SuiTxReceivers
   | BtcTxReceivers
   | SourceIpAllowlist
+  | TimeLock
   | SolanaInstructionPolicy
   | BtcSegwitValueLimit
   | RequireMfa