@ledgerhq/revault-sdk 0.22.3 → 0.22.4

package/lib/bake.d.ts

@@ -1,6 +1,6 @@
 import { L as Logger } from './logger-C-TPbnjv.js';
 import z from 'zod';
-import { E as Engine, f as WithWorkspace, c as WithDevice, l as WithPsdAuth } from './types-XVM9jF-Z.js';
+import { E as Engine, f as WithWorkspace, c as WithDevice, l as WithPsdAuth } from './types-BTcYWX_0.js';
 import { VaultRequestResponse } from '@ledgerhq/revault-api';
 import { a as RouterInputs } from './types-CpGEbAxh.js';
 import './types-DJfbanPz.js';
@@ -93,6 +93,14 @@ declare const zManifestPolicy: z.ZodObject<{
     }, z.core.$strict>>;
 }, z.core.$strict>;
 type ManifestPolicy = z.infer<typeof zManifestPolicy>;
+declare const zManifestRawSigningGovernanceRule: z.ZodObject<{
+    type: z.ZodLiteral<"SIGN_DIGESTS">;
+    steps: z.ZodArray<z.ZodObject<{
+        quorum: z.ZodNumber;
+        members: z.ZodArray<z.ZodUnion<readonly [z.ZodNumber, z.ZodString]>>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+type ManifestRawSigningGovernanceRule = z.infer<typeof zManifestRawSigningGovernanceRule>;
 declare const zManifestAccount: z.ZodObject<{
     name: z.ZodString;
     currency: z.ZodString;
@@ -131,6 +139,15 @@ declare const zManifestAccount: z.ZodObject<{
             repledgeAuthorized: z.ZodOptional<z.ZodBoolean>;
             needsAssetManagerApprovalForSettlements: z.ZodOptional<z.ZodBoolean>;
         }, z.core.$strict>>;
+    }, z.core.$strict>, z.ZodObject<{
+        type: z.ZodLiteral<"RAW_SIGNING">;
+        rules: z.ZodArray<z.ZodObject<{
+            type: z.ZodLiteral<"SIGN_DIGESTS">;
+            steps: z.ZodArray<z.ZodObject<{
+                quorum: z.ZodNumber;
+                members: z.ZodArray<z.ZodUnion<readonly [z.ZodNumber, z.ZodString]>>;
+            }, z.core.$strict>>;
+        }, z.core.$strict>>;
     }, z.core.$strict>], "type">;
 }, z.core.$strict>;
 type ManifestAccount = z.infer<typeof zManifestAccount>;
@@ -216,6 +233,14 @@ declare const zManifestTradelinkNetwork: z.ZodObject<{
     }, z.core.$strict>>>;
 }, z.core.$strict>;
 type ManifestTradelinkNetwork = z.infer<typeof zManifestTradelinkNetwork>;
+declare const zManifestWorkspaceRule: z.ZodObject<{
+    permission: z.ZodEnum<{
+        CREATE_ACCOUNT_WITH_POLICY: "CREATE_ACCOUNT_WITH_POLICY";
+    }>;
+    quorum: z.ZodNumber;
+    members: z.ZodArray<z.ZodUnion<readonly [z.ZodNumber, z.ZodString]>>;
+}, z.core.$strict>;
+type ManifestWorkspaceRule = z.infer<typeof zManifestWorkspaceRule>;
 declare const zManifestWorkspace: z.ZodObject<{
     tradelink: z.ZodOptional<z.ZodObject<{
         networkBlueprint: z.ZodOptional<z.ZodObject<{
@@ -357,6 +382,15 @@ declare const zManifestWorkspace: z.ZodObject<{
                 repledgeAuthorized: z.ZodOptional<z.ZodBoolean>;
                 needsAssetManagerApprovalForSettlements: z.ZodOptional<z.ZodBoolean>;
             }, z.core.$strict>>;
+        }, z.core.$strict>, z.ZodObject<{
+            type: z.ZodLiteral<"RAW_SIGNING">;
+            rules: z.ZodArray<z.ZodObject<{
+                type: z.ZodLiteral<"SIGN_DIGESTS">;
+                steps: z.ZodArray<z.ZodObject<{
+                    quorum: z.ZodNumber;
+                    members: z.ZodArray<z.ZodUnion<readonly [z.ZodNumber, z.ZodString]>>;
+                }, z.core.$strict>>;
+            }, z.core.$strict>>;
         }, z.core.$strict>], "type">;
     }, z.core.$strict>>>;
     hederaData: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodArray<z.ZodObject<{
@@ -369,6 +403,13 @@ declare const zManifestWorkspace: z.ZodObject<{
         exchange: z.ZodString;
         amount: z.ZodString;
     }, z.core.$strict>>>;
+    workspaceRules: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        permission: z.ZodEnum<{
+            CREATE_ACCOUNT_WITH_POLICY: "CREATE_ACCOUNT_WITH_POLICY";
+        }>;
+        quorum: z.ZodNumber;
+        members: z.ZodArray<z.ZodUnion<readonly [z.ZodNumber, z.ZodString]>>;
+    }, z.core.$strict>>>;
 }, z.core.$strict>;
 type ManifestWorkspace = z.infer<typeof zManifestWorkspace>;
 declare const zManifestTradelinkOrg: z.ZodObject<{
@@ -549,6 +590,15 @@ declare const zManifest: z.ZodObject<{
                     repledgeAuthorized: z.ZodOptional<z.ZodBoolean>;
                     needsAssetManagerApprovalForSettlements: z.ZodOptional<z.ZodBoolean>;
                 }, z.core.$strict>>;
+            }, z.core.$strict>, z.ZodObject<{
+                type: z.ZodLiteral<"RAW_SIGNING">;
+                rules: z.ZodArray<z.ZodObject<{
+                    type: z.ZodLiteral<"SIGN_DIGESTS">;
+                    steps: z.ZodArray<z.ZodObject<{
+                        quorum: z.ZodNumber;
+                        members: z.ZodArray<z.ZodUnion<readonly [z.ZodNumber, z.ZodString]>>;
+                    }, z.core.$strict>>;
+                }, z.core.$strict>>;
             }, z.core.$strict>], "type">;
         }, z.core.$strict>>>;
         hederaData: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodArray<z.ZodObject<{
@@ -561,6 +611,13 @@ declare const zManifest: z.ZodObject<{
             exchange: z.ZodString;
             amount: z.ZodString;
         }, z.core.$strict>>>;
+        workspaceRules: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            permission: z.ZodEnum<{
+                CREATE_ACCOUNT_WITH_POLICY: "CREATE_ACCOUNT_WITH_POLICY";
+            }>;
+            quorum: z.ZodNumber;
+            members: z.ZodArray<z.ZodUnion<readonly [z.ZodNumber, z.ZodString]>>;
+        }, z.core.$strict>>>;
     }, z.core.$strict>>;
 }, z.core.$strict>;
 type Manifest = z.infer<typeof zManifest>;
@@ -576,4 +633,4 @@ declare function createAndApproveRequest(input: CreateRequestInput, approvers: E
 
 declare function bakeManifest(options: BakeOptions, logger: Logger): Promise<void>;
 
-export { type BakeOptions, type CreateRequestInput, type Manifest, type ManifestAccount, type ManifestApiUser, type ManifestGovernanceRule, type ManifestGroup, type ManifestHederaData, type ManifestPledgeAdjustment, type ManifestPolicy, type ManifestTradelinkEntity, type ManifestTradelinkGroup, type ManifestTradelinkNetwork, type ManifestTradelinkNetworkBlueprint, type ManifestTradelinkOrg, type ManifestWhitelist, type ManifestWorkspace, bakeManifest, bakePledgeAdjustment, createAndApproveRequest, zManifest, zManifestPolicy };
+export { type BakeOptions, type CreateRequestInput, type Manifest, type ManifestAccount, type ManifestApiUser, type ManifestGovernanceRule, type ManifestGroup, type ManifestHederaData, type ManifestPledgeAdjustment, type ManifestPolicy, type ManifestRawSigningGovernanceRule, type ManifestTradelinkEntity, type ManifestTradelinkGroup, type ManifestTradelinkNetwork, type ManifestTradelinkNetworkBlueprint, type ManifestTradelinkOrg, type ManifestWhitelist, type ManifestWorkspace, type ManifestWorkspaceRule, bakeManifest, bakePledgeAdjustment, createAndApproveRequest, zManifest, zManifestPolicy };

package/lib/bake.js

@@ -261,6 +261,12 @@ async function bakeWorkspace(options, logger) {
       }
     }
   }
+  if (workspace.workspaceRules) {
+    logTitle("Workspace Rules");
+    for (const workspaceRule of workspace.workspaceRules) {
+      await createWorkspaceRule(workspaceRule);
+    }
+  }
   if (workspace.groups) {
     logTitle("Groups");
     for (const group of workspace.groups) {
@@ -326,40 +332,53 @@ async function bakeWorkspace(options, logger) {
       whitelistIds: rule.whitelistNames?.map(whitelistIdFromName)
     };
   }
+  function rawSigningRuleFromManifest(rule) {
+    return {
+      operationType: rule.type,
+      // RAW_SIGNING only supports steps with userIds (no groups)
+      reviewSteps: rule.steps.map((step) => ({
+        quorum: step.quorum,
+        userIds: step.members.map(userIdFromDeviceIndexOrName)
+      }))
+    };
+  }
   async function createAccount(account, workspace2) {
     let req = null;
     const existing = existingAccounts.find(
       (a) => a.currency === account.currency && a.index === account.index && (a.contractAddress ?? null) === (account.contractAddress ?? null)
     );
+    const governance = account.governance.type === "TRADELINK" ? {
+      type: "TRADELINK",
+      assetManagerId: assetManagerIdFromName(account.governance.assetManager),
+      exchangeConfigs: account.governance.exchanges.map((exchangeConfig) => ({
+        exchangeId: exchangeIdFromName(exchangeConfig.name),
+        repledgeAuthorized: exchangeConfig.repledgeAuthorized === true,
+        needsAssetManagerApprovalForSettlements: exchangeConfig.needsAssetManagerApprovalForSettlements === true
+      }))
+    } : account.governance.type === "RAW_SIGNING" ? {
+      type: "RAW_SIGNING",
+      policy: { rules: account.governance.rules.map(rawSigningRuleFromManifest) }
+    } : {
+      type: "CLASSIC",
+      policy: { rules: account.governance.rules.map(govRuleFromManifest) }
+    };
+    const accountData = {
+      name: account.name,
+      currency: account.currency,
+      contractAddress: account.contractAddress ?? null,
+      tokenIdentifier: account.tokenIdentifier ?? null,
+      index: account.index,
+      governance
+    };
     const createInput = {
       type: "CREATE_ACCOUNT",
-      data: {
-        // general fields
-        name: account.name,
-        currency: account.currency,
-        contractAddress: account.contractAddress ?? null,
-        tokenIdentifier: account.tokenIdentifier ?? null,
-        index: account.index,
-        // governance fields
-        governance: account.governance.type === "TRADELINK" ? {
-          type: "TRADELINK",
-          assetManagerId: assetManagerIdFromName(account.governance.assetManager),
-          exchangeConfigs: account.governance.exchanges.map((exchangeConfig) => ({
-            exchangeId: exchangeIdFromName(exchangeConfig.name),
-            repledgeAuthorized: exchangeConfig.repledgeAuthorized === true,
-            needsAssetManagerApprovalForSettlements: exchangeConfig.needsAssetManagerApprovalForSettlements === true
-          }))
-        } : {
-          type: "CLASSIC",
-          policy: { rules: account.governance.rules.map(govRuleFromManifest) }
-        }
-      }
+      data: accountData
     };
     if (existing) {
       const editInput = {
-        ...createInput,
         type: "EDIT_ACCOUNT",
-        targetId: existing.id
+        targetId: existing.id,
+        data: { name: accountData.name, governance }
       };
       const previousAccountRequests = await admin1.client.requests.list.query({
         type: ["CREATE_ACCOUNT", "EDIT_ACCOUNT"],
@@ -375,9 +394,9 @@ async function bakeWorkspace(options, logger) {
           "State request should be an edit account request"
         );
         if (_.isEqual(
-          stripUndefinedDeep(createInput.data.governance),
+          stripUndefinedDeep(accountData.governance),
           stripUndefinedDeep(stateRequest.data.governance)
-        ) && createInput.data.name === stateRequest.data.name) {
+        ) && accountData.name === stateRequest.data.name) {
           logger.info(`[SKIPPED] Account "${account.name}" has not changed`);
           await activateHederaAccount(account, workspace2, existing.id);
           return;
@@ -554,6 +573,21 @@ async function bakeWorkspace(options, logger) {
     const createdPolicy = await admin1.client.policies.findById.query({ id: request.targetId });
     existingPolicies.push(createdPolicy);
   }
+  async function createWorkspaceRule(workspaceRule) {
+    const { permission, quorum, members } = workspaceRule;
+    logStep(`Editing workspace rule for ${permission}...`);
+    const userIds = members.map(userIdFromDeviceIndexOrName);
+    logSubStep("Creating request...");
+    const input = {
+      type: "EDIT_WORKSPACE_RULE",
+      data: {
+        permission,
+        reviewConfig: [{ quorum, userIds }]
+      }
+    };
+    await createAndApproveRequest(input, [admin1, admin2], logger);
+    logSubStep(`Workspace rule for "${permission}" has been edited`);
+  }
   async function createTradelink(tradelink) {
     if (tradelink.custodian) {
       if (existingTradelinkNetwork === null) {
@@ -818,9 +852,18 @@ var zManifestTradelinkAccountGovernance = z.object({
   assetManager: z.string().meta({ description: "Asset manager name" }),
   exchanges: z.array(zManifestTradelinkExchangeConfig)
 }).strict();
+var zManifestRawSigningGovernanceRule = z.object({
+  type: z.literal("SIGN_DIGESTS"),
+  steps: z.array(zManifestGovernanceStepWithUsers).min(1)
+}).strict();
+var zManifestRawSigningAccountGovernance = z.object({
+  type: z.literal("RAW_SIGNING"),
+  rules: z.array(zManifestRawSigningGovernanceRule)
+}).strict();
 var zManifestAccountGovernance = z.discriminatedUnion("type", [
   zManifestClassicAccountGovernance,
-  zManifestTradelinkAccountGovernance
+  zManifestTradelinkAccountGovernance,
+  zManifestRawSigningAccountGovernance
 ]);
 var zManifestAccount = z.object({
   name: z.string(),
@@ -872,6 +915,11 @@ var zManifestTradelinkNetwork = z.object({
   exchanges: z.array(zManifestTradelinkEntity).optional(),
   assetManagers: z.array(zManifestTradelinkEntity).optional()
 }).strict().meta({ description: "Tradelink network configuration" });
+var zManifestWorkspaceRule = z.object({
+  permission: z.enum(["CREATE_ACCOUNT_WITH_POLICY"]),
+  quorum: z.number().min(1),
+  members: z.array(z.union([zManifestUser, zManifestUserName]))
+}).strict().meta({ description: "Workspace rule for granting permissions" });
 var zManifestWorkspace = z.object({
   tradelink: zManifestTradelinkNetwork.optional(),
   users: z.object({
@@ -884,7 +932,8 @@ var zManifestWorkspace = z.object({
   policies: z.array(zManifestPolicy).optional(),
   accounts: z.array(zManifestAccount).optional(),
   hederaData: z.record(z.string(), z.array(zManifestHederaData)).optional(),
-  pledges: z.array(zManifestPledgeAdjustment).optional()
+  pledges: z.array(zManifestPledgeAdjustment).optional(),
+  workspaceRules: z.array(zManifestWorkspaceRule).optional()
 }).strict().meta({ description: "Workspace configuration" });
 var zManifestTradelinkOrgEntity = z.object({
   name: z.string(),