@mantle-agent/custody 0.1.0 → 0.1.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/custody.d.ts +19 -1
- package/dist/custody.js +25 -0
- package/dist/custody.js.map +1 -1
- package/package.json +1 -1
- package/src/custody.ts +30 -0
package/dist/custody.d.ts
CHANGED
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
import { createAccountWithAddress } from "@turnkey/viem";
|
|
2
|
-
import type { TCreatePoliciesBody, TCreateSubOrganizationBody, TCreateUsersBody, TCreateWalletBody, TDeletePoliciesBody, TDeleteUsersBody, TGetOrganizationConfigsBody, TGetPolicyBody, TGetUserBody, TGetUsersBody, TGetWalletAccountsBody, v1AuthenticatorParamsV2 } from "@turnkey/sdk-types";
|
|
2
|
+
import type { TCreatePoliciesBody, TCreateSubOrganizationBody, TCreateUsersBody, TCreateWalletAccountsBody, TCreateWalletBody, TDeletePoliciesBody, TDeleteUsersBody, TGetOrganizationConfigsBody, TGetPolicyBody, TGetUserBody, TGetUsersBody, TGetWalletAccountsBody, v1AuthenticatorParamsV2 } from "@turnkey/sdk-types";
|
|
3
3
|
import { type Address } from "viem";
|
|
4
4
|
import type { RootSigner, Signer } from "@mantle-agent/core";
|
|
5
5
|
import { type SessionSigningScope } from "./policies.js";
|
|
@@ -68,6 +68,9 @@ export type OwnerApi = {
|
|
|
68
68
|
walletId: string;
|
|
69
69
|
addresses: string[];
|
|
70
70
|
}>;
|
|
71
|
+
createWalletAccounts(body: TCreateWalletAccountsBody): Promise<{
|
|
72
|
+
addresses: string[];
|
|
73
|
+
}>;
|
|
71
74
|
createUsers(body: TCreateUsersBody): Promise<{
|
|
72
75
|
userIds: string[];
|
|
73
76
|
}>;
|
|
@@ -124,6 +127,21 @@ export declare function readAgentWallet(reader: ParentApi, params: {
|
|
|
124
127
|
subOrgId: string;
|
|
125
128
|
walletId: string;
|
|
126
129
|
}): Promise<AgentWallet>;
|
|
130
|
+
/**
|
|
131
|
+
* Owner step (PRD WAL-07 key rotation): a new session key at `sessionKeyPath(index)` in the agent's wallet. A
|
|
132
|
+
* revoked key can never be granted again (the hook keeps it REVOKED), so re-authorizing needs a fresh one.
|
|
133
|
+
*/
|
|
134
|
+
export declare function addSessionKey(owner: OwnerApi, params: {
|
|
135
|
+
subOrgId: string;
|
|
136
|
+
walletId: string;
|
|
137
|
+
index: number;
|
|
138
|
+
}): Promise<Address>;
|
|
139
|
+
/** Backend check: the rotated session key, read back from Turnkey at the exact path. */
|
|
140
|
+
export declare function readSessionKey(reader: ParentApi, params: {
|
|
141
|
+
subOrgId: string;
|
|
142
|
+
walletId: string;
|
|
143
|
+
index: number;
|
|
144
|
+
}): Promise<Address>;
|
|
127
145
|
/**
|
|
128
146
|
* Backend check: the policy the owner created must be exactly the one we asked for. A page that swapped in a
|
|
129
147
|
* broader policy (another key, no expiry, any executor) is caught here before the session goes live.
|
package/dist/custody.js
CHANGED
|
@@ -73,6 +73,31 @@ export async function readAgentWallet(reader, params) {
|
|
|
73
73
|
throw new Error("wallet does not have the agent key layout");
|
|
74
74
|
return { walletId: params.walletId, rootAddress: getAddress(root.address), sessionAddress: getAddress(session.address) };
|
|
75
75
|
}
|
|
76
|
+
/**
|
|
77
|
+
* Owner step (PRD WAL-07 key rotation): a new session key at `sessionKeyPath(index)` in the agent's wallet. A
|
|
78
|
+
* revoked key can never be granted again (the hook keeps it REVOKED), so re-authorizing needs a fresh one.
|
|
79
|
+
*/
|
|
80
|
+
export async function addSessionKey(owner, params) {
|
|
81
|
+
const { addresses } = await owner.createWalletAccounts({
|
|
82
|
+
organizationId: params.subOrgId,
|
|
83
|
+
walletId: params.walletId,
|
|
84
|
+
accounts: [ethAccount(sessionKeyPath(params.index), `session-${params.index}`)],
|
|
85
|
+
});
|
|
86
|
+
if (!addresses[0])
|
|
87
|
+
throw new Error("session key was not created");
|
|
88
|
+
return getAddress(addresses[0]);
|
|
89
|
+
}
|
|
90
|
+
/** Backend check: the rotated session key, read back from Turnkey at the exact path. */
|
|
91
|
+
export async function readSessionKey(reader, params) {
|
|
92
|
+
const { accounts } = await reader.getWalletAccounts({ organizationId: params.subOrgId, walletId: params.walletId });
|
|
93
|
+
const key = accounts.find((a) => a.walletId === params.walletId &&
|
|
94
|
+
a.path === sessionKeyPath(params.index) &&
|
|
95
|
+
a.addressFormat === "ADDRESS_FORMAT_ETHEREUM" &&
|
|
96
|
+
a.curve === "CURVE_SECP256K1");
|
|
97
|
+
if (!key)
|
|
98
|
+
throw new Error(`no session key at ${sessionKeyPath(params.index)}`);
|
|
99
|
+
return getAddress(key.address);
|
|
100
|
+
}
|
|
76
101
|
/**
|
|
77
102
|
* Backend check: the policy the owner created must be exactly the one we asked for. A page that swapped in a
|
|
78
103
|
* broader policy (another key, no expiry, any executor) is caught here before the session goes live.
|
package/dist/custody.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"custody.js","sourceRoot":"","sources":["../src/custody.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;
|
|
1
|
+
{"version":3,"file":"custody.js","sourceRoot":"","sources":["../src/custody.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAgBzD,OAAO,EAAE,UAAU,EAAgB,MAAM,MAAM,CAAC;AAEhD,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAA4B,MAAM,eAAe,CAAC;AAEnG,MAAM,CAAC,MAAM,oBAAoB,GAAG,yBAAyB,CAAC;AAE9D,uGAAuG;AACvG,MAAM,CAAC,MAAM,aAAa,GAAG,kBAAkB,CAAC;AAChD,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,kBAAkB,KAAK,EAAE,CAAC;AAE3E,MAAM,UAAU,GAAG,CAAC,IAAY,EAAE,IAAY,EAAE,EAAE,CAAC,CAAC;IAClD,KAAK,EAAE,iBAA0B;IACjC,UAAU,EAAE,mBAA4B;IACxC,IAAI;IACJ,aAAa,EAAE,yBAAkC;IACjD,IAAI;CACL,CAAC,CAAC;AA2CH;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,MAAiB,EACjB,MAAmE;IAEnE,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,qBAAqB,CAAC;QAC7C,mBAAmB,EAAE,MAAM,CAAC,IAAI;QAChC,SAAS,EAAE;YACT;gBACE,QAAQ,EAAE,MAAM,CAAC,SAAS;gBAC1B,OAAO,EACL,MAAM,CAAC,KAAK,CAAC,IAAI,KAAK,QAAQ;oBAC5B,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE,SAAS,EAAE,oBAAoB,EAAE,CAAC;oBAC/F,CAAC,CAAC,EAAE;gBACR,cAAc,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE;gBACnF,cAAc,EAAE,EAAE;aACnB;SACF;QACD,mBAAmB,EAAE,CAAC;QACtB,oBAAoB,EAAE,IAAI;QAC1B,gBAAgB,EAAE,IAAI;QACtB,cAAc,EAAE,IAAI;QACpB,mBAAmB,EAAE,IAAI;KAC1B,CAAC,CAAC;IACH,MAAM,WAAW,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC;IACzC,IAAI,CAAC,WAAW;QAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClF,OAAO,EAAE,QAAQ,EAAE,GAAG,CAAC,iBAAiB,EAAE,WAAW,EAAE,CAAC;AAC1D,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,iBAAiB,CAAC,MAA6C;IAC7E,OAAO;QACL,cAAc,EAAE,MAAM,CAAC,QAAQ;QAC/B,UAAU,EAAE,SAAS,MAAM,CAAC,OAAO,EAAE;QACrC,QAAQ,EAAE,CAAC,UAAU,CAAC,aAAa,EAAE,MAAM,CAAC,EAAE,UAAU,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;KAC1F,CAAC;AACJ,CAAC;AASD,wFAAwF;AACxF,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,KAAe,EACf,MAA6C;IAE7C,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,MAAM,KAAK,CAAC,YAAY,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC;IACpF,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC;IAClC,IAAI,CAAC,IAAI,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IACvF,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,UAAU,CAAC,IAAI,CAAC,EAAE,cAAc,EAAE,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;AAC1F,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,MAAiB,EACjB,MAA8C;IAE9C,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,iBAAiB,CAAC,EAAE,cAAc,EAAE,MAAM,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;IACpH,MAAM,EAAE,GAAG,CAAC,IAAY,EAAE,EAAE,CAC1B,QAAQ,CAAC,IAAI,CACX,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ;QAC9B,CAAC,CAAC,IAAI,KAAK,IAAI;QACf,CAAC,CAAC,aAAa,KAAK,yBAAyB;QAC7C,CAAC,CAAC,KAAK,KAAK,iBAAiB,CAChC,CAAC;IACJ,MAAM,IAAI,GAAG,EAAE,CAAC,aAAa,CAAC,CAAC;IAC/B,MAAM,OAAO,GAAG,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC;IACtC,IAAI,CAAC,IAAI,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IACpF,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,WAAW,EAAE,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,cAAc,EAAE,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;AAC3H,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,KAAe,EAAE,MAA6D;IAChH,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,KAAK,CAAC,oBAAoB,CAAC;QACrD,cAAc,EAAE,MAAM,CAAC,QAAQ;QAC/B,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,QAAQ,EAAE,CAAC,UAAU,CAAC,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,WAAW,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;KAChF,CAAC,CAAC;IACH,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IAClE,OAAO,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;AAClC,CAAC;AAED,wFAAwF;AACxF,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,MAAiB,EAAE,MAA6D;IACnH,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,iBAAiB,CAAC,EAAE,cAAc,EAAE,MAAM,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;IACpH,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CACvB,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ;QAC9B,CAAC,CAAC,IAAI,KAAK,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC;QACvC,CAAC,CAAC,aAAa,KAAK,yBAAyB;QAC7C,CAAC,CAAC,KAAK,KAAK,iBAAiB,CAChC,CAAC;IACF,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC/E,OAAO,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AACjC,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,MAAiB,EACjB,MAA0E;IAE1E,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,EAAE,cAAc,EAAE,MAAM,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC1G,MAAM,QAAQ,GAAG,oBAAoB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACpD,MAAM,UAAU,GAAI,CAAC,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,CAAW,CAAC,MAAM,CAC/E,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CACjD,CAAC;IACF,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACvH,CAAC;AASD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,MAA4B,EAC5B,OAAuD,EAAE;IAEzD,iHAAiH;IACjH,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,kBAAkB,CAAC,CAAC,CAAC;IAChE,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,WAAW,EAAE,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;IACjH,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC,OAAO,IAAI,oBAAoB,yBAAyB,EAAE;QAC5G,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,gBAAgB,EAAE;QAC9G,IAAI,EAAE,MAAM,CAAC,IAAI;KAClB,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IAC9H,MAAM,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAiD,CAAC;IAC/E,IAAI,CAAC,GAAG,CAAC,cAAc,IAAI,CAAC,GAAG,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IACtF,OAAO,EAAE,cAAc,EAAE,GAAG,CAAC,cAAc,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;AACpE,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,KAAe,EACf,MAA6E;IAE7E,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC;QAC1C,cAAc,EAAE,MAAM,CAAC,QAAQ;QAC/B,KAAK,EAAE;YACL;gBACE,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,uBAAuB;gBACpD,OAAO,EAAE;oBACP,EAAE,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,CAAC,oBAAoB,EAAE,SAAS,EAAE,oBAAoB,EAAE;iBACpG;gBACD,cAAc,EAAE,EAAE;gBAClB,cAAc,EAAE,EAAE;gBAClB,QAAQ,EAAE,EAAE;aACb;SACF;KACF,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC5B,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IAChE,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC;QAC/C,cAAc,EAAE,MAAM,CAAC,QAAQ;QAC/B,QAAQ,EAAE,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;KACzC,CAAC,CAAC;IACH,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;AACjC,CAAC;AAED,4GAA4G;AAC5G,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,KAAe,EACf,MAAwD;IAExD,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC;QAC/C,cAAc,EAAE,MAAM,CAAC,QAAQ;QAC/B,QAAQ,EAAE,CAAC,oBAAoB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;KAC/C,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;IAC9B,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACjE,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,oHAAoH;AACpH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,KAAe,EACf,MAAkF;IAElF,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC1D,MAAM,KAAK,CAAC,cAAc,CAAC,EAAE,cAAc,EAAE,MAAM,CAAC,QAAQ,EAAE,SAAS,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC;IACtG,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,kHAAkH;AAClH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,KAAe,EAAE,MAA8C;IAC1G,MAAM,KAAK,CAAC,WAAW,CAAC,EAAE,cAAc,EAAE,MAAM,CAAC,QAAQ,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;AAC3F,CAAC;AAED,iHAAiH;AACjH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,QAAqB,EAAE,MAA8C;IAC5G,OAAO,QAAQ,CAAC,WAAW,CAAC,EAAE,cAAc,EAAE,MAAM,CAAC,QAAQ,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;AAC/F,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,MAAiB,EACjB,MAAiG;IAEjG,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,EAAE,cAAc,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC7F,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC9B,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACpE,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,SAAS,KAAK,CAAC,EAAE,CAAC;QACtG,MAAM,IAAI,KAAK,CAAC,8CAA8C,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC1F,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACrG,uEAAuE;IACvE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,EAAE,cAAc,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;IACpG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,KAAK,MAAM,CAAC,oBAAoB,CAAC,EAAE,CAAC;QACtF,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;AACH,CAAC;AAID,+GAA+G;AAC/G,MAAM,UAAU,aAAa,CAAC,MAA+E;IAC3G,uFAAuF;IACvF,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IAClD,OAAO,wBAAwB,CAAC;QAC9B,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,cAAc,EAAE,MAAM,CAAC,QAAQ;QAC/B,QAAQ,EAAE,OAAO;QACjB,eAAe,EAAE,OAAO;KACzB,CAAC,CAAC;AACL,CAAC;AAED,mGAAmG;AACnG,MAAM,UAAU,UAAU,CAAC,MAA4E;IACrG,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAC/C,MAAM,OAAO,GAAG,wBAAwB,CAAC;QACvC,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,cAAc,EAAE,MAAM,CAAC,QAAQ;QAC/B,QAAQ,EAAE,OAAO;QACjB,eAAe,EAAE,OAAO;KACzB,CAAC,CAAC;IACH,IAAI,CAAC,OAAO,CAAC,iBAAiB;QAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACnG,OAAO,OAAqB,CAAC;AAC/B,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@mantle-agent/custody",
|
|
3
|
-
"version": "0.1.
|
|
3
|
+
"version": "0.1.1",
|
|
4
4
|
"description": "Turnkey custody for Mantle Agent Accounts: owner sub-orgs, agent wallets, delegated-access session signing policies and read-back verification. Browser-safe entry at /owner.",
|
|
5
5
|
"license": "MIT",
|
|
6
6
|
"repository": {
|
package/src/custody.ts
CHANGED
|
@@ -3,6 +3,7 @@ import type {
|
|
|
3
3
|
TCreatePoliciesBody,
|
|
4
4
|
TCreateSubOrganizationBody,
|
|
5
5
|
TCreateUsersBody,
|
|
6
|
+
TCreateWalletAccountsBody,
|
|
6
7
|
TCreateWalletBody,
|
|
7
8
|
TDeletePoliciesBody,
|
|
8
9
|
TDeleteUsersBody,
|
|
@@ -56,6 +57,7 @@ export type ParentApi = {
|
|
|
56
57
|
|
|
57
58
|
export type OwnerApi = {
|
|
58
59
|
createWallet(body: TCreateWalletBody): Promise<{ walletId: string; addresses: string[] }>;
|
|
60
|
+
createWalletAccounts(body: TCreateWalletAccountsBody): Promise<{ addresses: string[] }>;
|
|
59
61
|
createUsers(body: TCreateUsersBody): Promise<{ userIds: string[] }>;
|
|
60
62
|
createPolicies(body: TCreatePoliciesBody): Promise<{ policyIds: string[] }>;
|
|
61
63
|
deletePolicies(body: TDeletePoliciesBody): Promise<unknown>;
|
|
@@ -154,6 +156,34 @@ export async function readAgentWallet(
|
|
|
154
156
|
return { walletId: params.walletId, rootAddress: getAddress(root.address), sessionAddress: getAddress(session.address) };
|
|
155
157
|
}
|
|
156
158
|
|
|
159
|
+
/**
|
|
160
|
+
* Owner step (PRD WAL-07 key rotation): a new session key at `sessionKeyPath(index)` in the agent's wallet. A
|
|
161
|
+
* revoked key can never be granted again (the hook keeps it REVOKED), so re-authorizing needs a fresh one.
|
|
162
|
+
*/
|
|
163
|
+
export async function addSessionKey(owner: OwnerApi, params: { subOrgId: string; walletId: string; index: number }): Promise<Address> {
|
|
164
|
+
const { addresses } = await owner.createWalletAccounts({
|
|
165
|
+
organizationId: params.subOrgId,
|
|
166
|
+
walletId: params.walletId,
|
|
167
|
+
accounts: [ethAccount(sessionKeyPath(params.index), `session-${params.index}`)],
|
|
168
|
+
});
|
|
169
|
+
if (!addresses[0]) throw new Error("session key was not created");
|
|
170
|
+
return getAddress(addresses[0]);
|
|
171
|
+
}
|
|
172
|
+
|
|
173
|
+
/** Backend check: the rotated session key, read back from Turnkey at the exact path. */
|
|
174
|
+
export async function readSessionKey(reader: ParentApi, params: { subOrgId: string; walletId: string; index: number }): Promise<Address> {
|
|
175
|
+
const { accounts } = await reader.getWalletAccounts({ organizationId: params.subOrgId, walletId: params.walletId });
|
|
176
|
+
const key = accounts.find(
|
|
177
|
+
(a) =>
|
|
178
|
+
a.walletId === params.walletId &&
|
|
179
|
+
a.path === sessionKeyPath(params.index) &&
|
|
180
|
+
a.addressFormat === "ADDRESS_FORMAT_ETHEREUM" &&
|
|
181
|
+
a.curve === "CURVE_SECP256K1",
|
|
182
|
+
);
|
|
183
|
+
if (!key) throw new Error(`no session key at ${sessionKeyPath(params.index)}`);
|
|
184
|
+
return getAddress(key.address);
|
|
185
|
+
}
|
|
186
|
+
|
|
157
187
|
/**
|
|
158
188
|
* Backend check: the policy the owner created must be exactly the one we asked for. A page that swapped in a
|
|
159
189
|
* broader policy (another key, no expiry, any executor) is caught here before the session goes live.
|