getcofund 0.1.0 → 0.2.0

package/dist/cli/policies.js

@@ -0,0 +1,100 @@
+import { randomUUID } from "node:crypto";
+import { ApiPolicyTypeSchema, } from "../api-types.js";
+import { WRAPPER_ENTRYPOINT } from "../eip712.js";
+import { btcMessageSigner, evmWallet, readKeystore } from "../keys.js";
+import { signPolicyCreation } from "../policies.js";
+import { approval, chainPins, client, keystorePath, pickCofund, pinnedCompany, USAGE, } from "./context.js";
+/** The members `list` names, by id or email, in that order. */
+function pickSigners(members, list) {
+    return list.split(",").map((wanted) => {
+        const key = wanted.trim().toLowerCase();
+        const member = members.find((m) => m.id === key || m.email.toLowerCase() === key);
+        if (!member) {
+            throw new Error(`No member ${wanted.trim()} in this cofund`);
+        }
+        return member;
+    });
+}
+/** A transfer policy by default, a call policy with --wrapper. */
+function policyType(values) {
+    if (values.type) {
+        return ApiPolicyTypeSchema.parse(values.type);
+    }
+    return values.wrapper ? "Treasury_Management" : "Operational_Expense";
+}
+function policyLines(policy, company) {
+    const names = policy.signers.map((s) => s.name ?? s.email).join(", ");
+    return [
+        `policy    ${policy.name} (${policy.type})`,
+        `vault     ${policy.vault.address} on ${policy.vault.chain}`,
+        `signers   ${names}; ${policy.threshold} of ${policy.signers.length} must sign`,
+        policy.wrapper
+            ? `calls     ${policy.wrapper}, function ${WRAPPER_ENTRYPOINT}`
+            : `cap       ${policy.maxAmount} base units of ${policy.token} per transfer`,
+        `company   "${company}"`,
+    ];
+}
+/**
+ * `cofund policies create`: build the policy's activation from the flags, sign
+ * it with the local key and create the policy. It activates at once when one
+ * admin may activate it, else it awaits the other admins.
+ */
+export async function policiesCreate(io, values) {
+    const threshold = Number(values.threshold);
+    const transfer = values.token && values["max-amount"];
+    if (!(values.vault &&
+        values.name &&
+        values.signers &&
+        Number.isInteger(threshold)) ||
+        Boolean(transfer) === Boolean(values.wrapper)) {
+        io.err(USAGE);
+        return 1;
+    }
+    const keystore = readKeystore(keystorePath(io, values.keystore));
+    const api = client(io);
+    const cofundId = pickCofund(await api.me(), values.cofund);
+    const company = pinnedCompany(keystore, cofundId);
+    const [vaults, members] = await Promise.all([
+        api.vaults(cofundId),
+        api.members(cofundId),
+    ]);
+    const vault = vaults.find((v) => v.id === values.vault);
+    if (!vault) {
+        io.err(`No vault ${values.vault} in this cofund`);
+        return 1;
+    }
+    const common = {
+        id: randomUUID(),
+        vault,
+        name: values.name,
+        type: policyType(values),
+        signers: pickSigners(members, values.signers),
+        threshold,
+    };
+    const policy = values.wrapper
+        ? { ...common, wrapper: values.wrapper }
+        : {
+            ...common,
+            token: values.token,
+            maxAmount: values["max-amount"],
+        };
+    for (const line of policyLines(policy, company)) {
+        io.out(line);
+    }
+    const approve = approval(io, values.yes, "Sign and create this policy?");
+    if (!approve) {
+        io.err("Pass --yes to create without a prompt");
+        return 1;
+    }
+    if (!(await approve())) {
+        io.err("Not created");
+        return 1;
+    }
+    const body = await signPolicyCreation(policy, company, chainPins(io), {
+        evm: evmWallet(keystore),
+        btc: btcMessageSigner(keystore),
+    });
+    const created = await api.createPolicy(cofundId, body);
+    io.out(`created   ${created.id} (${created.status})`);
+    return 0;
+}

package/dist/cli.d.ts

@@ -5,6 +5,11 @@
  *   cofund keys init [--force]
  *   cofund me
  *   cofund invite accept [--invite <id>] [--company <name>]
+ *   cofund invite create --email <email> --first-name <name> --last-name <name>
+ *     --position <title> [--admin] [--chains A,B] [--yes]
+ *   cofund policies create --vault <id> --name <name> --signers <id|email,…>
+ *     --threshold <n> (--token <address|BTC> --max-amount <base units> |
+ *     --wrapper <address>) [--type <PolicyType>] [--yes]
  *   cofund requests [list]
  *   cofund requests show <id>
  *   cofund requests sign <id> [--yes]

package/dist/cli.js

@@ -5,6 +5,11 @@
  *   cofund keys init [--force]
  *   cofund me
  *   cofund invite accept [--invite <id>] [--company <name>]
+ *   cofund invite create --email <email> --first-name <name> --last-name <name>
+ *     --position <title> [--admin] [--chains A,B] [--yes]
+ *   cofund policies create --vault <id> --name <name> --signers <id|email,…>
+ *     --threshold <n> (--token <address|BTC> --max-amount <base units> |
+ *     --wrapper <address>) [--type <PolicyType>] [--yes]
  *   cofund requests [list]
  *   cofund requests show <id>
  *   cofund requests sign <id> [--yes]
@@ -27,8 +32,9 @@ import { createInterface } from "node:readline/promises";
 import { pathToFileURL } from "node:url";
 import { parseArgs } from "node:util";
 import { client, USAGE } from "./cli/context.js";
-import { inviteAccept } from "./cli/invite.js";
+import { inviteAccept, inviteCreate } from "./cli/invite.js";
 import { keysInit } from "./cli/keys.js";
+import { policiesCreate } from "./cli/policies.js";
 import { requestsCommand } from "./cli/requests.js";
 import { stocksBuy } from "./cli/stocks.js";
 import { webhooksCommand } from "./cli/webhooks.js";
@@ -45,6 +51,20 @@ export async function runCli(argv, io) {
             policy: { type: "string" },
             spend: { type: "string" },
             events: { type: "string" },
+            vault: { type: "string" },
+            name: { type: "string" },
+            type: { type: "string" },
+            signers: { type: "string" },
+            threshold: { type: "string" },
+            token: { type: "string" },
+            "max-amount": { type: "string" },
+            wrapper: { type: "string" },
+            email: { type: "string" },
+            "first-name": { type: "string" },
+            "last-name": { type: "string" },
+            position: { type: "string" },
+            admin: { type: "boolean" },
+            chains: { type: "string" },
             yes: { type: "boolean", short: "y" },
             help: { type: "boolean", short: "h" },
         },
@@ -73,6 +93,10 @@ export async function runCli(argv, io) {
                 return 0;
             case "invite accept":
                 return await inviteAccept(io, values);
+            case "invite create":
+                return await inviteCreate(io, values);
+            case "policies create":
+                return await policiesCreate(io, values);
             default:
                 io.err(USAGE);
                 return 1;

package/dist/client.d.ts

@@ -1,4 +1,4 @@
-import { type AcceptInviteRequest, type CreateWebhookRequest, type ProposeCallRequest, type ProposeTransferRequest } from "./api-types.ts";
+import { type AcceptInviteRequest, type CreateInviteRequest, type CreatePolicyRequest, type CreateWebhookRequest, type ProposeCallRequest, type ProposeTransferRequest } from "./api-types.ts";
 export declare class CofundApiError extends Error {
     readonly status: number;
     constructor(status: number, message: string);
@@ -168,9 +168,71 @@ export declare class CofundClient {
         wrapper: string | null;
         func: "entry" | null;
     }>;
+    /**
+     * Admins only: create a policy with the creator's activation signature
+     * (`signPolicyCreation`). It activates at once when the activation rule
+     * lets one admin do it, else it awaits the other admins' approvals as a
+     * `policy` request with the same id. Safe to retry: the same `id` returns
+     * the same policy.
+     */
+    createPolicy(cofundId: string, body: CreatePolicyRequest): Promise<{
+        id: string;
+        name: string;
+        type: "Contractor_Stipend" | "Operational_Expense" | "Treasury_Management";
+        status: "PENDING" | "ACTIVE" | "INACTIVE" | "FAILED" | "AWAITING_SIGNATURES";
+        threshold: number;
+        vault: {
+            id: string;
+            chain: "ETHEREUM" | "BASE" | "ARBITRUM" | "ROBINHOOD";
+            address: string;
+        } | {
+            id: string;
+            chain: "BTC";
+            address: string;
+        };
+        signers: {
+            id: string;
+            name: string | null;
+        }[];
+        token: {
+            address: string;
+            symbol: string;
+            decimals: number;
+        } | null;
+        maxAmount: string | null;
+        recipients: string[];
+        wrapper: string | null;
+        func: "entry" | null;
+    }>;
+    /** Admins only: the user id an invite to `email` must seat; null for a new account. */
+    inviteUserId(cofundId: string, email: string): Promise<{
+        userId: string | null;
+    }>;
+    /**
+     * Admins only: invite a member with the admin's `InviteUser` per chain
+     * (`signInviteCreation`). Safe to retry: the same `id` returns the same
+     * invite.
+     */
+    createInvite(cofundId: string, body: CreateInviteRequest): Promise<{
+        id: string;
+        cofundId: string;
+        member: {
+            id: string;
+            email: string;
+            isAdmin: boolean;
+            position: string;
+        };
+        chains: {
+            chain: "ETHEREUM" | "BASE" | "ARBITRUM" | "ROBINHOOD";
+            id: string;
+            status: "FAILED" | "AWAITING_SIGNATURES" | "COMPLETED" | "AWAITING_SUBMISSION" | "PROCESSING" | "EXPIRED" | "CANCELED" | "REJECTED";
+            expiresAt: string;
+        }[];
+    }>;
     /** Admins only. */
     members(cofundId: string): Promise<{
         id: string;
+        onchainId: string;
         email: string;
         name: string | null;
         isAdmin: boolean;

package/dist/client.js

@@ -1,5 +1,5 @@
 import { z } from "zod";
-import { AcceptInviteResultSchema, ApiCallRequestSchema, ApiErrorSchema, ApiInviteSchema, ApiMemberSchema, ApiMeSchema, ApiPolicySchema, ApiRequestSchema, ApiTransferRequestSchema, ApiVaultDetailSchema, ApiVaultSchema, ApiWebhookSchema, CreatedWebhookSchema, DeleteWebhookResultSchema, RejectResultSchema, } from "./api-types.js";
+import { AcceptInviteResultSchema, ApiCallRequestSchema, ApiCreatedInviteSchema, ApiErrorSchema, ApiInviteSchema, ApiMemberSchema, ApiMeSchema, ApiPolicySchema, ApiRequestSchema, ApiTransferRequestSchema, ApiVaultDetailSchema, ApiVaultSchema, ApiWebhookSchema, CreatedWebhookSchema, DeleteWebhookResultSchema, InviteUserIdSchema, RejectResultSchema, } from "./api-types.js";
 const TRAILING_SLASHES = /\/+$/;
 /** Gateway errors a retry of an idempotent proposal may outlast. */
 const RETRYABLE = new Set([502, 503, 504]);
@@ -106,6 +106,30 @@ export class CofundClient {
     policy(cofundId, policyId) {
         return this.call(ApiPolicySchema, `/cofunds/${cofundId}/policies/${policyId}`);
     }
+    /**
+     * Admins only: create a policy with the creator's activation signature
+     * (`signPolicyCreation`). It activates at once when the activation rule
+     * lets one admin do it, else it awaits the other admins' approvals as a
+     * `policy` request with the same id. Safe to retry: the same `id` returns
+     * the same policy.
+     */
+    createPolicy(cofundId, body) {
+        return this.call(ApiPolicySchema, `/cofunds/${cofundId}/policies`, body, {
+            retries: 2,
+        });
+    }
+    /** Admins only: the user id an invite to `email` must seat; null for a new account. */
+    inviteUserId(cofundId, email) {
+        return this.call(InviteUserIdSchema, `/cofunds/${cofundId}/invites/user-id`, { email });
+    }
+    /**
+     * Admins only: invite a member with the admin's `InviteUser` per chain
+     * (`signInviteCreation`). Safe to retry: the same `id` returns the same
+     * invite.
+     */
+    createInvite(cofundId, body) {
+        return this.call(ApiCreatedInviteSchema, `/cofunds/${cofundId}/invites`, body, { retries: 2 });
+    }
     /** Admins only. */
     members(cofundId) {
         return this.call(z.array(ApiMemberSchema), `/cofunds/${cofundId}/members`);

package/dist/eip712.d.ts

@@ -87,6 +87,20 @@ export declare function buildCofundDomain({ chainId, state, }: {
 export declare const INVITE_USER_TYPES: TypeSet;
 /** `CFHelpersUsersv1.MAX_INVITE_LIFETIME`: the furthest out an `InviteUser`'s `expiresAt` may be. */
 export declare const MAX_INVITE_LIFETIME_SECONDS: number;
+/**
+ * Headroom under the contract's ceiling. `_requireWindow` rejects
+ * `expiresAt > block.timestamp + MAX_INVITE_LIFETIME`, and `block.timestamp`
+ * at inclusion is the sequencer's clock, not the signer's: signing exactly
+ * `now + 30 days` reverts with `InvalidParams` whenever the chain is even one
+ * second behind (clock skew, a lagging L2 sequencer). Anvil stamps blocks from
+ * the same wall clock, so no local stack ever shows it. A full day of headroom
+ * (so 29 days signed) is far beyond any skew.
+ */
+export declare const CHAIN_CLOCK_SKEW_MARGIN_SECONDS: number;
+/** What an inviting admin signs: the ceiling minus the skew margin. */
+export declare const INVITE_LIFETIME_SECONDS: number;
+/** An invite's `expiresAt`: unix SECONDS, as `uint256 expiresAt` wants them. */
+export declare function inviteExpiresAt(now?: Date, lifetimeSeconds?: number): string;
 export declare const REMOVE_USER_TYPES: TypeSet;
 /**
  * Closing a client's onboarding phase (§4.3, round 4).

package/dist/eip712.js

@@ -51,6 +51,22 @@ export const INVITE_USER_TYPES = Object.freeze({
 });
 /** `CFHelpersUsersv1.MAX_INVITE_LIFETIME`: the furthest out an `InviteUser`'s `expiresAt` may be. */
 export const MAX_INVITE_LIFETIME_SECONDS = 30 * 24 * 60 * 60;
+/**
+ * Headroom under the contract's ceiling. `_requireWindow` rejects
+ * `expiresAt > block.timestamp + MAX_INVITE_LIFETIME`, and `block.timestamp`
+ * at inclusion is the sequencer's clock, not the signer's: signing exactly
+ * `now + 30 days` reverts with `InvalidParams` whenever the chain is even one
+ * second behind (clock skew, a lagging L2 sequencer). Anvil stamps blocks from
+ * the same wall clock, so no local stack ever shows it. A full day of headroom
+ * (so 29 days signed) is far beyond any skew.
+ */
+export const CHAIN_CLOCK_SKEW_MARGIN_SECONDS = 24 * 60 * 60;
+/** What an inviting admin signs: the ceiling minus the skew margin. */
+export const INVITE_LIFETIME_SECONDS = MAX_INVITE_LIFETIME_SECONDS - CHAIN_CLOCK_SKEW_MARGIN_SECONDS;
+/** An invite's `expiresAt`: unix SECONDS, as `uint256 expiresAt` wants them. */
+export function inviteExpiresAt(now = new Date(), lifetimeSeconds = INVITE_LIFETIME_SECONDS) {
+    return String(Math.floor(now.getTime() / 1000) + lifetimeSeconds);
+}
 export const REMOVE_USER_TYPES = Object.freeze({
     RemoveUser: [
         { name: "company", type: "string" },

package/dist/index.d.ts

@@ -5,6 +5,7 @@ export * from "./client.ts";
 export * from "./eip712.ts";
 export * from "./invite.ts";
 export * from "./keys.ts";
+export * from "./policies.ts";
 export * from "./requests.ts";
 export * from "./stocks/index.ts";
 export * from "./webhooks.ts";

package/dist/index.js

@@ -5,6 +5,7 @@ export * from "./client.js";
 export * from "./eip712.js";
 export * from "./invite.js";
 export * from "./keys.js";
+export * from "./policies.js";
 export * from "./requests.js";
 export * from "./stocks/index.js";
 export * from "./webhooks.js";

package/dist/invite.d.ts

@@ -1,7 +1,8 @@
 import type { Wallet } from "ethers";
-import type { AcceptInviteRequest, ApiInvite } from "./api-types.ts";
+import { type AcceptInviteRequest, type ApiInvite, type CreateInviteRequest, type EvmChainName } from "./api-types.ts";
 import { type ChainPins } from "./chains.ts";
 import { type InviteUserMessage } from "./eip712.ts";
+import type { TypedDataSigner } from "./requests.ts";
 /** What the invitee expects before signing anything. */
 export type InviteExpectations = {
     /** The caller's own user id (from `/me`). */
@@ -25,3 +26,29 @@ export declare function checkInvite(invite: ApiInvite, expected: InviteExpectati
 }[];
 /** Sign each checked `InviteUser` with the local EVM key. */
 export declare function signInviteAcceptance(checked: ReturnType<typeof checkInvite>, wallet: Wallet): Promise<AcceptInviteRequest["evm"]>;
+/** An invite to create, as the inviting admin states it. */
+export type NewInvite = {
+    /** A fresh UUID: the invite's id and every chain's `authId`; a retry reuses it. */
+    id: string;
+    /** The inviting admin's own user id (`/me`), signed as `callerId`. */
+    callerId: string;
+    /** `inviteUserId(email)`'s answer, else `id`. */
+    userId: string;
+    email: string;
+    firstName: string;
+    lastName: string;
+    position: string;
+    isAdmin: boolean;
+    /** The cofund's EVM vault chains: one seat on each. */
+    chains: EvmChainName[];
+    /** Unix seconds; 29 days out by default (`INVITE_LIFETIME_SECONDS`). */
+    expiresAt?: string;
+    now?: Date;
+};
+/**
+ * The POST /invites body for `invite`: on each chain the `InviteUser` built
+ * here from the admin's own inputs, under the pinned domain and the pinned
+ * `company`, signed with the local EVM key. The invitee and any co-signing
+ * admins later sign the same message.
+ */
+export declare function signInviteCreation(invite: NewInvite, company: string, pins: ChainPins, wallet: TypedDataSigner): Promise<CreateInviteRequest>;

package/dist/invite.js

@@ -1,5 +1,6 @@
+import { CreateInviteRequestSchema, } from "./api-types.js";
 import { pinnedDomain, sameDomain } from "./chains.js";
-import { inviteUserTypes, MAX_INVITE_LIFETIME_SECONDS, } from "./eip712.js";
+import { inviteExpiresAt, inviteUserTypes, MAX_INVITE_LIFETIME_SECONDS, } from "./eip712.js";
 /** The decoded message, field by field: nothing the types do not name. */
 function rebuildMessage(m) {
     return {
@@ -69,3 +70,41 @@ export async function signInviteAcceptance(checked, wallet) {
         signature: await wallet.signTypedData(domain, inviteUserTypes(), message),
     })));
 }
+/**
+ * The POST /invites body for `invite`: on each chain the `InviteUser` built
+ * here from the admin's own inputs, under the pinned domain and the pinned
+ * `company`, signed with the local EVM key. The invitee and any co-signing
+ * admins later sign the same message.
+ */
+export async function signInviteCreation(invite, company, pins, wallet) {
+    const now = invite.now ?? new Date();
+    const expiresAt = invite.expiresAt ?? inviteExpiresAt(now);
+    const problem = inviteWindowProblem(expiresAt, now);
+    if (problem) {
+        throw new Error(`The invite cannot be signed: ${problem}`);
+    }
+    const message = {
+        company,
+        callerId: invite.callerId,
+        userId: invite.userId,
+        userIsAdmin: invite.isAdmin,
+        userPosition: invite.position,
+        expiresAt,
+        authId: invite.id,
+    };
+    const chains = await Promise.all(invite.chains.map(async (chain) => ({
+        chain,
+        expiresAt,
+        signature: await wallet.signTypedData(pinnedDomain(pins, chain), inviteUserTypes(), message),
+    })));
+    return CreateInviteRequestSchema.parse({
+        id: invite.id,
+        email: invite.email,
+        firstName: invite.firstName,
+        lastName: invite.lastName,
+        position: invite.position,
+        isAdmin: invite.isAdmin,
+        userId: invite.userId,
+        chains,
+    });
+}

package/dist/policies.d.ts

@@ -0,0 +1,69 @@
+import { type ApiMember, type ApiPolicyType, type ApiVault, type CreatePolicyRequest, type PolicyType } from "./api-types.ts";
+import { type BtcPolicyActivationData } from "./btc-policy-activation.ts";
+import { type ChainPins } from "./chains.ts";
+import type { LocalSigners } from "./requests.ts";
+/**
+ * Policy activations: what an admin signs to create a policy or to approve one.
+ * One builder for both, so the creator signs exactly what each approving admin
+ * later rebuilds and the app verifies.
+ */
+/** What an activation commits to, besides its signers. */
+export type PolicyActivationFields = {
+    /** The policy's id, also its activation's `authId`. */
+    id: string;
+    name: string;
+    type: PolicyType;
+    threshold: number;
+    /** Transfer policies: the token (an EVM address, or `BTC`), the cap per transfer and the allowlist (empty: any). */
+    token: string | null;
+    maxAmount: string | null;
+    recipients: string[];
+    /** Call policies: the wrapper; its one function is `entry`. */
+    wrapper: string | null;
+};
+/**
+ * The EVM activation: a call policy names its wrapper and `entry`, a transfer
+ * policy its token, cap and allowlist. `signerIds` are the signers' on-chain
+ * user ids.
+ */
+export declare function evmPolicyActivation(company: string, fields: PolicyActivationFields & {
+    signerIds: string[];
+}): {
+    types: Record<string, {
+        name: string;
+        type: string;
+    }[]>;
+    message: Record<string, unknown>;
+};
+/** The BTC activation; each signer's Cofund leaf key is derived here from their account xpub. */
+export declare function btcPolicyActivation(company: string, fields: PolicyActivationFields & {
+    signerXpubs: string[];
+}): BtcPolicyActivationData;
+/** A policy to create, as its creator states it. */
+export type NewPolicy = {
+    /** A fresh UUID: the policy's id and its activation's `authId`; a retry reuses it. */
+    id: string;
+    /** From `vaults()`. */
+    vault: ApiVault;
+    name: string;
+    type: ApiPolicyType;
+    /** The members who sign, from `members()`: the activation names their `onchainId` (EVM) or BTC key. */
+    signers: ApiMember[];
+    threshold: number;
+} & ({
+    token: string;
+    maxAmount: string;
+    wrapper?: undefined;
+} | {
+    wrapper: string;
+    token?: undefined;
+    maxAmount?: undefined;
+});
+/**
+ * The POST /policies body for `policy`: its activation built here from the
+ * creator's own inputs, under the pinned domain (EVM) and the pinned
+ * `company`, and signed with the local key: EIP-712 on EVM, the BTC key's
+ * Cofund leaf on BTC. The server builds the same activation and checks the
+ * signature against the creator's key.
+ */
+export declare function signPolicyCreation(policy: NewPolicy, company: string, pins: ChainPins, signers: LocalSigners): Promise<CreatePolicyRequest>;

package/dist/policies.js

@@ -0,0 +1,132 @@
+import { sha256 } from "@noble/hashes/sha2";
+import { bytesToHex } from "@noble/hashes/utils";
+import { ethers } from "ethers";
+import { CreatePolicyRequestSchema, } from "./api-types.js";
+import { btcPolicyActivationMessage, } from "./btc-policy-activation.js";
+import { pinnedDomain } from "./chains.js";
+import { transactionPolicyActivationTypes, transferPolicyActivationTypes, WRAPPER_ENTRYPOINT, } from "./eip712.js";
+import { btcCofundLeafKey } from "./keys.js";
+const byCodepoint = (a, b) => (a < b ? -1 : Number(a > b));
+/**
+ * The EVM activation: a call policy names its wrapper and `entry`, a transfer
+ * policy its token, cap and allowlist. `signerIds` are the signers' on-chain
+ * user ids.
+ */
+export function evmPolicyActivation(company, fields) {
+    const common = {
+        company,
+        policyId: fields.id,
+        title: fields.name,
+        policyType: fields.type,
+        signerIds: [...fields.signerIds].sort(byCodepoint),
+        threshold: String(fields.threshold),
+        authId: fields.id,
+    };
+    if (fields.wrapper) {
+        return {
+            types: transactionPolicyActivationTypes(),
+            message: { ...common, wrapper: fields.wrapper, func: WRAPPER_ENTRYPOINT },
+        };
+    }
+    return {
+        types: transferPolicyActivationTypes(),
+        message: {
+            ...common,
+            token: fields.token ?? ethers.ZeroAddress,
+            maxAmount: fields.maxAmount ?? "0",
+            recipients: fields.recipients,
+        },
+    };
+}
+/** The BTC activation; each signer's Cofund leaf key is derived here from their account xpub. */
+export function btcPolicyActivation(company, fields) {
+    const isTransaction = fields.wrapper !== null;
+    return {
+        clientId: bytesToHex(sha256(new TextEncoder().encode(company))),
+        policyId: fields.id,
+        authId: fields.id,
+        policyType: fields.type,
+        policyTitle: fields.name,
+        policySignerKeys: fields.signerXpubs
+            .map(btcCofundLeafKey)
+            .sort(byCodepoint),
+        policyThreshold: fields.threshold,
+        txWrapper: fields.wrapper ?? "",
+        txFunc: isTransaction ? WRAPPER_ENTRYPOINT : "",
+        isTransaction,
+        maxAmount: isTransaction ? "0" : (fields.maxAmount ?? "0"),
+        tokenIdentifier: isTransaction ? "" : (fields.token ?? ""),
+        recipients: isTransaction ? [] : [...fields.recipients].sort(byCodepoint),
+    };
+}
+/** Each signer's BTC account xpub in this cofund. */
+function btcXpubs(signers) {
+    return signers.map((signer) => {
+        const key = signer.keys.find(({ chain }) => chain === "BTC");
+        if (!key) {
+            throw new Error(`${signer.name ?? signer.id} has no Bitcoin key`);
+        }
+        return key.pubKey;
+    });
+}
+/**
+ * The POST /policies body for `policy`: its activation built here from the
+ * creator's own inputs, under the pinned domain (EVM) and the pinned
+ * `company`, and signed with the local key: EIP-712 on EVM, the BTC key's
+ * Cofund leaf on BTC. The server builds the same activation and checks the
+ * signature against the creator's key.
+ */
+export async function signPolicyCreation(policy, company, pins, signers) {
+    const fields = {
+        id: policy.id,
+        name: policy.name,
+        type: policy.type,
+        threshold: policy.threshold,
+        token: policy.token ?? null,
+        maxAmount: policy.maxAmount ?? null,
+        recipients: [],
+        wrapper: policy.wrapper ?? null,
+    };
+    const common = {
+        id: policy.id,
+        vaultId: policy.vault.id,
+        name: policy.name,
+        type: policy.type,
+        signers: policy.signers.map(({ id }) => id),
+        threshold: policy.threshold,
+    };
+    const { vault } = policy;
+    if (vault.chain === "BTC") {
+        if (policy.wrapper !== undefined || policy.token !== "BTC") {
+            throw new Error("A Bitcoin policy sends BTC, and binds no wrapper");
+        }
+        if (!signers.btc) {
+            throw new Error("A Bitcoin policy needs the BTC key");
+        }
+        const data = btcPolicyActivation(company, {
+            ...fields,
+            signerXpubs: btcXpubs(policy.signers),
+        });
+        return CreatePolicyRequestSchema.parse({
+            ...common,
+            chain: "BTC",
+            token: "BTC",
+            maxAmount: policy.maxAmount,
+            signature: await signers.btc.signMessage(btcPolicyActivationMessage(data)),
+        });
+    }
+    const { types, message } = evmPolicyActivation(company, {
+        ...fields,
+        signerIds: policy.signers.map(({ onchainId }) => onchainId),
+    });
+    const signature = await signers.evm.signTypedData(pinnedDomain(pins, vault.chain), types, message);
+    return CreatePolicyRequestSchema.parse(policy.wrapper === undefined
+        ? {
+            ...common,
+            chain: vault.chain,
+            token: policy.token,
+            maxAmount: policy.maxAmount,
+            signature,
+        }
+        : { ...common, chain: vault.chain, wrapper: policy.wrapper, signature });
+}

package/dist/requests.d.ts

@@ -1,7 +1,7 @@
 import type { ApiInviteRequest, ApiPolicy, ApiPolicyRequest, ApiRequest, ApiToken, ChainName, EvmChainName, PolicyType } from "./api-types.ts";
 import { type ChainPins } from "./chains.ts";
 import { type AllowanceMessage, type Eip712Domain } from "./eip712.ts";
-import { type BtcMessageSigner } from "./keys.ts";
+import type { BtcMessageSigner } from "./keys.ts";
 import { type DecodedStockSwap } from "./stocks/index.ts";
 /**
  * Local signers for transfers, calls, policy activations and admin invites.