accounts/dist/core/AccessKey.d.ts

Tempo Accounts SDK

import { Address, Hex, WebCryptoP256 } from 'ox';
import { KeyAuthorization } from 'ox/tempo';
import { type Client, type Transport } from 'viem';
import { Account as TempoAccount } from 'viem/tempo';
import type { StoreApi } from 'zustand';
import type { OneOf } from '../internal/types.js';
import * as Keystore from './Keystore.js';
import type * as Store from './Store.js';
declare const status: {
    /** No matching usable access key was found. */
    readonly missing: "missing";
    /** A matching key has a stored authorization that has not been observed on-chain yet. */
    readonly pending: "pending";
    /** A matching key exists on-chain and can be used. */
    readonly published: "published";
    /** A matching key exists but is past its expiry. */
    readonly expired: "expired";
};
type Status = (typeof status)[keyof typeof status];
/** Access key entry stored alongside accounts. */
export type AccessKey = {
    /** Access key address. */
    address: Address.Address;
    /** Owner of the access key. */
    access: Address.Address;
    /** Chain ID this access key authorization is scoped to. */
    chainId: number;
    /** Unix timestamp when the access key expires. */
    expiry?: number | undefined;
    /** Signed key authorization managed by viem until the key is observed on-chain. */
    keyAuthorization?: KeyAuthorization.Signed | undefined;
    /** Key type. */
    keyType: 'secp256k1' | 'p256' | 'webAuthn' | 'webCrypto';
    /** TIP-20 spending limits for the access key. */
    limits?: {
        token: Address.Address;
        limit: bigint;
        period?: number | undefined;
    }[] | undefined;
    /** Call scopes restricting which contracts/selectors this key can call. */
    scopes?: {
        address: Address.Address;
        selector?: Hex.Hex | string | undefined;
        recipients?: readonly Address.Address[] | undefined;
    }[] | undefined;
} & OneOf<{} | {
    /** The exported private key backing the access key. */
    privateKey: Hex.Hex;
} | {
    /** The WebCrypto key pair backing the access key. */
    keyPair: Awaited<ReturnType<typeof WebCryptoP256.createKeyPair>>;
} | {
    /** Opaque keystore handle backing the access key. Persisted verbatim; schema owned by the keystore that wrote it. */
    handle: Keystore.Handle;
    /** Public key backing the access key. */
    publicKey: Hex.Hex;
}>;
/** Calls used to match access key scopes. */
export type Call = {
    /** Contract address being called. */
    to?: Address.Address | undefined;
    /** Calldata being sent. */
    data?: Hex.Hex | undefined;
};
/** Access key status query. */
type StatusQuery = {
    /** Root account address. */
    account: Address.Address;
    /** Specific access key address to match. */
    accessKey?: Address.Address | undefined;
    /** Calls to match against access key scopes. */
    calls?: readonly Call[] | undefined;
    /** Chain ID the access key must be authorized on. */
    chainId: number;
    /** Client used to verify publication state on-chain. */
    client: Client<Transport>;
    /** Current Unix timestamp in seconds. Defaults to `Date.now() / 1000`. */
    now?: number | undefined;
    /** Access-key manager options. */
    store: ManagerOptions;
};
/** Access key selection query. */
type SelectQuery = {
    /** Root account address. */
    account: Address.Address;
    /** Calls to match against access key scopes. */
    calls?: readonly Call[] | undefined;
    /** Chain ID the access key must be authorized on. */
    chainId: number;
    /** Current Unix timestamp in seconds. Defaults to `Date.now() / 1000`. */
    now?: number | undefined;
    /** Access-key manager options. */
    store: ManagerOptions;
};
/** Access key authorization reuse policy. */
export type ReusePolicy = {
    /** Minimum Unix timestamp a reusable key must be valid through. */
    minExpiry?: number | undefined;
    /** Minimum spending limits a reusable key must satisfy. */
    minLimits?: readonly KeyAuthorization.TokenLimit[] | undefined;
};
/** Access key authorization parameters plus SDK-only reuse policy. */
export type ReusableAuthorization = Omit<prepareAuthorization.Options, 'chainId' | 'keystores'> & {
    /** Chain ID the key authorization is scoped to. */
    chainId?: bigint | number | undefined;
    /** SDK-only reuse policy. Not sent over RPC. */
    reuse?: ReusePolicy | undefined;
};
type ReusableQuery = {
    /** Root account address. */
    account: Address.Address;
    /** Calls the access key must be able to sign. */
    calls?: readonly Call[] | undefined;
    /** Chain ID the access key must be authorized on. */
    chainId: number;
    /** Current Unix timestamp in seconds. Defaults to `Date.now() / 1000`. */
    now?: number | undefined;
    /** Access key authorization parameters with optional reuse policy. */
    parameters: ReusableAuthorization;
    /** Access-key manager options. */
    store: ManagerOptions;
};
type CallsQuery = {
    /** Calls the authorization must be able to sign. */
    calls?: readonly Call[] | undefined;
    /** Access key authorization parameters. */
    parameters: Pick<ReusableAuthorization, 'scopes'>;
};
type ListQuery = {
    /** Root account address. */
    account: Address.Address;
    /** Specific access key address to match. */
    accessKey?: Address.Address | undefined;
    /** Chain ID the access key is scoped to. */
    chainId: number;
    /** Access-key manager dependencies. */
    store: ManagerOptions;
};
type MatchQuery = {
    /** Calls the access key must be able to sign. */
    calls?: readonly Call[] | undefined;
};
type ManagerOptions = {
    /** Keystores backing access-key records that carry an opaque `handle`. */
    keystores: Keystore.Keystores;
    /** Zustand store containing access-key metadata. */
    state: Pick<StoreApi<Store.State>, 'getState' | 'setState'>;
};
/** Access-key identity. */
type Key = {
    /** Root account address. */
    account: Address.Address;
    /** Access key address. */
    accessKey: Address.Address;
    /** Chain ID the access key is scoped to. */
    chainId: number;
};
/** Store-bound access-key operations. */
type Manager = {
    /** Adds a signed access-key authorization. */
    add: (options: Omit<add.Options, 'store'>) => add.ReturnType;
    /** Prepares, signs, and saves an access key authorization. */
    authorize: (options: Omit<authorize.Options, 'store'>) => Promise<authorize.ReturnType>;
    /** Clears all access-key records. */
    clear: () => void;
    /** Prepares an unsigned key authorization, creating key material via the keystore when needed. */
    prepareAuthorization: (options: Omit<prepareAuthorization.Options, 'keystore'>) => Promise<prepareAuthorization.ReturnType>;
    /** Returns publication status for a stored or on-chain access key. */
    getStatus: (options: Omit<StatusQuery, 'store'>) => Promise<Status>;
    /** Returns a locally-signable access key account by exact address. */
    get: (options: Omit<get.Options, 'store'>) => Promise<get.ReturnType>;
    /** Returns access-key metadata matching a query. */
    list: (options: Omit<ListQuery, 'store'>) => readonly AccessKey[];
    /** Removes an access-key record. */
    remove: (options: Omit<remove.Options, 'store'>) => void;
    /** Selects a locally-signable access key account for an intent. */
    select: (options: Omit<SelectQuery, 'store'>) => Promise<TempoAccount.AccessKeyAccount | undefined>;
    /** Updates stored authorization metadata for an existing access key. */
    updateAuthorization: (options: Omit<updateAuthorization.Options, 'store'>) => void;
};
/** Creates store-bound access-key operations. */
export declare function createManager(options: createManager.Options): Manager;
export declare namespace createManager {
    /** Options for {@link createManager}. */
    type Options = ManagerOptions;
}
/** Prepares an unsigned key authorization and local key material when needed. */
export declare function prepareAuthorization(options: prepareAuthorization.Options): Promise<prepareAuthorization.ReturnType>;
export declare namespace prepareAuthorization {
    /** Options for {@link prepareAuthorization}. */
    type Options = {
        /** External access key address. Alternative to `publicKey`. */
        address?: Address.Address | undefined;
        /** Chain ID the key authorization is scoped to. */
        chainId: bigint | number;
        /** Unix timestamp when the key expires. */
        expiry: number;
        /**
         * Keystores used to create key material when none is provided.
         * @default Keystore.defaults
         */
        keystores?: Keystore.Keystores | undefined;
        /** External key type. Defaults to `secp256k1` for external keys. */
        keyType?: 'secp256k1' | 'p256' | 'webAuthn' | undefined;
        /** TIP-20 spending limits for this key. */
        limits?: readonly KeyAuthorization.TokenLimit[] | undefined;
        /** Exported private key backing the access key. */
        privateKey?: Hex.Hex | undefined;
        /** External public key to derive the access key address from. */
        publicKey?: Hex.Hex | undefined;
        /** Call scopes restricting which contracts/selectors this key can call. */
        scopes?: readonly KeyAuthorization.Scope[] | undefined;
        /**
         * TIP-1053 witness (32 bytes) to bind into the key authorization. Set to
         * `hashMessage(message)` to fuse a Sign-In-with-Tempo proof into the
         * access-key authorization so both are covered by a single signature.
         */
        witness?: Hex.Hex | undefined;
    };
    /** Prepared unsigned key authorization and optional local key material. */
    type ReturnType = {
        /** Keystore-created key material reference. */
        key?: {
            handle: Keystore.Handle;
            publicKey: Hex.Hex;
        } | undefined;
        /** Unsigned key authorization to sign with the root account. */
        keyAuthorization: KeyAuthorization.KeyAuthorization<false>;
        /** Exported private key backing an external access key. */
        privateKey?: Hex.Hex | undefined;
    };
}
/** Prepares, signs, and saves an access key authorization. */
export declare function authorize(options: authorize.Options): Promise<authorize.ReturnType>;
export declare namespace authorize {
    /** Options for {@link authorize}. */
    type Options = {
        /** Root account that owns this access key and signs its authorization. */
        account: Pick<TempoAccount.Account, 'address' | 'sign'>;
        /** Default chain ID for the authorization when `parameters.chainId` is not set. */
        chainId: bigint | number;
        /** Access key authorization parameters. */
        parameters: Omit<prepareAuthorization.Options, 'chainId' | 'keystores'> & {
            /** Chain ID the key authorization is scoped to. */
            chainId?: bigint | number | undefined;
        };
        /** Reactive state store. */
        store: ManagerOptions;
    };
    /** Signed key authorization in RPC form. */
    type ReturnType = KeyAuthorization.Rpc;
}
/** Returns whether a local access key satisfies reusable authorization parameters. */
export declare function hasReusableAuthorization(options: ReusableQuery): Promise<boolean>;
/** Returns whether an authorization request could sign the provided calls. */
export declare function canAuthorizeCalls(options: CallsQuery): boolean;
/** Returns publication status for a stored or on-chain access key. */
export declare function getStatus(options: StatusQuery): Promise<Status>;
/** Selects a locally-signable access key account for an intent. */
export declare function select(options: SelectQuery): Promise<TempoAccount.AccessKeyAccount | undefined>;
/** Returns a locally-signable access key account by exact address. */
export declare function get(options: get.Options): Promise<get.ReturnType>;
export declare namespace get {
    type Options = MatchQuery & {
        /** Root account address. */
        account: Address.Address;
        /** Specific access key address to match. */
        accessKey: Address.Address;
        /** Chain ID the access key must be authorized on. */
        chainId: number;
        /** Current Unix timestamp in seconds. Defaults to `Date.now() / 1000`. */
        now?: number | undefined;
        /** Reactive state store. */
        store: ManagerOptions;
    };
    type ReturnType = TempoAccount.AccessKeyAccount | undefined;
}
/** Adds a signed access key authorization. */
export declare function add(options: add.Options): add.ReturnType;
export declare namespace add {
    /** Options for {@link add}. */
    type Options = {
        /** Root account address that owns this access key. */
        account: Address.Address;
        /** Signed key authorization for the access key. */
        authorization: KeyAuthorization.Signed;
        /** Opaque keystore handle backing the access key. Requires `publicKey`. */
        handle?: Keystore.Handle | undefined;
        /** The exported private key backing the access key. */
        privateKey?: Hex.Hex | undefined;
        /** The WebCrypto key pair backing the access key. */
        keyPair?: Awaited<globalThis.ReturnType<typeof WebCryptoP256.createKeyPair>> | undefined;
        /** Public key backing a keystore-managed access key. */
        publicKey?: Hex.Hex | undefined;
        /** Reactive state store. */
        store: ManagerOptions;
    };
    /** Stored access key record. */
    type ReturnType = AccessKey;
}
declare function updateAuthorization(options: updateAuthorization.Options): void;
declare namespace updateAuthorization {
    type Options = Key & {
        /** Signed key authorization for the access key. */
        authorization: KeyAuthorization.Signed;
        /** Reactive state store. */
        store: ManagerOptions;
    };
}
/** Removes an access key record. */
export declare function remove(options: remove.Options): void;
export declare namespace remove {
    /** Options for {@link remove}. */
    type Options = Key & {
        /** Reactive state store. */
        store: ManagerOptions;
    };
}
/** Returns whether an error means an access key is already unavailable on-chain. */
export declare function isUnavailableError(error: unknown): boolean;
export {};
//# sourceMappingURL=AccessKey.d.ts.map