name	multisig
description	Build and integrate with the Mesh Multisig (Cardano multisig wallet) codebase. Use when working on multisig wallets, bot API, v1 REST endpoints, wallet flows, governance, or Cardano treasury tooling.

Multisig (Mesh)

Project overview

Stack: Next.js (Pages Router), tRPC, Prisma, Cardano (Mesh SDK).
Auth: NextAuth (user) + JWT for API (wallet sign-in or bot keys).
API: REST v1 under /api/v1/* (Swagger at /api-docs, spec at /api/swagger).

Key areas

Area	Location	Notes
Landing page	`src/components/pages/homepage/index.tsx`	Hero, features, DApps, Developers & Bots section
API docs (Swagger)	`src/pages/api-docs.tsx`, `src/utils/swagger.ts`	OpenAPI 3.0; add new paths in `swagger.ts`
Bot API	`src/pages/api/v1/botAuth.ts`, `src/lib/auth/botKey.ts`, `src/lib/auth/botAccess.ts`	Bot auth: POST `/api/v1/botAuth` with `botKeyId`, `secret`, `paymentAddress`
Reference bot client	`scripts/bot-ref/`	`bot-client.ts`; auth → walletIds, pendingTransactions, freeUtxos
Wallet flows	`src/components/pages/homepage/wallets/new-wallet-flow/`, `useWalletFlowState.tsx`	New wallet creation and invite flow
tRPC	`src/server/api/routers/`, `src/server/api/root.ts`	Wallets, bot routers
DB	`prisma/schema.prisma`	Wallet, BotKey, BotUser, etc.

Bot integration (machine-friendly)

OpenAPI spec (JSON): GET /api/swagger — use for codegen or automation.
Auth (bots): POST /api/v1/botAuth
Body: { "botKeyId": string, "secret": string, "paymentAddress": string, "stakeAddress"?: string }
Response: { "token": string, "botId": string }. Use Authorization: Bearer <token> for v1 endpoints.
Bot keys: Created in-app (User → Create bot). One bot key can have one paymentAddress; same address cannot be used by another bot.
Scopes: Bot keys have scope (e.g. multisig:read); botAccess.ts enforces wallet access for bots.
V1 endpoints used by bots: walletIds (query address = bot’s paymentAddress), pendingTransactions, freeUtxos, addTransaction, signTransaction, etc. Same as wallet-authenticated calls but identity is the bot’s registered address.

Conventions

Wallet ID: UUID from DB; address: Cardano payment (or stake) address.
Scripts: Reference scripts in scripts/ (e.g. scripts/bot-ref/). Use npx tsx for TS scripts.
Env: JWT_SECRET required for API tokens; bot keys stored hashed in DB.

When editing

Adding a new v1 endpoint: implement in src/pages/api/v1/<name>.ts, add path and CORS/rate limits, then add to src/utils/swagger.ts and document bot usage if applicable.
Changing bot auth or scopes: update botAuth.ts, botAccess.ts, and landing “Developers & Bots” section plus scripts/bot-ref/README.md if needed.
Landing page: human and bot-friendly docs live in the “Developers & Bots” section; keep OpenAPI URL and bot auth summary accurate.

Multisig (Mesh)

Project overview

Stack: Next.js (Pages Router), tRPC, Prisma, Cardano (Mesh SDK).

Auth: NextAuth (user) + JWT for API (wallet sign-in or bot keys).

API: REST v1 under /api/v1/* (Swagger at /api-docs, spec at /api/swagger).

Key areas

Area

Location

Notes

Landing page

src/components/pages/homepage/index.tsx

Hero, features, DApps, Developers & Bots section

API docs (Swagger)

src/pages/api-docs.tsx, src/utils/swagger.ts

OpenAPI 3.0; add new paths in swagger.ts

Bot API

src/pages/api/v1/botAuth.ts, src/lib/auth/botKey.ts, src/lib/auth/botAccess.ts

Bot auth: POST /api/v1/botAuth with botKeyId, secret, paymentAddress

Reference bot client

scripts/bot-ref/

bot-client.ts; auth → walletIds, pendingTransactions, freeUtxos

Wallet flows

src/components/pages/homepage/wallets/new-wallet-flow/, useWalletFlowState.tsx

New wallet creation and invite flow

tRPC

src/server/api/routers/, src/server/api/root.ts

Wallets, bot routers

prisma/schema.prisma

Wallet, BotKey, BotUser, etc.

Bot integration (machine-friendly)

OpenAPI spec (JSON): GET /api/swagger — use for codegen or automation.

Auth (bots): POST /api/v1/botAuth
Body: { "botKeyId": string, "secret": string, "paymentAddress": string, "stakeAddress"?: string }
Response: { "token": string, "botId": string }. Use Authorization: Bearer <token> for v1 endpoints.

Bot keys: Created in-app (User → Create bot). One bot key can have one paymentAddress; same address cannot be used by another bot.

Scopes: Bot keys have scope (e.g. multisig:read); botAccess.ts enforces wallet access for bots.

V1 endpoints used by bots: walletIds (query address = bot’s paymentAddress), pendingTransactions, freeUtxos, addTransaction, signTransaction, etc. Same as wallet-authenticated calls but identity is the bot’s registered address.

Conventions

Wallet ID: UUID from DB; address: Cardano payment (or stake) address.

Scripts: Reference scripts in scripts/ (e.g. scripts/bot-ref/). Use npx tsx for TS scripts.

Env: JWT_SECRET required for API tokens; bot keys stored hashed in DB.

When editing

Adding a new v1 endpoint: implement in src/pages/api/v1/<name>.ts, add path and CORS/rate limits, then add to src/utils/swagger.ts and document bot usage if applicable.

Changing bot auth or scopes: update botAuth.ts, botAccess.ts, and landing “Developers & Bots” section plus scripts/bot-ref/README.md if needed.

Landing page: human and bot-friendly docs live in the “Developers & Bots” section; keep OpenAPI URL and bot auth summary accurate.