@rhinestone/sdk 2.0.0-beta.43 → 2.0.0-beta.45

package/dist/src/signing/intent-plans/assemble.js

@@ -0,0 +1,96 @@
+import { encodePlannedValidatorContribution } from '../contribution.js';
+import { runSigningStep } from '../error.js';
+import { wrapErc7739TypedDataSignature } from '../protocols/erc7739.js';
+export function assembleIntentStage(input, context) {
+    const outputs = {};
+    for (const artifact of input.stagePlan.artifacts) {
+        if (artifact.input.kind === 'session-claim-pair')
+            continue;
+        outputs[artifact.id] =
+            artifact.input.kind === 'reuse-artifact'
+                ? resolveReusedArtifact(artifact.id, artifact.input, input.priorOutputs)
+                : assembleSignedArtifact(input, artifact, context);
+    }
+    for (const artifact of input.stagePlan.artifacts) {
+        if (artifact.input.kind !== 'session-claim-pair')
+            continue;
+        const preClaimSig = outputs[artifact.input.preClaimArtifactId];
+        const notarizedClaimSig = outputs[artifact.input.notarizedClaimArtifactId];
+        if (typeof preClaimSig !== 'string' ||
+            typeof notarizedClaimSig !== 'string') {
+            throw new Error(`Session claim pair ${artifact.id} is incomplete`);
+        }
+        outputs[artifact.id] = { preClaimSig, notarizedClaimSig };
+    }
+    return outputs;
+}
+export function assembleIntentValidatorArtifact(input) {
+    if (input.artifact.erc6492.kind !== 'none') {
+        throw new Error('ERC-6492 is forbidden for intent signatures');
+    }
+    const step = (failureStage, operation) => input.diagnostics
+        ? runSigningStep({
+            plan: input.diagnostics.plan,
+            failureStage,
+            stageId: input.diagnostics.stageId,
+            artifactId: input.artifact.id,
+            usage: input.artifact.usage,
+            operation,
+        })
+        : operation();
+    let contribution = input.validatorContribution;
+    const erc7739 = input.artifact.erc7739;
+    if (erc7739.kind === 'wrap-typed-data') {
+        contribution = step('protocol-operation', () => wrapErc7739TypedDataSignature({
+            typedData: erc7739.typedData,
+            signature: contribution,
+        }));
+    }
+    return input.artifact.accountEnvelope.kind === 'none'
+        ? contribution
+        : step('account-envelope', () => input.context.accountAdapter.encodeSignatureEnvelope({
+            account: input.context.account,
+            envelope: input.artifact.accountEnvelope,
+            validatorContribution: contribution,
+            purpose: 'intent',
+        }));
+}
+function assembleSignedArtifact(input, artifact, context) {
+    if (artifact.validatorCodec.kind === 'none') {
+        if (artifact.input.kind !== 'task-results' ||
+            artifact.input.taskIds.length !== 1) {
+            throw new Error(`Direct artifact ${artifact.id} requires one task`);
+        }
+        const result = input.results[artifact.input.taskIds[0]];
+        if (result?.kind !== 'ecdsa-signature') {
+            throw new Error(`Direct artifact ${artifact.id} requires an ECDSA result`);
+        }
+        return result.signature;
+    }
+    return assembleIntentValidatorArtifact({
+        artifact,
+        context,
+        validatorContribution: runSigningStep({
+            plan: input.plan,
+            failureStage: 'validator-encode',
+            stageId: input.stage.stageId,
+            artifactId: artifact.id,
+            usage: artifact.usage,
+            operation: () => encodePlannedValidatorContribution({
+                artifact,
+                stage: input.stage,
+                results: input.results,
+            }),
+        }),
+        diagnostics: { plan: input.plan, stageId: input.stage.stageId },
+    });
+}
+function resolveReusedArtifact(artifactId, route, priorOutputs) {
+    const source = priorOutputs[`${route.stageId}:${route.artifactId}`];
+    if (typeof source === 'string')
+        return source;
+    if (source && route.selection === 'pre-claim' && 'preClaimSig' in source) {
+        return source.preClaimSig;
+    }
+    throw new Error(`Reused artifact ${route.artifactId} is unavailable for ${artifactId}`);
+}

package/dist/src/signing/intent-plans/independent.d.ts

@@ -0,0 +1,48 @@
+import type { Account, Address, Hex } from 'viem';
+import type { WebAuthnAccount } from 'viem/account-abstraction';
+import type { SigningContext } from '../context.js';
+import type { ArtifactAssemblyPlan } from '../types.js';
+export interface IndependentOwnerDescriptor {
+    readonly ownerId: string;
+    readonly identity: Address | Hex;
+    readonly kind: 'ecdsa' | 'webauthn';
+    readonly factorId?: string;
+    readonly factorPublicId?: number | Hex;
+}
+export type IndependentOwnerSignatureData = {
+    readonly kind: 'ecdsa';
+    readonly signer: Address;
+    readonly origin: readonly Hex[];
+} | {
+    readonly kind: 'passkey';
+    readonly publicKey: Hex;
+    readonly origin: readonly {
+        readonly webauthn: {
+            readonly authenticatorData: Hex;
+            readonly challengeIndex?: number;
+            readonly clientDataJSON: string;
+            readonly typeIndex?: number;
+            readonly userVerificationRequired?: boolean;
+        };
+        readonly signature: Hex;
+    }[];
+};
+export type IndependentOwnerSignature = ({
+    readonly intentId: string;
+} & IndependentOwnerSignatureData) | {
+    readonly intentId: string;
+    readonly kind: 'multi-factor';
+    readonly validatorId: number | Hex;
+    readonly signature: IndependentOwnerSignatureData;
+};
+export declare function assembleIndependentIntentArtifact(input: {
+    readonly intentId: string;
+    readonly originIndex: number;
+    readonly originCount: number;
+    readonly signatures: readonly IndependentOwnerSignature[];
+    readonly owners: readonly IndependentOwnerDescriptor[];
+    readonly artifact: ArtifactAssemblyPlan;
+    readonly context: SigningContext;
+}): Hex;
+export type IndependentSigner = Account | WebAuthnAccount;
+//# sourceMappingURL=independent.d.ts.map

package/dist/src/signing/intent-plans/independent.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"independent.d.ts","sourceRoot":"","sources":["../../../../signing/intent-plans/independent.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,MAAM,CAAA;AACjD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAA;AAY/D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAChD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAA;AAGpD,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,QAAQ,EAAE,OAAO,GAAG,GAAG,CAAA;IAChC,QAAQ,CAAC,IAAI,EAAE,OAAO,GAAG,UAAU,CAAA;IACnC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,GAAG,CAAA;CACvC;AAED,MAAM,MAAM,6BAA6B,GACrC;IACE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAA;IACxB,QAAQ,CAAC,MAAM,EAAE,SAAS,GAAG,EAAE,CAAA;CAChC,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;IACxB,QAAQ,CAAC,SAAS,EAAE,GAAG,CAAA;IACvB,QAAQ,CAAC,MAAM,EAAE,SAAS;QACxB,QAAQ,CAAC,QAAQ,EAAE;YACjB,QAAQ,CAAC,iBAAiB,EAAE,GAAG,CAAA;YAC/B,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;YAChC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;YAC/B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;YAC3B,QAAQ,CAAC,wBAAwB,CAAC,EAAE,OAAO,CAAA;SAC5C,CAAA;QACD,QAAQ,CAAC,SAAS,EAAE,GAAG,CAAA;KACxB,EAAE,CAAA;CACJ,CAAA;AAEL,MAAM,MAAM,yBAAyB,GACjC,CAAC;IAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG,6BAA6B,CAAC,GAC/D;IACE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAA;IAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,GAAG,CAAA;IAClC,QAAQ,CAAC,SAAS,EAAE,6BAA6B,CAAA;CAClD,CAAA;AAEL,wBAAgB,iCAAiC,CAAC,KAAK,EAAE;IACvD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,UAAU,EAAE,SAAS,yBAAyB,EAAE,CAAA;IACzD,QAAQ,CAAC,MAAM,EAAE,SAAS,0BAA0B,EAAE,CAAA;IACtD,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,CAAA;IACvC,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAA;CACjC,GAAG,GAAG,CA2BN;AAoLD,MAAM,MAAM,iBAAiB,GAAG,OAAO,GAAG,eAAe,CAAA"}

package/dist/src/signing/intent-plans/independent.js

@@ -0,0 +1,150 @@
+import { InsufficientOwnerSignaturesError, MismatchedOwnerSignaturesError, UnknownOwnerError, } from '../../errors/execution.js';
+import { encodeValidatorContribution } from '../../modules/validators/contribution.js';
+import { encodeValidatorId } from '../../modules/validators/multi-factor.js';
+import { assembleIntentValidatorArtifact } from './assemble.js';
+export function assembleIndependentIntentArtifact(input) {
+    if (input.artifact.validatorCodec.kind === 'none') {
+        throw new Error('Independent signing requires a validator codec');
+    }
+    if (input.artifact.validatorCodec.kind === 'smart-session-state') {
+        throw new Error('Smart Session state cannot be signed independently');
+    }
+    const contributions = importOwnerContributions(input);
+    const codec = input.artifact.validatorCodec;
+    if (codec.kind === 'smart-session') {
+        throw new Error('Smart Session state cannot be signed independently');
+    }
+    const validatorContribution = input.artifact.validatorFactors
+        ? encodeIndependentFactors(codec, input.artifact.validatorFactors, contributions)
+        : encodeAtomicContributions(codec, contributions.map(({ contribution }) => contribution));
+    return assembleIntentValidatorArtifact({
+        artifact: input.artifact,
+        context: input.context,
+        validatorContribution,
+    });
+}
+function importOwnerContributions(input) {
+    const seen = new Set();
+    return input.signatures.map((value) => {
+        if (value.intentId !== input.intentId) {
+            throw new MismatchedOwnerSignaturesError({
+                context: { intentIds: [input.intentId, value.intentId] },
+            });
+        }
+        const signature = value.kind === 'multi-factor' ? value.signature : value;
+        if (signature.origin.length !== input.originCount) {
+            throw new MismatchedOwnerSignaturesError({
+                context: { expectedOriginCount: input.originCount },
+            });
+        }
+        const identity = signature.kind === 'ecdsa'
+            ? signature.signer.toLowerCase()
+            : signature.publicKey.toLowerCase();
+        const owner = input.owners.find((candidate) => candidate.identity.toLowerCase() === identity &&
+            (value.kind === 'multi-factor'
+                ? candidate.factorPublicId !== undefined &&
+                    sameValidatorId(candidate.factorPublicId, value.validatorId)
+                : candidate.factorId === undefined));
+        if (!owner) {
+            const matchingIdentity = input.owners.filter((candidate) => candidate.identity.toLowerCase() === identity);
+            if (matchingIdentity.length > 0 &&
+                (value.kind === 'multi-factor' ||
+                    matchingIdentity.some(({ factorId }) => factorId !== undefined))) {
+                throw new MismatchedOwnerSignaturesError({
+                    context: value.kind === 'multi-factor'
+                        ? { validatorId: value.validatorId }
+                        : { expectedKind: 'multi-factor' },
+                });
+            }
+            throw new UnknownOwnerError({
+                context: signature.kind === 'passkey'
+                    ? { publicKey: signature.publicKey }
+                    : { signer: signature.signer },
+            });
+        }
+        const contributionKey = `${owner.factorId ?? 'root'}:${identity}`;
+        if (seen.has(contributionKey))
+            throw new MismatchedOwnerSignaturesError({
+                context: { duplicateOwner: identity },
+            });
+        seen.add(contributionKey);
+        if ((signature.kind === 'ecdsa' && owner.kind !== 'ecdsa') ||
+            (signature.kind === 'passkey' && owner.kind !== 'webauthn')) {
+            throw new MismatchedOwnerSignaturesError({
+                context: { owner: identity },
+            });
+        }
+        const contribution = signature.kind === 'ecdsa'
+            ? {
+                kind: 'ecdsa',
+                ownerId: owner.ownerId,
+                signature: signature.origin[input.originIndex],
+                encoding: 'validator-contribution',
+            }
+            : {
+                kind: 'webauthn',
+                ownerId: owner.ownerId,
+                publicKey: signature.publicKey,
+                signature: signature.origin[input.originIndex].signature,
+                authenticatorData: signature.origin[input.originIndex].webauthn.authenticatorData,
+                clientDataJSON: signature.origin[input.originIndex].webauthn.clientDataJSON,
+                challengeIndex: signature.origin[input.originIndex].webauthn.challengeIndex ?? 0,
+                typeIndex: signature.origin[input.originIndex].webauthn.typeIndex ?? 0,
+                userVerificationRequired: signature.origin[input.originIndex].webauthn
+                    .userVerificationRequired ?? false,
+            };
+        return {
+            ...(owner.factorId ? { factorId: owner.factorId } : {}),
+            contribution,
+        };
+    });
+}
+function sameValidatorId(left, right) {
+    try {
+        return (encodeValidatorId(left).toLowerCase() ===
+            encodeValidatorId(right).toLowerCase());
+    }
+    catch {
+        return false;
+    }
+}
+function encodeIndependentFactors(codec, factors, contributions) {
+    const factorContributions = factors.flatMap((factor) => {
+        const selected = contributions.flatMap((entry) => entry.factorId === factor.id ? [entry.contribution] : []);
+        if (selected.length === 0)
+            return [];
+        if (selected.length < factor.codec.threshold) {
+            throw new InsufficientOwnerSignaturesError({
+                required: factor.codec.threshold,
+                provided: selected.length,
+                validatorId: factor.publicId,
+            });
+        }
+        return [
+            {
+                kind: 'factor',
+                factorId: factor.id,
+                publicId: factor.publicId,
+                validator: factor.validator,
+                contribution: encodeValidatorContribution(factor.codec, selected),
+            },
+        ];
+    });
+    if (factorContributions.length < codec.threshold) {
+        throw new InsufficientOwnerSignaturesError({
+            required: codec.threshold,
+            provided: factorContributions.length,
+        });
+    }
+    return encodeValidatorContribution(codec, factorContributions);
+}
+function encodeAtomicContributions(codec, contributions) {
+    if (codec.kind === 'ordered-threshold' &&
+        contributions.length < codec.threshold) {
+        throw new InsufficientOwnerSignaturesError({
+            required: codec.threshold,
+            provided: contributions.length,
+        });
+    }
+    return encodeValidatorContribution(codec, contributions);
+}

package/dist/src/signing/intent-plans/plan.d.ts

@@ -0,0 +1,14 @@
+import type { SigningContext } from '../context.js';
+import type { SigningCheckpointPort, SigningPlan, SigningTranscript } from '../types.js';
+import type { IndependentSigningProjection, IntentSigningPlanCreationInput } from './types.js';
+export declare function createIntentSigningPlan(input: IntentSigningPlanCreationInput): SigningPlan;
+export declare function projectIndependentSigning(plan: SigningPlan, signerIds: readonly string[], ownerIds?: readonly string[]): {
+    readonly plan: SigningPlan;
+    readonly projection: IndependentSigningProjection;
+};
+export declare function executeIntentSigning(input: {
+    readonly planInput: IntentSigningPlanCreationInput;
+    readonly context: SigningContext;
+    readonly checkpoints: SigningCheckpointPort;
+}): Promise<SigningTranscript>;
+//# sourceMappingURL=plan.d.ts.map

package/dist/src/signing/intent-plans/plan.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plan.d.ts","sourceRoot":"","sources":["../../../../signing/intent-plans/plan.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAEhD,OAAO,KAAK,EACV,qBAAqB,EACrB,WAAW,EACX,iBAAiB,EAClB,MAAM,UAAU,CAAA;AAEjB,OAAO,KAAK,EACV,4BAA4B,EAC5B,8BAA8B,EAC/B,MAAM,SAAS,CAAA;AAEhB,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,8BAA8B,GACpC,WAAW,CAoEb;AAED,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,WAAW,EACjB,SAAS,EAAE,SAAS,MAAM,EAAE,EAC5B,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,GAC3B;IACD,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;IAC1B,QAAQ,CAAC,UAAU,EAAE,4BAA4B,CAAA;CAClD,CA8DA;AAoFD,wBAAsB,oBAAoB,CAAC,KAAK,EAAE;IAChD,QAAQ,CAAC,SAAS,EAAE,8BAA8B,CAAA;IAClD,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAA;IAChC,QAAQ,CAAC,WAAW,EAAE,qBAAqB,CAAA;CAC5C,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAS7B"}

package/dist/src/signing/intent-plans/plan.js

@@ -0,0 +1,187 @@
+import { executeSigningPlan } from '../execute.js';
+import { assembleIntentStage } from './assemble.js';
+export function createIntentSigningPlan(input) {
+    const targetArtifact = input.intent.target
+        ? requireSingleArtifact(input.intent.artifacts.filter(({ usage, payloadId }) => usage === 'intent-target' && payloadId === input.intent.target?.id), 'target')
+        : undefined;
+    const plan = {
+        version: 1,
+        kind: 'intent-full',
+        payload: { kind: 'intent', id: input.intent.id },
+        configuredTopology: input.intent.configuredTopology,
+        effectiveSelection: input.intent.effectiveSelection,
+        preparedIntent: {
+            signatureMode: input.intent.preparedSignatureMode,
+            artifacts: input.intent.artifacts.map(({ id, usage, payloadId, cardinality, shape }) => ({
+                id,
+                usage,
+                payloadId,
+                cardinality,
+                shape,
+            })),
+            ...(input.intent.destination
+                ? {
+                    destination: input.intent.destination.mode === 'sign'
+                        ? {
+                            mode: 'sign',
+                            artifactId: input.intent.destination.artifactId,
+                            payloadId: input.intent.destination.payload.id,
+                        }
+                        : input.intent.destination,
+                }
+                : {}),
+            ...(targetArtifact
+                ? {
+                    target: {
+                        artifactId: targetArtifact.id,
+                        payloadId: targetArtifact.payloadId,
+                    },
+                }
+                : {}),
+        },
+        stages: input.stages.map((stage) => ({
+            id: stage.id,
+            checkpoint: stage.checkpoint,
+            priorOutputs: stage.priorOutputs,
+            taskTemplates: stage.tasks,
+            schedule: stage.schedule,
+            artifacts: stage.artifacts.map((artifact) => ({
+                ...artifact,
+                stageId: stage.id,
+            })),
+        })),
+        publicOutputs: input.intent.artifacts.map((artifact) => ({
+            id: artifact.id,
+            source: { kind: 'artifact', artifactId: artifact.id },
+            exposedForIndependentSigning: artifact.exposedForIndependentSigning,
+        })),
+    };
+    assertPreparedMode(input);
+    assertIntentRoutes(input, plan);
+    return plan;
+}
+export function projectIndependentSigning(plan, signerIds, ownerIds) {
+    if (plan.kind !== 'intent-full') {
+        throw new Error('Independent signing requires a full intent plan');
+    }
+    const selected = new Set(signerIds);
+    const selectedOwners = ownerIds ? new Set(ownerIds) : undefined;
+    if (selected.size !== signerIds.length) {
+        throw new Error('Independent signer selection contains duplicates');
+    }
+    for (const signerId of selected) {
+        if (!plan.effectiveSelection.signerIds.includes(signerId)) {
+            throw new Error(`Independent signer ${signerId} is not in the plan`);
+        }
+    }
+    const stages = plan.stages.map((stage) => {
+        const taskTemplates = stage.taskTemplates.filter((task) => selected.has(task.signer.id) &&
+            (!selectedOwners ||
+                [...selectedOwners].some((ownerId) => task.id.includes(ownerId))));
+        const taskIds = new Set(taskTemplates.map(({ id }) => id));
+        return {
+            ...stage,
+            priorOutputs: [],
+            taskTemplates,
+            schedule: stage.schedule
+                .map((batch) => ({
+                ...batch,
+                taskIds: batch.taskIds.filter((taskId) => taskIds.has(taskId)),
+            }))
+                .filter(({ taskIds: ids }) => ids.length > 0),
+            artifacts: [],
+        };
+    });
+    const projected = {
+        ...plan,
+        kind: 'intent-independent',
+        effectiveSelection: {
+            ...plan.effectiveSelection,
+            signerIds: plan.effectiveSelection.signerIds.filter((id) => selected.has(id)),
+        },
+        stages,
+        publicOutputs: stages.flatMap((stage) => stage.taskTemplates.map((task) => ({
+            id: `${task.id}-contribution`,
+            source: { kind: 'task-result', taskId: task.id },
+            exposedForIndependentSigning: true,
+        }))),
+    };
+    return {
+        plan: projected,
+        projection: {
+            planKind: 'intent-independent',
+            sourceIntentId: plan.payload.id,
+            exposedArtifactIds: projected.publicOutputs.map(({ id }) => id),
+            selectedSignerIds: [...signerIds],
+        },
+    };
+}
+function assertIntentRoutes(input, plan) {
+    const artifacts = plan.stages.flatMap((stage) => stage.artifacts);
+    const requirements = new Map(input.intent.artifacts.map((artifact) => [artifact.id, artifact]));
+    if (requirements.size !== input.intent.artifacts.length) {
+        throw new Error('Intent artifact requirements contain duplicate ids');
+    }
+    for (const requirement of input.intent.artifacts) {
+        if (!artifacts.some(({ id }) => id === requirement.id)) {
+            throw new Error(`Intent artifact ${requirement.id} has no assembly route`);
+        }
+    }
+    const destination = input.intent.destination;
+    if (!destination)
+        return;
+    const requirement = requirements.get(destination.artifactId);
+    if (!requirement || requirement.usage !== 'intent-destination') {
+        throw new Error('Intent destination artifact requirement is missing');
+    }
+    const route = artifacts.find(({ id }) => id === destination.artifactId);
+    if (!route)
+        throw new Error('Intent destination assembly route is missing');
+    if (destination.mode === 'sign') {
+        if (requirement.payloadId !== destination.payload.id ||
+            route.input.kind !== 'task-results') {
+            throw new Error('Intent destination signing route is incompatible');
+        }
+        return;
+    }
+    if (route.input.kind !== 'reuse-artifact' ||
+        route.input.artifactId !== destination.originArtifactId ||
+        route.input.selection !== destination.selection) {
+        throw new Error('Intent destination reuse route is incompatible');
+    }
+}
+function requireSingleArtifact(artifacts, role) {
+    if (artifacts.length !== 1) {
+        throw new Error(`Intent ${role} requires exactly one artifact`);
+    }
+    return artifacts[0];
+}
+function assertPreparedMode(input) {
+    const originArtifacts = input.intent.artifacts.filter(({ usage }) => usage === 'intent-origin' ||
+        usage === 'intent-pre-claim' ||
+        usage === 'intent-notarized-claim');
+    const expectedPerOrigin = 1;
+    const expected = input.intent.origins.length * expectedPerOrigin;
+    if (originArtifacts.length !== expected) {
+        throw new Error(`Prepared signature mode requires ${expected} origin artifacts, received ${originArtifacts.length}`);
+    }
+    const invalidShape = originArtifacts.some(({ shape }) => input.intent.preparedSignatureMode === 'default'
+        ? shape !== 'hex'
+        : !['hex', 'session-claims'].includes(shape));
+    if (invalidShape) {
+        const expectedShape = input.intent.preparedSignatureMode === 'default'
+            ? 'hex'
+            : 'hex or session-claims';
+        throw new Error(`Prepared signature mode requires ${expectedShape} origin artifacts`);
+    }
+}
+export async function executeIntentSigning(input) {
+    const plan = createIntentSigningPlan(input.planInput);
+    return executeSigningPlan({
+        plan,
+        payloads: input.planInput.payloads,
+        signerInvoker: input.context.signerInvoker,
+        checkpoints: input.checkpoints,
+        assembleStage: (stage) => assembleIntentStage(stage, input.context),
+    });
+}

package/dist/src/signing/intent-plans/types.d.ts

@@ -0,0 +1,63 @@
+import type { Hex, TypedDataDefinition } from 'viem';
+import type { EvmChainReference } from '../../chains/types.js';
+import type { ArtifactAssemblyPlan, ConfiguredValidatorTopology, EffectiveSignerSelection, SignatureUsage, SigningBatch, SigningPayloadRegistry, SigningReadCheckpoint, SigningTaskTemplate } from '../types.js';
+export type PreparedIntentSignatureMode = 'default' | 'session' | 'session-with-execution-verification';
+export interface IntentSigningPayload {
+    readonly id: Hex;
+    readonly chain: EvmChainReference;
+    readonly role: 'origin' | 'destination' | 'target';
+    readonly typedData: TypedDataDefinition;
+    readonly usage: SignatureUsage;
+}
+export type DestinationSigningRequirement = {
+    readonly mode: 'sign';
+    readonly payload: IntentSigningPayload;
+    readonly artifactId: string;
+} | {
+    readonly mode: 'reuse-origin';
+    readonly artifactId: string;
+    readonly originArtifactId: string;
+    readonly selection: 'whole' | 'pre-claim';
+};
+export interface IntentArtifactRequirement {
+    readonly id: string;
+    readonly usage: SignatureUsage;
+    readonly payloadId: Hex;
+    readonly cardinality: 'one' | 'per-origin';
+    readonly shape: 'hex' | 'session-claims';
+    readonly exposedForIndependentSigning: boolean;
+}
+export interface IntentSigningInput {
+    readonly id: Hex;
+    readonly preparedSignatureMode: PreparedIntentSignatureMode;
+    readonly configuredTopology: ConfiguredValidatorTopology;
+    readonly effectiveSelection: EffectiveSignerSelection;
+    readonly origins: readonly IntentSigningPayload[];
+    readonly destination?: DestinationSigningRequirement;
+    readonly target?: IntentSigningPayload;
+    readonly artifacts: readonly IntentArtifactRequirement[];
+}
+export interface IndependentSigningProjection {
+    readonly planKind: 'intent-independent';
+    readonly sourceIntentId: Hex;
+    readonly exposedArtifactIds: readonly string[];
+    readonly selectedSignerIds: readonly string[];
+}
+export interface IntentSigningStageInput {
+    readonly id: string;
+    readonly checkpoint: SigningReadCheckpoint;
+    readonly priorOutputs: readonly {
+        readonly stageId: string;
+        readonly outputId: string;
+        readonly selection: 'whole' | 'pre-claim';
+    }[];
+    readonly tasks: readonly SigningTaskTemplate[];
+    readonly schedule: readonly SigningBatch[];
+    readonly artifacts: readonly Omit<ArtifactAssemblyPlan, 'stageId'>[];
+}
+export interface IntentSigningPlanCreationInput {
+    readonly intent: IntentSigningInput;
+    readonly stages: readonly IntentSigningStageInput[];
+    readonly payloads: SigningPayloadRegistry;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/src/signing/intent-plans/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../signing/intent-plans/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,GAAG,EAAE,mBAAmB,EAAE,MAAM,MAAM,CAAA;AACpD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAA;AAC3D,OAAO,KAAK,EACV,oBAAoB,EACpB,2BAA2B,EAC3B,wBAAwB,EACxB,cAAc,EACd,YAAY,EACZ,sBAAsB,EACtB,qBAAqB,EACrB,mBAAmB,EACpB,MAAM,UAAU,CAAA;AAEjB,MAAM,MAAM,2BAA2B,GACnC,SAAS,GACT,SAAS,GACT,qCAAqC,CAAA;AAEzC,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAA;IAChB,QAAQ,CAAC,KAAK,EAAE,iBAAiB,CAAA;IACjC,QAAQ,CAAC,IAAI,EAAE,QAAQ,GAAG,aAAa,GAAG,QAAQ,CAAA;IAClD,QAAQ,CAAC,SAAS,EAAE,mBAAmB,CAAA;IACvC,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAA;CAC/B;AAED,MAAM,MAAM,6BAA6B,GACrC;IACE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,OAAO,EAAE,oBAAoB,CAAA;IACtC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAC5B,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAA;IAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;IACjC,QAAQ,CAAC,SAAS,EAAE,OAAO,GAAG,WAAW,CAAA;CAC1C,CAAA;AAEL,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAA;IAC9B,QAAQ,CAAC,SAAS,EAAE,GAAG,CAAA;IACvB,QAAQ,CAAC,WAAW,EAAE,KAAK,GAAG,YAAY,CAAA;IAC1C,QAAQ,CAAC,KAAK,EAAE,KAAK,GAAG,gBAAgB,CAAA;IACxC,QAAQ,CAAC,4BAA4B,EAAE,OAAO,CAAA;CAC/C;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAA;IAChB,QAAQ,CAAC,qBAAqB,EAAE,2BAA2B,CAAA;IAC3D,QAAQ,CAAC,kBAAkB,EAAE,2BAA2B,CAAA;IACxD,QAAQ,CAAC,kBAAkB,EAAE,wBAAwB,CAAA;IACrD,QAAQ,CAAC,OAAO,EAAE,SAAS,oBAAoB,EAAE,CAAA;IACjD,QAAQ,CAAC,WAAW,CAAC,EAAE,6BAA6B,CAAA;IACpD,QAAQ,CAAC,MAAM,CAAC,EAAE,oBAAoB,CAAA;IACtC,QAAQ,CAAC,SAAS,EAAE,SAAS,yBAAyB,EAAE,CAAA;CACzD;AAED,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,CAAA;IACvC,QAAQ,CAAC,cAAc,EAAE,GAAG,CAAA;IAC5B,QAAQ,CAAC,kBAAkB,EAAE,SAAS,MAAM,EAAE,CAAA;IAC9C,QAAQ,CAAC,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAA;CAC9C;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,UAAU,EAAE,qBAAqB,CAAA;IAC1C,QAAQ,CAAC,YAAY,EAAE,SAAS;QAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;QACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;QACzB,QAAQ,CAAC,SAAS,EAAE,OAAO,GAAG,WAAW,CAAA;KAC1C,EAAE,CAAA;IACH,QAAQ,CAAC,KAAK,EAAE,SAAS,mBAAmB,EAAE,CAAA;IAC9C,QAAQ,CAAC,QAAQ,EAAE,SAAS,YAAY,EAAE,CAAA;IAC1C,QAAQ,CAAC,SAAS,EAAE,SAAS,IAAI,CAAC,oBAAoB,EAAE,SAAS,CAAC,EAAE,CAAA;CACrE;AAED,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAA;IACnC,QAAQ,CAAC,MAAM,EAAE,SAAS,uBAAuB,EAAE,CAAA;IACnD,QAAQ,CAAC,QAAQ,EAAE,sBAAsB,CAAA;CAC1C"}

package/dist/src/signing/intent-plans/types.js

@@ -0,0 +1 @@
+export {};

package/dist/src/signing/message.d.ts

@@ -0,0 +1,28 @@
+import { type Hex, type SignableMessage } from 'viem';
+import type { EvmChainReference } from '../chains/types.js';
+import type { SigningContext } from './context.js';
+import type { ArtifactAssemblyPlan, ConfiguredValidatorTopology, EffectiveSignerSelection, PayloadSigningTask, SigningCheckpointPort, SigningPayloadMaterial, SigningPlan, SigningTranscript } from './types.js';
+export interface MessageSigningPlanInput {
+    readonly message: SignableMessage;
+    readonly signingMaterial?: Extract<SigningPayloadMaterial, {
+        readonly kind: 'message';
+    }>;
+    readonly chain: EvmChainReference;
+    readonly configuredTopology: ConfiguredValidatorTopology;
+    readonly effectiveSelection: EffectiveSignerSelection;
+    readonly tasks: readonly PayloadSigningTask[];
+    readonly route: Omit<ArtifactAssemblyPlan, 'id' | 'stageId' | 'input' | 'usage'>;
+    readonly checkpoint?: Extract<import('./types.js').SigningReadCheckpoint, {
+        readonly kind: 'account-deployment';
+    }>;
+}
+export declare function createMessageSigningPlan(input: MessageSigningPlanInput): SigningPlan;
+export declare function signAccountMessage(input: {
+    readonly planInput: MessageSigningPlanInput;
+    readonly context: SigningContext;
+    readonly checkpoints: SigningCheckpointPort;
+}): Promise<{
+    readonly signature: Hex;
+    readonly transcript: SigningTranscript;
+}>;
+//# sourceMappingURL=message.d.ts.map

package/dist/src/signing/message.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"message.d.ts","sourceRoot":"","sources":["../../../signing/message.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,GAAG,EAAe,KAAK,eAAe,EAAE,MAAM,MAAM,CAAA;AAElE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAA;AACxD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAM/C,OAAO,KAAK,EACV,oBAAoB,EACpB,2BAA2B,EAC3B,wBAAwB,EACxB,kBAAkB,EAClB,qBAAqB,EACrB,sBAAsB,EACtB,WAAW,EACX,iBAAiB,EAClB,MAAM,SAAS,CAAA;AAEhB,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAA;IACjC,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAChC,sBAAsB,EACtB;QAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;KAAE,CAC7B,CAAA;IACD,QAAQ,CAAC,KAAK,EAAE,iBAAiB,CAAA;IACjC,QAAQ,CAAC,kBAAkB,EAAE,2BAA2B,CAAA;IACxD,QAAQ,CAAC,kBAAkB,EAAE,wBAAwB,CAAA;IACrD,QAAQ,CAAC,KAAK,EAAE,SAAS,kBAAkB,EAAE,CAAA;IAC7C,QAAQ,CAAC,KAAK,EAAE,IAAI,CAClB,oBAAoB,EACpB,IAAI,GAAG,SAAS,GAAG,OAAO,GAAG,OAAO,CACrC,CAAA;IACD,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAC3B,OAAO,SAAS,EAAE,qBAAqB,EACvC;QAAE,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAA;KAAE,CACxC,CAAA;CACF;AAED,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,uBAAuB,GAC7B,WAAW,CAkBb;AAED,wBAAsB,kBAAkB,CAAC,KAAK,EAAE;IAC9C,QAAQ,CAAC,SAAS,EAAE,uBAAuB,CAAA;IAC3C,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAA;IAChC,QAAQ,CAAC,WAAW,EAAE,qBAAqB,CAAA;CAC5C,GAAG,OAAO,CAAC;IACV,QAAQ,CAAC,SAAS,EAAE,GAAG,CAAA;IACvB,QAAQ,CAAC,UAAU,EAAE,iBAAiB,CAAA;CACvC,CAAC,CAqBD"}