@rhinestone/sdk 2.0.0-beta.9 → 2.0.0

package/dist/src/modules/validators/webauthn.d.ts

@@ -0,0 +1,54 @@
+import { type Address, type Hex } from 'viem';
+import type { ResolvedModule } from '../types.js';
+import type { AtomicValidatorDefinition } from './types.js';
+export declare const WEBAUTHN_VALIDATOR_ADDRESS: Address;
+export declare const WEBAUTHN_V0_VALIDATOR_ADDRESS: `0x${string}`;
+export declare const WEBAUTHN_MOCK_SIGNATURE: "0x0000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a00000000000000000000000000000000000000000000000000000000000000001b9b86eb98fda3ed4d797d9e690588dfadf17b329a76a47cec935bebf92d7ddc80000000000000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000c00000000000000000000000000000000000000000000000000000000000000120000000000000000000000000000000000000000000000000000000000000001700000000000000000000000000000000000000000000000000000000000000019b2e9410bb6850f9f660a03d609d5a844fb96bcdc87a15139b03ee22c70f469100d2b865a215c3bf786387064effa8fcedcb1d625b5148f8a1236d5e3ff11acf000000000000000000000000000000000000000000000000000000000000002549960de5880e8c687434170f6476605b8fe4aeb9a28632c7995cf3ba831d9763050000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000867b2274797065223a22776562617574686e2e676574222c226368616c6c656e6765223a22396a4546696a75684557724d34534f572d7443684a625545484550343456636a634a2d42716f3166544d38222c226f726967696e223a22687474703a2f2f6c6f63616c686f73743a38303830222c2263726f73734f726967696e223a66616c73657d0000000000000000000000000000000000000000000000000000";
+export interface PublicKey {
+    prefix?: number | undefined;
+    x: bigint;
+    y: bigint;
+}
+export interface WebauthnCredential {
+    pubKey: PublicKey | Hex | Uint8Array;
+    authenticatorId: string;
+}
+export interface WebAuthnSignature {
+    authenticatorData: Hex;
+    clientDataJSON: string;
+    challengeIndex: bigint;
+    typeIndex: bigint;
+    r: bigint;
+    s: bigint;
+}
+export declare function parseWebauthnPublicKey(publicKey: Hex | Uint8Array): PublicKey;
+export declare function parseWebauthnSignature(signature: Hex | Uint8Array): {
+    readonly r: bigint;
+    readonly s: bigint;
+};
+export declare function generateWebauthnCredentialId(pubKeyX: bigint, pubKeyY: bigint, account: Address): Hex;
+export declare function encodeWebauthnSignatures(credentialIds: readonly Hex[], usePrecompile: boolean, signatures: readonly WebAuthnSignature[]): Hex;
+export declare function encodeWebauthnSignatureV0(signature: Omit<WebAuthnSignature, 'challengeIndex'>, usePrecompile: boolean): Hex;
+export declare function encodeWebauthnValidatorContribution(input: {
+    readonly ownerOrder: readonly string[];
+    readonly threshold: number;
+    readonly account: Address;
+    readonly usePrecompile: boolean;
+    readonly format: 'current' | 'v0';
+    readonly contributions: readonly {
+        readonly ownerId: string;
+        readonly publicKey: Hex;
+        readonly signature: Hex;
+        readonly authenticatorData: Hex;
+        readonly clientDataJSON: string;
+        readonly challengeIndex: number;
+        readonly typeIndex: number;
+    }[];
+}): Hex;
+export declare function resolveWebauthnCredentials(input: {
+    readonly credentials: readonly WebauthnCredential[];
+    readonly threshold: number;
+    readonly address?: `0x${string}`;
+}): ResolvedModule;
+export declare function resolveWebauthnValidator(definition: AtomicValidatorDefinition): ResolvedModule;
+//# sourceMappingURL=webauthn.d.ts.map

package/dist/src/modules/validators/webauthn.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webauthn.d.ts","sourceRoot":"","sources":["../../../../modules/validators/webauthn.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,OAAO,EAGZ,KAAK,GAAG,EAGT,MAAM,MAAM,CAAA;AACb,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,UAAU,CAAA;AAC9C,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,SAAS,CAAA;AAExD,eAAO,MAAM,0BAA0B,EAAE,OACK,CAAA;AAC9C,eAAO,MAAM,6BAA6B,eAA6B,CAAA;AAEvE,eAAO,MAAM,uBAAuB,EAClC,o4CAA64C,CAAA;AAE/4C,MAAM,WAAW,SAAS;IACxB,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAC3B,CAAC,EAAE,MAAM,CAAA;IACT,CAAC,EAAE,MAAM,CAAA;CACV;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,SAAS,GAAG,GAAG,GAAG,UAAU,CAAA;IACpC,eAAe,EAAE,MAAM,CAAA;CACxB;AAED,MAAM,WAAW,iBAAiB;IAChC,iBAAiB,EAAE,GAAG,CAAA;IACtB,cAAc,EAAE,MAAM,CAAA;IACtB,cAAc,EAAE,MAAM,CAAA;IACtB,SAAS,EAAE,MAAM,CAAA;IACjB,CAAC,EAAE,MAAM,CAAA;IACT,CAAC,EAAE,MAAM,CAAA;CACV;AAED,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,GAAG,GAAG,UAAU,GAAG,SAAS,CAU7E;AAED,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,GAAG,GAAG,UAAU,GAAG;IACnE,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAA;IAClB,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAA;CACnB,CAOA;AAED,wBAAgB,4BAA4B,CAC1C,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,OAAO,GACf,GAAG,CAOL;AAED,wBAAgB,wBAAwB,CACtC,aAAa,EAAE,SAAS,GAAG,EAAE,EAC7B,aAAa,EAAE,OAAO,EACtB,UAAU,EAAE,SAAS,iBAAiB,EAAE,GACvC,GAAG,CA8BL;AAED,wBAAgB,yBAAyB,CACvC,SAAS,EAAE,IAAI,CAAC,iBAAiB,EAAE,gBAAgB,CAAC,EACpD,aAAa,EAAE,OAAO,GACrB,GAAG,CAmBL;AAED,wBAAgB,mCAAmC,CAAC,KAAK,EAAE;IACzD,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAA;IACtC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAA;IAC/B,QAAQ,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CAAA;IACjC,QAAQ,CAAC,aAAa,EAAE,SAAS;QAC/B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;QACxB,QAAQ,CAAC,SAAS,EAAE,GAAG,CAAA;QACvB,QAAQ,CAAC,SAAS,EAAE,GAAG,CAAA;QACvB,QAAQ,CAAC,iBAAiB,EAAE,GAAG,CAAA;QAC/B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;QAC/B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;QAC/B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;KAC3B,EAAE,CAAA;CACJ,GAAG,GAAG,CAgDN;AAED,wBAAgB,0BAA0B,CAAC,KAAK,EAAE;IAChD,QAAQ,CAAC,WAAW,EAAE,SAAS,kBAAkB,EAAE,CAAA;IACnD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,OAAO,CAAC,EAAE,KAAK,MAAM,EAAE,CAAA;CACjC,GAAG,cAAc,CAkCjB;AAED,wBAAgB,wBAAwB,CACtC,UAAU,EAAE,yBAAyB,GACpC,cAAc,CAkBhB"}

package/dist/src/modules/validators/webauthn.js

@@ -0,0 +1,159 @@
+import { bytesToHex, encodeAbiParameters, hexToBytes, keccak256, } from 'viem';
+export const WEBAUTHN_VALIDATOR_ADDRESS = '0x0000000000578c4cb0e472a5462da43c495c3f33';
+export const WEBAUTHN_V0_VALIDATOR_ADDRESS = WEBAUTHN_VALIDATOR_ADDRESS;
+export const WEBAUTHN_MOCK_SIGNATURE = '0x0000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a00000000000000000000000000000000000000000000000000000000000000001b9b86eb98fda3ed4d797d9e690588dfadf17b329a76a47cec935bebf92d7ddc80000000000000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000c00000000000000000000000000000000000000000000000000000000000000120000000000000000000000000000000000000000000000000000000000000001700000000000000000000000000000000000000000000000000000000000000019b2e9410bb6850f9f660a03d609d5a844fb96bcdc87a15139b03ee22c70f469100d2b865a215c3bf786387064effa8fcedcb1d625b5148f8a1236d5e3ff11acf000000000000000000000000000000000000000000000000000000000000002549960de5880e8c687434170f6476605b8fe4aeb9a28632c7995cf3ba831d9763050000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000867b2274797065223a22776562617574686e2e676574222c226368616c6c656e6765223a22396a4546696a75684557724d34534f572d7443684a625545484550343456636a634a2d42716f3166544d38222c226f726967696e223a22687474703a2f2f6c6f63616c686f73743a38303830222c2263726f73734f726967696e223a66616c73657d0000000000000000000000000000000000000000000000000000';
+export function parseWebauthnPublicKey(publicKey) {
+    const bytes = typeof publicKey === 'string' ? hexToBytes(publicKey) : publicKey;
+    const offset = bytes.length === 65 ? 1 : 0;
+    const prefix = offset === 1 ? bytes[0] : undefined;
+    return {
+        ...(prefix === undefined ? {} : { prefix }),
+        x: BigInt(bytesToHex(bytes.slice(offset, 32 + offset))),
+        y: BigInt(bytesToHex(bytes.slice(32 + offset, 64 + offset))),
+    };
+}
+export function parseWebauthnSignature(signature) {
+    const bytes = typeof signature === 'string' ? hexToBytes(signature) : signature;
+    return {
+        r: BigInt(bytesToHex(bytes.slice(0, 32))),
+        s: BigInt(bytesToHex(bytes.slice(32, 64))),
+    };
+}
+export function generateWebauthnCredentialId(pubKeyX, pubKeyY, account) {
+    return keccak256(encodeAbiParameters([{ type: 'uint256' }, { type: 'uint256' }, { type: 'address' }], [pubKeyX, pubKeyY, account]));
+}
+export function encodeWebauthnSignatures(credentialIds, usePrecompile, signatures) {
+    const ordered = credentialIds
+        .map((credentialId, index) => ({
+        credentialId,
+        signature: signatures[index],
+    }))
+        .sort((left, right) => left.credentialId.localeCompare(right.credentialId));
+    return encodeAbiParameters([
+        { type: 'bytes32[]', name: 'credIds' },
+        { type: 'bool', name: 'usePrecompile' },
+        {
+            type: 'tuple[]',
+            name: 'webAuthns',
+            components: [
+                { type: 'bytes', name: 'authenticatorData' },
+                { type: 'string', name: 'clientDataJSON' },
+                { type: 'uint256', name: 'challengeIndex' },
+                { type: 'uint256', name: 'typeIndex' },
+                { type: 'uint256', name: 'r' },
+                { type: 'uint256', name: 's' },
+            ],
+        },
+    ], [
+        ordered.map(({ credentialId }) => credentialId),
+        usePrecompile,
+        ordered.map(({ signature }) => signature),
+    ]);
+}
+export function encodeWebauthnSignatureV0(signature, usePrecompile) {
+    return encodeAbiParameters([
+        { type: 'bytes', name: 'authenticatorData' },
+        { type: 'string', name: 'clientDataJSON' },
+        { type: 'uint256', name: 'responseTypeLocation' },
+        { type: 'uint256', name: 'r' },
+        { type: 'uint256', name: 's' },
+        { type: 'bool', name: 'usePrecompiled' },
+    ], [
+        signature.authenticatorData,
+        signature.clientDataJSON,
+        signature.typeIndex,
+        signature.r,
+        signature.s,
+        usePrecompile,
+    ]);
+}
+export function encodeWebauthnValidatorContribution(input) {
+    if (input.threshold < 1 || input.threshold > input.ownerOrder.length) {
+        throw new Error('Validator threshold is outside the configured owner set');
+    }
+    const configured = new Set(input.ownerOrder);
+    const contributions = new Map();
+    for (const contribution of input.contributions) {
+        if (!configured.has(contribution.ownerId)) {
+            throw new Error(`Unknown validator owner ${contribution.ownerId}`);
+        }
+        if (contributions.has(contribution.ownerId)) {
+            throw new Error(`Duplicate validator owner ${contribution.ownerId}`);
+        }
+        contributions.set(contribution.ownerId, contribution);
+    }
+    const ordered = input.ownerOrder.flatMap((ownerId) => {
+        const contribution = contributions.get(ownerId);
+        return contribution ? [contribution] : [];
+    });
+    if (ordered.length < input.threshold) {
+        throw new Error(`Insufficient validator contributions: required ${input.threshold}, received ${ordered.length}`);
+    }
+    const signatures = ordered.map((contribution) => ({
+        authenticatorData: contribution.authenticatorData,
+        clientDataJSON: contribution.clientDataJSON,
+        challengeIndex: BigInt(contribution.challengeIndex),
+        typeIndex: BigInt(contribution.typeIndex),
+        ...parseWebauthnSignature(contribution.signature),
+    }));
+    if (input.format === 'v0') {
+        if (signatures.length !== 1) {
+            throw new Error('WebAuthn V0 accepts exactly one contribution');
+        }
+        return encodeWebauthnSignatureV0(signatures[0], input.usePrecompile);
+    }
+    const credentialIds = ordered.map((contribution) => {
+        const publicKey = parseWebauthnPublicKey(contribution.publicKey);
+        return generateWebauthnCredentialId(publicKey.x, publicKey.y, input.account);
+    });
+    return encodeWebauthnSignatures(credentialIds, input.usePrecompile, signatures);
+}
+export function resolveWebauthnCredentials(input) {
+    const credentials = input.credentials.map((credential) => {
+        const publicKey = typeof credential.pubKey === 'object' &&
+            !(credential.pubKey instanceof Uint8Array)
+            ? credential.pubKey
+            : parseWebauthnPublicKey(credential.pubKey);
+        return {
+            pubKeyX: publicKey.x,
+            pubKeyY: publicKey.y,
+            requireUV: false,
+        };
+    });
+    return {
+        kind: 'validator',
+        address: input.address ?? WEBAUTHN_VALIDATOR_ADDRESS,
+        initData: encodeAbiParameters([
+            { name: 'threshold', type: 'uint256' },
+            {
+                name: 'credentials',
+                type: 'tuple[]',
+                components: [
+                    { name: 'pubKeyX', type: 'uint256' },
+                    { name: 'pubKeyY', type: 'uint256' },
+                    { name: 'requireUV', type: 'bool' },
+                ],
+            },
+        ], [BigInt(input.threshold), credentials]),
+        deInitData: '0x',
+        additionalContext: '0x',
+    };
+}
+export function resolveWebauthnValidator(definition) {
+    const credentials = definition.owners.map((owner) => {
+        if (owner.kind !== 'webauthn') {
+            throw new Error('WebAuthn validator contains a non-WebAuthn owner');
+        }
+        return {
+            pubKey: owner.account.publicKey,
+            authenticatorId: owner.account.id,
+        };
+    });
+    return resolveWebauthnCredentials({
+        credentials,
+        threshold: definition.threshold,
+        address: definition.module.source === 'explicit'
+            ? definition.module.address
+            : WEBAUTHN_VALIDATOR_ADDRESS,
+    });
+}

package/dist/src/signing/context.d.ts

@@ -0,0 +1,25 @@
+import type { AccountAdapter, AccountRuntime } from '../accounts/adapter.js';
+import type { AccountCapabilities, AccountIdentity } from '../accounts/types.js';
+import type { ResolvedValidatorDefinition, ValidatorCapabilities, ValidatorContributionCodec, ValidatorSigningPurpose } from '../modules/validators/types.js';
+import type { ArtifactAssemblyPlan, EffectiveSignerSelection, OwnerSignerSelection, SignerInvocationPort, SignerReference } from './types.js';
+export interface SigningContext {
+    readonly account: AccountIdentity;
+    readonly accountAdapter: AccountAdapter;
+    readonly accountCapabilities: AccountCapabilities;
+    readonly validator: ResolvedValidatorDefinition;
+    readonly validatorCapabilities: ValidatorCapabilities;
+    readonly effectiveSigners: EffectiveSignerSelection;
+    readonly signerReferences: Readonly<Record<string, SignerReference>>;
+    readonly signerInvoker: SignerInvocationPort;
+}
+export declare function createAccountSigningContext(input: {
+    readonly runtime: AccountRuntime;
+    readonly purpose: ValidatorSigningPurpose;
+    readonly signerInvoker: SignerInvocationPort;
+    readonly selection?: OwnerSignerSelection;
+}): SigningContext;
+export declare function getSigningValidatorCodec(context: SigningContext, payloadKind?: 'message' | 'typed-data'): ValidatorContributionCodec;
+export declare function getSigningValidatorFactors(context: SigningContext, payloadKind?: 'message' | 'typed-data'): NonNullable<ArtifactAssemblyPlan['validatorFactors']>;
+export declare function getAccountSignatureRoute(runtime: AccountRuntime, context: SigningContext, erc7739?: ArtifactAssemblyPlan['erc7739'], payloadKind?: 'message' | 'typed-data'): Omit<ArtifactAssemblyPlan, 'id' | 'stageId' | 'input' | 'usage'>;
+export declare function getAccountSignatureEnvelope(context: SigningContext): import('../accounts/types.js').AccountSignatureEnvelope;
+//# sourceMappingURL=context.d.ts.map

package/dist/src/signing/context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../../../signing/context.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AACzE,OAAO,KAAK,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAI7E,OAAO,KAAK,EACV,2BAA2B,EAC3B,qBAAqB,EACrB,0BAA0B,EAC1B,uBAAuB,EACxB,MAAM,6BAA6B,CAAA;AAEpC,OAAO,KAAK,EACV,oBAAoB,EACpB,wBAAwB,EACxB,oBAAoB,EACpB,oBAAoB,EACpB,eAAe,EAChB,MAAM,SAAS,CAAA;AAEhB,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAA;IACjC,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAA;IACvC,QAAQ,CAAC,mBAAmB,EAAE,mBAAmB,CAAA;IACjD,QAAQ,CAAC,SAAS,EAAE,2BAA2B,CAAA;IAC/C,QAAQ,CAAC,qBAAqB,EAAE,qBAAqB,CAAA;IACrD,QAAQ,CAAC,gBAAgB,EAAE,wBAAwB,CAAA;IACnD,QAAQ,CAAC,gBAAgB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC,CAAA;IACpE,QAAQ,CAAC,aAAa,EAAE,oBAAoB,CAAA;CAC7C;AAID,wBAAgB,2BAA2B,CAAC,KAAK,EAAE;IACjD,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAA;IAChC,QAAQ,CAAC,OAAO,EAAE,uBAAuB,CAAA;IACzC,QAAQ,CAAC,aAAa,EAAE,oBAAoB,CAAA;IAC5C,QAAQ,CAAC,SAAS,CAAC,EAAE,oBAAoB,CAAA;CAC1C,GAAG,cAAc,CA4DjB;AAED,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,cAAc,EACvB,WAAW,CAAC,EAAE,SAAS,GAAG,YAAY,GACrC,0BAA0B,CAoB5B;AAED,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,cAAc,EACvB,WAAW,CAAC,EAAE,SAAS,GAAG,YAAY,GACrC,WAAW,CAAC,oBAAoB,CAAC,kBAAkB,CAAC,CAAC,CAmCvD;AAED,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,cAAc,EACvB,OAAO,EAAE,cAAc,EACvB,OAAO,GAAE,oBAAoB,CAAC,SAAS,CAAoB,EAC3D,WAAW,GAAE,SAAS,GAAG,YAAwB,GAChD,IAAI,CAAC,oBAAoB,EAAE,IAAI,GAAG,SAAS,GAAG,OAAO,GAAG,OAAO,CAAC,CAsBlE;AAED,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,cAAc,GACtB,OAAO,mBAAmB,EAAE,wBAAwB,CAWtD"}

package/dist/src/signing/context.js

@@ -0,0 +1,163 @@
+import { isAddressEqual } from 'viem';
+import { getValidatorCapabilities } from '../modules/validators/capabilities.js';
+import { resolveValidator } from '../modules/validators/resolve.js';
+import { ecdsaSignerId } from '../modules/validators/signer-id.js';
+import { signingTopology } from './plan.js';
+const zeroAddress = '0x0000000000000000000000000000000000000000';
+export function createAccountSigningContext(input) {
+    const validator = input.selection?.validator ??
+        input.runtime.construction.owner ??
+        eoaValidator(input.runtime);
+    const module = input.selection?.validator === undefined &&
+        input.runtime.construction.owner === undefined
+        ? {
+            kind: 'validator',
+            address: zeroAddress,
+            initData: '0x',
+            deInitData: '0x',
+            additionalContext: '0x',
+        }
+        : resolveValidator(validator);
+    const signerReferences = Object.fromEntries(validatorOwners(validator).map((owner) => [
+        owner.signerId,
+        {
+            id: owner.signerId,
+            kind: owner.kind === 'webauthn'
+                ? 'webauthn'
+                : 'ecdsa',
+        },
+    ]));
+    const topology = input.selection?.validator === undefined &&
+        input.runtime.construction.owner === undefined
+        ? {
+            configuredTopology: {
+                rootValidatorId: 'eoa',
+                validators: [],
+                threshold: 1,
+            },
+            effectiveSelection: {
+                validatorIds: [],
+                signerIds: Object.keys(signerReferences),
+                threshold: 1,
+            },
+        }
+        : signingTopology(validator, input.selection?.signerIds);
+    return {
+        account: input.runtime.identity,
+        accountAdapter: input.runtime.adapter,
+        accountCapabilities: input.runtime.adapter.capabilities,
+        validator,
+        validatorCapabilities: getValidatorCapabilities(validator, module, input.runtime.construction.account.kind, input.purpose, input.runtime.adapter.capabilities.supportsOriginSignatureReuse),
+        effectiveSigners: topology.effectiveSelection,
+        signerReferences,
+        signerInvoker: input.signerInvoker,
+    };
+}
+export function getSigningValidatorCodec(context, payloadKind) {
+    const codec = context.validatorCapabilities.contributionCodec;
+    const normalizedCodec = payloadKind === 'typed-data' && codec.kind === 'ordered-threshold'
+        ? { ...codec, recoveryEncoding: 'ethereum' }
+        : codec;
+    if (context.validator.kind !== 'passkey' ||
+        normalizedCodec.kind !== 'ordered-threshold') {
+        return normalizedCodec;
+    }
+    return {
+        ...normalizedCodec,
+        webauthn: {
+            account: context.account.address,
+            usePrecompile: false,
+            format: 'current',
+        },
+    };
+}
+export function getSigningValidatorFactors(context, payloadKind) {
+    if (context.validator.kind !== 'multi-factor')
+        return [];
+    return context.validator.validators.map((factor) => {
+        const module = resolveValidator(factor);
+        const codec = getValidatorCapabilities(factor, module, context.account.definition.kind, context.validatorCapabilities.compatibilityKey.purpose, context.accountCapabilities.supportsOriginSignatureReuse).contributionCodec;
+        const normalizedCodec = payloadKind === 'typed-data' && codec.kind === 'ordered-threshold'
+            ? { ...codec, recoveryEncoding: 'ethereum' }
+            : codec;
+        if (normalizedCodec.kind !== 'ordered-threshold') {
+            throw new Error(`Multi-factor validator ${factor.id} is not atomic`);
+        }
+        return {
+            id: factor.id,
+            publicId: factor.publicId,
+            validator: module.address,
+            codec: factor.kind === 'passkey'
+                ? {
+                    ...normalizedCodec,
+                    webauthn: {
+                        account: context.account.address,
+                        usePrecompile: false,
+                        format: 'current',
+                    },
+                }
+                : normalizedCodec,
+        };
+    });
+}
+export function getAccountSignatureRoute(runtime, context, erc7739 = { kind: 'none' }, payloadKind = 'message') {
+    const deployment = runtime.adapter.getDeploymentPlan(runtime.construction);
+    let erc6492 = { kind: 'none' };
+    if (!deployment.deployed) {
+        if (!deployment.factory || !deployment.factoryData) {
+            throw new Error('Account factory arguments are unavailable');
+        }
+        erc6492 = {
+            kind: 'wrap-deployless',
+            factory: deployment.factory,
+            factoryData: deployment.factoryData,
+        };
+    }
+    return {
+        validatorCodec: getSigningValidatorCodec(context, payloadKind),
+        ...(context.validator.kind === 'multi-factor'
+            ? { validatorFactors: getSigningValidatorFactors(context, payloadKind) }
+            : {}),
+        erc7739,
+        accountEnvelope: getAccountSignatureEnvelope(context),
+        erc6492,
+    };
+}
+export function getAccountSignatureEnvelope(context) {
+    const envelope = context.accountCapabilities.signatureEnvelope;
+    if (envelope.kind === 'none' || envelope.kind === 'hca')
+        return envelope;
+    const validator = context.validatorCapabilities.compatibilityKey.moduleAddress;
+    return envelope.kind === 'kernel'
+        ? {
+            ...envelope,
+            validator,
+            isRoot: isAddressEqual(validator, envelope.validator),
+        }
+        : { ...envelope, validator };
+}
+function eoaValidator(runtime) {
+    const account = runtime.construction.eoa;
+    if (!account)
+        throw new Error('EOA account signer is missing');
+    return {
+        kind: 'ecdsa',
+        id: 'eoa',
+        publicId: 0,
+        module: { source: 'explicit', address: zeroAddress },
+        owners: [
+            {
+                kind: 'ecdsa',
+                id: 'eoa/owner/0',
+                signerId: ecdsaSignerId(account),
+                account,
+            },
+        ],
+        threshold: 1,
+    };
+}
+function validatorOwners(validator) {
+    return validator.kind === 'multi-factor'
+        ? validator.validators.flatMap(({ owners }) => owners)
+        : validator.owners;
+}

package/dist/src/signing/contribution.d.ts

@@ -0,0 +1,13 @@
+import type { ValidatorContributionCodec } from '../modules/validators/types.js';
+import type { ArtifactAssemblyPlan, MaterializedSigningStage, PlannedValidatorContributionCodec, RawSignerResult } from './types.js';
+export declare function encodePlannedValidatorContribution(input: {
+    readonly artifact: ArtifactAssemblyPlan;
+    readonly stage: MaterializedSigningStage;
+    readonly results: Readonly<Record<string, RawSignerResult>>;
+}): `0x${string}`;
+export declare function resolvePlannedValidatorCodec(codec: PlannedValidatorContributionCodec | {
+    readonly kind: 'none';
+}, stage: MaterializedSigningStage): ValidatorContributionCodec | {
+    readonly kind: 'none';
+};
+//# sourceMappingURL=contribution.d.ts.map

package/dist/src/signing/contribution.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"contribution.d.ts","sourceRoot":"","sources":["../../../signing/contribution.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,0BAA0B,EAE3B,MAAM,6BAA6B,CAAA;AACpC,OAAO,KAAK,EACV,oBAAoB,EACpB,wBAAwB,EACxB,iCAAiC,EACjC,eAAe,EAChB,MAAM,SAAS,CAAA;AAEhB,wBAAgB,kCAAkC,CAAC,KAAK,EAAE;IACxD,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,CAAA;IACvC,QAAQ,CAAC,KAAK,EAAE,wBAAwB,CAAA;IACxC,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC,CAAA;CAC5D,GAAG,KAAK,MAAM,EAAE,CA4ChB;AAED,wBAAgB,4BAA4B,CAC1C,KAAK,EAAE,iCAAiC,GAAG;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,EACpE,KAAK,EAAE,wBAAwB,GAC9B,0BAA0B,GAAG;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAOxD"}

package/dist/src/signing/contribution.js

@@ -0,0 +1,83 @@
+import { encodeValidatorContribution } from '../modules/validators/contribution.js';
+import { encodeEcdsaRecoveryValue } from '../modules/validators/ownable.js';
+export function encodePlannedValidatorContribution(input) {
+    const codec = resolvePlannedValidatorCodec(input.artifact.validatorCodec, input.stage);
+    if (codec.kind === 'none') {
+        throw new Error(`Artifact ${input.artifact.id} has no validator codec`);
+    }
+    if (input.artifact.input.kind !== 'task-results') {
+        throw new Error(`Artifact ${input.artifact.id} does not use task results`);
+    }
+    const planned = input.artifact.input.taskIds.map((taskId) => {
+        const task = input.stage.tasks.find(({ id }) => id === taskId);
+        const result = input.results[taskId];
+        if (!task || !result || !task.contribution) {
+            throw new Error(`Signing contribution ${taskId} is incomplete`);
+        }
+        return {
+            metadata: task.contribution,
+            contribution: contributionFromResult(task.contribution, result),
+        };
+    });
+    if (!input.artifact.validatorFactors) {
+        return encodeValidatorContribution(codec, planned.map(({ contribution }) => contribution));
+    }
+    const factors = input.artifact.validatorFactors.map((factor) => ({
+        kind: 'factor',
+        factorId: factor.id,
+        publicId: factor.publicId,
+        validator: factor.validator,
+        contribution: encodeValidatorContribution(factor.codec, planned.flatMap(({ metadata, contribution }) => 'factorId' in metadata && metadata.factorId === factor.id
+            ? [contribution]
+            : [])),
+    }));
+    return encodeValidatorContribution(codec, factors);
+}
+export function resolvePlannedValidatorCodec(codec, stage) {
+    if (codec.kind !== 'smart-session-state')
+        return codec;
+    const fact = stage.facts.find(({ id }) => id === codec.factId);
+    if (fact?.kind !== 'session-enabled') {
+        throw new Error(`Session-state fact ${codec.factId} is missing`);
+    }
+    return fact.enabled ? codec.whenEnabled : codec.whenDisabled;
+}
+function contributionFromResult(metadata, result) {
+    switch (metadata.kind) {
+        case 'ecdsa':
+            if (result.kind !== 'ecdsa-signature') {
+                throw new Error('ECDSA task returned an incompatible result');
+            }
+            return {
+                kind: 'ecdsa',
+                ownerId: metadata.ownerId,
+                signature: result.signature,
+                encoding: metadata.encoding,
+            };
+        case 'webauthn':
+            if (result.kind !== 'webauthn-assertion') {
+                throw new Error('WebAuthn task returned an incompatible result');
+            }
+            return {
+                kind: 'webauthn',
+                ownerId: metadata.ownerId,
+                publicKey: metadata.publicKey,
+                signature: result.signature,
+                authenticatorData: result.authenticatorData,
+                clientDataJSON: result.clientDataJSON,
+                challengeIndex: result.challengeIndex,
+                typeIndex: result.typeIndex,
+                userVerificationRequired: result.userVerificationRequired,
+            };
+        case 'session':
+            if (result.kind !== 'ecdsa-signature') {
+                throw new Error('Session task returned an incompatible result');
+            }
+            return {
+                kind: 'session',
+                signature: encodeEcdsaRecoveryValue(result.signature, metadata.recoveryEncoding),
+            };
+        case 'authorization':
+            throw new Error('Authorization results are not validator contributions');
+    }
+}

package/dist/src/signing/eip7702.d.ts

@@ -0,0 +1,41 @@
+import { type Address, type Hex, type SignedAuthorization, type TypedDataDefinition } from 'viem';
+import type { ChainReference } from '../chains/types.js';
+import type { PayloadSigningTask, SignerInvocationPort, SignerReference, SigningCheckpointPort, SigningPayloadRegistry, SigningPlan, SigningTranscript } from './types.js';
+export interface NexusEip7702InitPlanInput {
+    readonly typedData: TypedDataDefinition;
+    readonly signer: SignerReference;
+}
+export declare function createNexusEip7702InitTypedData(input: {
+    readonly contract: Address;
+    readonly initData: Hex;
+}): TypedDataDefinition;
+export declare function createNexusEip7702InitPlan(input: NexusEip7702InitPlanInput): SigningPlan;
+export declare function signNexusEip7702Init(input: {
+    readonly planInput: NexusEip7702InitPlanInput;
+    readonly signerInvoker: SignerInvocationPort;
+    readonly checkpoints: SigningCheckpointPort;
+}): Promise<{
+    readonly signature: Hex;
+    readonly transcript: SigningTranscript;
+}>;
+export interface AuthorizationListPlanInput {
+    readonly account: Address;
+    readonly contract: Address;
+    readonly chains: readonly ChainReference[];
+    readonly signer: SignerReference;
+    readonly nonceByChain: Readonly<Record<number, number>>;
+}
+export declare function createAuthorizationListPlan(input: AuthorizationListPlanInput): {
+    readonly plan: SigningPlan;
+    readonly payloads: SigningPayloadRegistry;
+};
+export declare function signAuthorizationList(input: {
+    readonly planInput: AuthorizationListPlanInput;
+    readonly signerInvoker: SignerInvocationPort;
+    readonly checkpoints: SigningCheckpointPort;
+}): Promise<{
+    readonly authorizations: readonly SignedAuthorization[];
+    readonly transcript: SigningTranscript;
+}>;
+export type { PayloadSigningTask };
+//# sourceMappingURL=eip7702.d.ts.map

package/dist/src/signing/eip7702.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"eip7702.d.ts","sourceRoot":"","sources":["../../../signing/eip7702.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,OAAO,EAEZ,KAAK,GAAG,EAGR,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACzB,MAAM,MAAM,CAAA;AACb,OAAO,KAAK,EAAE,cAAc,EAAqB,MAAM,iBAAiB,CAAA;AAExE,OAAO,KAAK,EAGV,kBAAkB,EAClB,oBAAoB,EACpB,eAAe,EACf,qBAAqB,EACrB,sBAAsB,EACtB,WAAW,EACX,iBAAiB,EAClB,MAAM,SAAS,CAAA;AAEhB,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,SAAS,EAAE,mBAAmB,CAAA;IACvC,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAA;CACjC;AAED,wBAAgB,+BAA+B,CAAC,KAAK,EAAE;IACrD,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAA;IAC1B,QAAQ,CAAC,QAAQ,EAAE,GAAG,CAAA;CACvB,GAAG,mBAAmB,CAiBtB;AAED,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,yBAAyB,GAC/B,WAAW,CAeb;AAED,wBAAsB,oBAAoB,CAAC,KAAK,EAAE;IAChD,QAAQ,CAAC,SAAS,EAAE,yBAAyB,CAAA;IAC7C,QAAQ,CAAC,aAAa,EAAE,oBAAoB,CAAA;IAC5C,QAAQ,CAAC,WAAW,EAAE,qBAAqB,CAAA;CAC5C,GAAG,OAAO,CAAC;IACV,QAAQ,CAAC,SAAS,EAAE,GAAG,CAAA;IACvB,QAAQ,CAAC,UAAU,EAAE,iBAAiB,CAAA;CACvC,CAAC,CAkBD;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAA;IAC1B,QAAQ,CAAC,MAAM,EAAE,SAAS,cAAc,EAAE,CAAA;IAC1C,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAA;IAChC,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;CACxD;AAED,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,0BAA0B,GAChC;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,sBAAsB,CAAA;CAAE,CAkF3E;AAED,wBAAsB,qBAAqB,CAAC,KAAK,EAAE;IACjD,QAAQ,CAAC,SAAS,EAAE,0BAA0B,CAAA;IAC9C,QAAQ,CAAC,aAAa,EAAE,oBAAoB,CAAA;IAC5C,QAAQ,CAAC,WAAW,EAAE,qBAAqB,CAAA;CAC5C,GAAG,OAAO,CAAC;IACV,QAAQ,CAAC,cAAc,EAAE,SAAS,mBAAmB,EAAE,CAAA;IACvD,QAAQ,CAAC,UAAU,EAAE,iBAAiB,CAAA;CACvC,CAAC,CAeD;AAiGD,YAAY,EAAE,kBAAkB,EAAE,CAAA"}