@rhinestone/sdk 2.0.0-beta.9 → 2.1.0

package/dist/src/signing/context.d.ts

@@ -0,0 +1,25 @@
+import type { AccountAdapter, AccountRuntime } from '../accounts/adapter.js';
+import type { AccountCapabilities, AccountIdentity } from '../accounts/types.js';
+import type { ResolvedValidatorDefinition, ValidatorCapabilities, ValidatorContributionCodec, ValidatorSigningPurpose } from '../modules/validators/types.js';
+import type { ArtifactAssemblyPlan, EffectiveSignerSelection, OwnerSignerSelection, SignerInvocationPort, SignerReference } from './types.js';
+export interface SigningContext {
+    readonly account: AccountIdentity;
+    readonly accountAdapter: AccountAdapter;
+    readonly accountCapabilities: AccountCapabilities;
+    readonly validator: ResolvedValidatorDefinition;
+    readonly validatorCapabilities: ValidatorCapabilities;
+    readonly effectiveSigners: EffectiveSignerSelection;
+    readonly signerReferences: Readonly<Record<string, SignerReference>>;
+    readonly signerInvoker: SignerInvocationPort;
+}
+export declare function createAccountSigningContext(input: {
+    readonly runtime: AccountRuntime;
+    readonly purpose: ValidatorSigningPurpose;
+    readonly signerInvoker: SignerInvocationPort;
+    readonly selection?: OwnerSignerSelection;
+}): SigningContext;
+export declare function getSigningValidatorCodec(context: SigningContext, payloadKind?: 'message' | 'typed-data'): ValidatorContributionCodec;
+export declare function getSigningValidatorFactors(context: SigningContext, payloadKind?: 'message' | 'typed-data'): NonNullable<ArtifactAssemblyPlan['validatorFactors']>;
+export declare function getAccountSignatureRoute(runtime: AccountRuntime, context: SigningContext, erc7739?: ArtifactAssemblyPlan['erc7739'], payloadKind?: 'message' | 'typed-data'): Omit<ArtifactAssemblyPlan, 'id' | 'stageId' | 'input' | 'usage'>;
+export declare function getAccountSignatureEnvelope(context: SigningContext): import('../accounts/types.js').AccountSignatureEnvelope;
+//# sourceMappingURL=context.d.ts.map

package/dist/src/signing/context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../../../signing/context.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AACzE,OAAO,KAAK,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAI7E,OAAO,KAAK,EACV,2BAA2B,EAC3B,qBAAqB,EACrB,0BAA0B,EAC1B,uBAAuB,EACxB,MAAM,6BAA6B,CAAA;AAEpC,OAAO,KAAK,EACV,oBAAoB,EACpB,wBAAwB,EACxB,oBAAoB,EACpB,oBAAoB,EACpB,eAAe,EAChB,MAAM,SAAS,CAAA;AAEhB,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAA;IACjC,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAA;IACvC,QAAQ,CAAC,mBAAmB,EAAE,mBAAmB,CAAA;IACjD,QAAQ,CAAC,SAAS,EAAE,2BAA2B,CAAA;IAC/C,QAAQ,CAAC,qBAAqB,EAAE,qBAAqB,CAAA;IACrD,QAAQ,CAAC,gBAAgB,EAAE,wBAAwB,CAAA;IACnD,QAAQ,CAAC,gBAAgB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC,CAAA;IACpE,QAAQ,CAAC,aAAa,EAAE,oBAAoB,CAAA;CAC7C;AAID,wBAAgB,2BAA2B,CAAC,KAAK,EAAE;IACjD,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAA;IAChC,QAAQ,CAAC,OAAO,EAAE,uBAAuB,CAAA;IACzC,QAAQ,CAAC,aAAa,EAAE,oBAAoB,CAAA;IAC5C,QAAQ,CAAC,SAAS,CAAC,EAAE,oBAAoB,CAAA;CAC1C,GAAG,cAAc,CA4DjB;AAED,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,cAAc,EACvB,WAAW,CAAC,EAAE,SAAS,GAAG,YAAY,GACrC,0BAA0B,CAoB5B;AAED,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,cAAc,EACvB,WAAW,CAAC,EAAE,SAAS,GAAG,YAAY,GACrC,WAAW,CAAC,oBAAoB,CAAC,kBAAkB,CAAC,CAAC,CAmCvD;AAED,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,cAAc,EACvB,OAAO,EAAE,cAAc,EACvB,OAAO,GAAE,oBAAoB,CAAC,SAAS,CAAoB,EAC3D,WAAW,GAAE,SAAS,GAAG,YAAwB,GAChD,IAAI,CAAC,oBAAoB,EAAE,IAAI,GAAG,SAAS,GAAG,OAAO,GAAG,OAAO,CAAC,CAsBlE;AAED,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,cAAc,GACtB,OAAO,mBAAmB,EAAE,wBAAwB,CAWtD"}

package/dist/src/signing/context.js

@@ -0,0 +1,163 @@
+import { isAddressEqual } from 'viem';
+import { getValidatorCapabilities } from '../modules/validators/capabilities.js';
+import { resolveValidator } from '../modules/validators/resolve.js';
+import { ecdsaSignerId } from '../modules/validators/signer-id.js';
+import { signingTopology } from './plan.js';
+const zeroAddress = '0x0000000000000000000000000000000000000000';
+export function createAccountSigningContext(input) {
+    const validator = input.selection?.validator ??
+        input.runtime.construction.owner ??
+        eoaValidator(input.runtime);
+    const module = input.selection?.validator === undefined &&
+        input.runtime.construction.owner === undefined
+        ? {
+            kind: 'validator',
+            address: zeroAddress,
+            initData: '0x',
+            deInitData: '0x',
+            additionalContext: '0x',
+        }
+        : resolveValidator(validator);
+    const signerReferences = Object.fromEntries(validatorOwners(validator).map((owner) => [
+        owner.signerId,
+        {
+            id: owner.signerId,
+            kind: owner.kind === 'webauthn'
+                ? 'webauthn'
+                : 'ecdsa',
+        },
+    ]));
+    const topology = input.selection?.validator === undefined &&
+        input.runtime.construction.owner === undefined
+        ? {
+            configuredTopology: {
+                rootValidatorId: 'eoa',
+                validators: [],
+                threshold: 1,
+            },
+            effectiveSelection: {
+                validatorIds: [],
+                signerIds: Object.keys(signerReferences),
+                threshold: 1,
+            },
+        }
+        : signingTopology(validator, input.selection?.signerIds);
+    return {
+        account: input.runtime.identity,
+        accountAdapter: input.runtime.adapter,
+        accountCapabilities: input.runtime.adapter.capabilities,
+        validator,
+        validatorCapabilities: getValidatorCapabilities(validator, module, input.runtime.construction.account.kind, input.purpose, input.runtime.adapter.capabilities.supportsOriginSignatureReuse),
+        effectiveSigners: topology.effectiveSelection,
+        signerReferences,
+        signerInvoker: input.signerInvoker,
+    };
+}
+export function getSigningValidatorCodec(context, payloadKind) {
+    const codec = context.validatorCapabilities.contributionCodec;
+    const normalizedCodec = payloadKind === 'typed-data' && codec.kind === 'ordered-threshold'
+        ? { ...codec, recoveryEncoding: 'ethereum' }
+        : codec;
+    if (context.validator.kind !== 'passkey' ||
+        normalizedCodec.kind !== 'ordered-threshold') {
+        return normalizedCodec;
+    }
+    return {
+        ...normalizedCodec,
+        webauthn: {
+            account: context.account.address,
+            usePrecompile: false,
+            format: 'current',
+        },
+    };
+}
+export function getSigningValidatorFactors(context, payloadKind) {
+    if (context.validator.kind !== 'multi-factor')
+        return [];
+    return context.validator.validators.map((factor) => {
+        const module = resolveValidator(factor);
+        const codec = getValidatorCapabilities(factor, module, context.account.definition.kind, context.validatorCapabilities.compatibilityKey.purpose, context.accountCapabilities.supportsOriginSignatureReuse).contributionCodec;
+        const normalizedCodec = payloadKind === 'typed-data' && codec.kind === 'ordered-threshold'
+            ? { ...codec, recoveryEncoding: 'ethereum' }
+            : codec;
+        if (normalizedCodec.kind !== 'ordered-threshold') {
+            throw new Error(`Multi-factor validator ${factor.id} is not atomic`);
+        }
+        return {
+            id: factor.id,
+            publicId: factor.publicId,
+            validator: module.address,
+            codec: factor.kind === 'passkey'
+                ? {
+                    ...normalizedCodec,
+                    webauthn: {
+                        account: context.account.address,
+                        usePrecompile: false,
+                        format: 'current',
+                    },
+                }
+                : normalizedCodec,
+        };
+    });
+}
+export function getAccountSignatureRoute(runtime, context, erc7739 = { kind: 'none' }, payloadKind = 'message') {
+    const deployment = runtime.adapter.getDeploymentPlan(runtime.construction);
+    let erc6492 = { kind: 'none' };
+    if (!deployment.deployed) {
+        if (!deployment.factory || !deployment.factoryData) {
+            throw new Error('Account factory arguments are unavailable');
+        }
+        erc6492 = {
+            kind: 'wrap-deployless',
+            factory: deployment.factory,
+            factoryData: deployment.factoryData,
+        };
+    }
+    return {
+        validatorCodec: getSigningValidatorCodec(context, payloadKind),
+        ...(context.validator.kind === 'multi-factor'
+            ? { validatorFactors: getSigningValidatorFactors(context, payloadKind) }
+            : {}),
+        erc7739,
+        accountEnvelope: getAccountSignatureEnvelope(context),
+        erc6492,
+    };
+}
+export function getAccountSignatureEnvelope(context) {
+    const envelope = context.accountCapabilities.signatureEnvelope;
+    if (envelope.kind === 'none' || envelope.kind === 'hca')
+        return envelope;
+    const validator = context.validatorCapabilities.compatibilityKey.moduleAddress;
+    return envelope.kind === 'kernel'
+        ? {
+            ...envelope,
+            validator,
+            isRoot: isAddressEqual(validator, envelope.validator),
+        }
+        : { ...envelope, validator };
+}
+function eoaValidator(runtime) {
+    const account = runtime.construction.eoa;
+    if (!account)
+        throw new Error('EOA account signer is missing');
+    return {
+        kind: 'ecdsa',
+        id: 'eoa',
+        publicId: 0,
+        module: { source: 'explicit', address: zeroAddress },
+        owners: [
+            {
+                kind: 'ecdsa',
+                id: 'eoa/owner/0',
+                signerId: ecdsaSignerId(account),
+                account,
+            },
+        ],
+        threshold: 1,
+    };
+}
+function validatorOwners(validator) {
+    return validator.kind === 'multi-factor'
+        ? validator.validators.flatMap(({ owners }) => owners)
+        : validator.owners;
+}

package/dist/src/signing/contribution.d.ts

@@ -0,0 +1,13 @@
+import type { ValidatorContributionCodec } from '../modules/validators/types.js';
+import type { ArtifactAssemblyPlan, MaterializedSigningStage, PlannedValidatorContributionCodec, RawSignerResult } from './types.js';
+export declare function encodePlannedValidatorContribution(input: {
+    readonly artifact: ArtifactAssemblyPlan;
+    readonly stage: MaterializedSigningStage;
+    readonly results: Readonly<Record<string, RawSignerResult>>;
+}): `0x${string}`;
+export declare function resolvePlannedValidatorCodec(codec: PlannedValidatorContributionCodec | {
+    readonly kind: 'none';
+}, stage: MaterializedSigningStage): ValidatorContributionCodec | {
+    readonly kind: 'none';
+};
+//# sourceMappingURL=contribution.d.ts.map

package/dist/src/signing/contribution.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"contribution.d.ts","sourceRoot":"","sources":["../../../signing/contribution.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,0BAA0B,EAE3B,MAAM,6BAA6B,CAAA;AACpC,OAAO,KAAK,EACV,oBAAoB,EACpB,wBAAwB,EACxB,iCAAiC,EACjC,eAAe,EAChB,MAAM,SAAS,CAAA;AAEhB,wBAAgB,kCAAkC,CAAC,KAAK,EAAE;IACxD,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,CAAA;IACvC,QAAQ,CAAC,KAAK,EAAE,wBAAwB,CAAA;IACxC,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC,CAAA;CAC5D,GAAG,KAAK,MAAM,EAAE,CA4ChB;AAED,wBAAgB,4BAA4B,CAC1C,KAAK,EAAE,iCAAiC,GAAG;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,EACpE,KAAK,EAAE,wBAAwB,GAC9B,0BAA0B,GAAG;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAOxD"}

package/dist/src/signing/contribution.js

@@ -0,0 +1,83 @@
+import { encodeValidatorContribution } from '../modules/validators/contribution.js';
+import { encodeEcdsaRecoveryValue } from '../modules/validators/ownable.js';
+export function encodePlannedValidatorContribution(input) {
+    const codec = resolvePlannedValidatorCodec(input.artifact.validatorCodec, input.stage);
+    if (codec.kind === 'none') {
+        throw new Error(`Artifact ${input.artifact.id} has no validator codec`);
+    }
+    if (input.artifact.input.kind !== 'task-results') {
+        throw new Error(`Artifact ${input.artifact.id} does not use task results`);
+    }
+    const planned = input.artifact.input.taskIds.map((taskId) => {
+        const task = input.stage.tasks.find(({ id }) => id === taskId);
+        const result = input.results[taskId];
+        if (!task || !result || !task.contribution) {
+            throw new Error(`Signing contribution ${taskId} is incomplete`);
+        }
+        return {
+            metadata: task.contribution,
+            contribution: contributionFromResult(task.contribution, result),
+        };
+    });
+    if (!input.artifact.validatorFactors) {
+        return encodeValidatorContribution(codec, planned.map(({ contribution }) => contribution));
+    }
+    const factors = input.artifact.validatorFactors.map((factor) => ({
+        kind: 'factor',
+        factorId: factor.id,
+        publicId: factor.publicId,
+        validator: factor.validator,
+        contribution: encodeValidatorContribution(factor.codec, planned.flatMap(({ metadata, contribution }) => 'factorId' in metadata && metadata.factorId === factor.id
+            ? [contribution]
+            : [])),
+    }));
+    return encodeValidatorContribution(codec, factors);
+}
+export function resolvePlannedValidatorCodec(codec, stage) {
+    if (codec.kind !== 'smart-session-state')
+        return codec;
+    const fact = stage.facts.find(({ id }) => id === codec.factId);
+    if (fact?.kind !== 'session-enabled') {
+        throw new Error(`Session-state fact ${codec.factId} is missing`);
+    }
+    return fact.enabled ? codec.whenEnabled : codec.whenDisabled;
+}
+function contributionFromResult(metadata, result) {
+    switch (metadata.kind) {
+        case 'ecdsa':
+            if (result.kind !== 'ecdsa-signature') {
+                throw new Error('ECDSA task returned an incompatible result');
+            }
+            return {
+                kind: 'ecdsa',
+                ownerId: metadata.ownerId,
+                signature: result.signature,
+                encoding: metadata.encoding,
+            };
+        case 'webauthn':
+            if (result.kind !== 'webauthn-assertion') {
+                throw new Error('WebAuthn task returned an incompatible result');
+            }
+            return {
+                kind: 'webauthn',
+                ownerId: metadata.ownerId,
+                publicKey: metadata.publicKey,
+                signature: result.signature,
+                authenticatorData: result.authenticatorData,
+                clientDataJSON: result.clientDataJSON,
+                challengeIndex: result.challengeIndex,
+                typeIndex: result.typeIndex,
+                userVerificationRequired: result.userVerificationRequired,
+            };
+        case 'session':
+            if (result.kind !== 'ecdsa-signature') {
+                throw new Error('Session task returned an incompatible result');
+            }
+            return {
+                kind: 'session',
+                signature: encodeEcdsaRecoveryValue(result.signature, metadata.recoveryEncoding),
+            };
+        case 'authorization':
+            throw new Error('Authorization results are not validator contributions');
+    }
+}

package/dist/src/signing/eip7702.d.ts

@@ -0,0 +1,41 @@
+import { type Address, type Hex, type SignedAuthorization, type TypedDataDefinition } from 'viem';
+import type { ChainReference } from '../chains/types.js';
+import type { PayloadSigningTask, SignerInvocationPort, SignerReference, SigningCheckpointPort, SigningPayloadRegistry, SigningPlan, SigningTranscript } from './types.js';
+export interface NexusEip7702InitPlanInput {
+    readonly typedData: TypedDataDefinition;
+    readonly signer: SignerReference;
+}
+export declare function createNexusEip7702InitTypedData(input: {
+    readonly contract: Address;
+    readonly initData: Hex;
+}): TypedDataDefinition;
+export declare function createNexusEip7702InitPlan(input: NexusEip7702InitPlanInput): SigningPlan;
+export declare function signNexusEip7702Init(input: {
+    readonly planInput: NexusEip7702InitPlanInput;
+    readonly signerInvoker: SignerInvocationPort;
+    readonly checkpoints: SigningCheckpointPort;
+}): Promise<{
+    readonly signature: Hex;
+    readonly transcript: SigningTranscript;
+}>;
+export interface AuthorizationListPlanInput {
+    readonly account: Address;
+    readonly contract: Address;
+    readonly chains: readonly ChainReference[];
+    readonly signer: SignerReference;
+    readonly nonceByChain: Readonly<Record<number, number>>;
+}
+export declare function createAuthorizationListPlan(input: AuthorizationListPlanInput): {
+    readonly plan: SigningPlan;
+    readonly payloads: SigningPayloadRegistry;
+};
+export declare function signAuthorizationList(input: {
+    readonly planInput: AuthorizationListPlanInput;
+    readonly signerInvoker: SignerInvocationPort;
+    readonly checkpoints: SigningCheckpointPort;
+}): Promise<{
+    readonly authorizations: readonly SignedAuthorization[];
+    readonly transcript: SigningTranscript;
+}>;
+export type { PayloadSigningTask };
+//# sourceMappingURL=eip7702.d.ts.map

package/dist/src/signing/eip7702.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"eip7702.d.ts","sourceRoot":"","sources":["../../../signing/eip7702.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,OAAO,EAEZ,KAAK,GAAG,EAGR,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACzB,MAAM,MAAM,CAAA;AACb,OAAO,KAAK,EAAE,cAAc,EAAqB,MAAM,iBAAiB,CAAA;AAExE,OAAO,KAAK,EAGV,kBAAkB,EAClB,oBAAoB,EACpB,eAAe,EACf,qBAAqB,EACrB,sBAAsB,EACtB,WAAW,EACX,iBAAiB,EAClB,MAAM,SAAS,CAAA;AAEhB,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,SAAS,EAAE,mBAAmB,CAAA;IACvC,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAA;CACjC;AAED,wBAAgB,+BAA+B,CAAC,KAAK,EAAE;IACrD,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAA;IAC1B,QAAQ,CAAC,QAAQ,EAAE,GAAG,CAAA;CACvB,GAAG,mBAAmB,CAiBtB;AAED,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,yBAAyB,GAC/B,WAAW,CAeb;AAED,wBAAsB,oBAAoB,CAAC,KAAK,EAAE;IAChD,QAAQ,CAAC,SAAS,EAAE,yBAAyB,CAAA;IAC7C,QAAQ,CAAC,aAAa,EAAE,oBAAoB,CAAA;IAC5C,QAAQ,CAAC,WAAW,EAAE,qBAAqB,CAAA;CAC5C,GAAG,OAAO,CAAC;IACV,QAAQ,CAAC,SAAS,EAAE,GAAG,CAAA;IACvB,QAAQ,CAAC,UAAU,EAAE,iBAAiB,CAAA;CACvC,CAAC,CAkBD;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAA;IAC1B,QAAQ,CAAC,MAAM,EAAE,SAAS,cAAc,EAAE,CAAA;IAC1C,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAA;IAChC,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;CACxD;AAED,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,0BAA0B,GAChC;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,sBAAsB,CAAA;CAAE,CAkF3E;AAED,wBAAsB,qBAAqB,CAAC,KAAK,EAAE;IACjD,QAAQ,CAAC,SAAS,EAAE,0BAA0B,CAAA;IAC9C,QAAQ,CAAC,aAAa,EAAE,oBAAoB,CAAA;IAC5C,QAAQ,CAAC,WAAW,EAAE,qBAAqB,CAAA;CAC5C,GAAG,OAAO,CAAC;IACV,QAAQ,CAAC,cAAc,EAAE,SAAS,mBAAmB,EAAE,CAAA;IACvD,QAAQ,CAAC,UAAU,EAAE,iBAAiB,CAAA;CACvC,CAAC,CAeD;AAiGD,YAAY,EAAE,kBAAkB,EAAE,CAAA"}

package/dist/src/signing/eip7702.js

@@ -0,0 +1,215 @@
+import { encodeAbiParameters, hashTypedData, keccak256, } from 'viem';
+import { executeSigningPlan } from './execute.js';
+export function createNexusEip7702InitTypedData(input) {
+    return {
+        domain: { name: 'Nexus', version: '1.2.0' },
+        types: {
+            Initialize: [
+                { name: 'nexus', type: 'address' },
+                { name: 'chainIds', type: 'uint256[]' },
+                { name: 'initData', type: 'bytes' },
+            ],
+        },
+        primaryType: 'Initialize',
+        message: {
+            nexus: input.contract,
+            chainIds: [0n],
+            initData: input.initData,
+        },
+    };
+}
+export function createNexusEip7702InitPlan(input) {
+    const payloadId = hashTypedData(input.typedData);
+    return directSigningPlan({
+        kind: 'nexus-eip7702-init',
+        payload: { kind: 'typed-data', id: payloadId },
+        stageId: 'nexus-eip7702-init',
+        task: {
+            id: 'nexus-eip7702-init-signer',
+            signer: input.signer,
+            role: 'owner',
+            invocationKind: 'ecdsa-sign-typed-data',
+            payload: { source: 'plan-payload', payloadId },
+        },
+        artifactId: 'nexus-eip7702-init-signature',
+    });
+}
+export async function signNexusEip7702Init(input) {
+    const plan = createNexusEip7702InitPlan(input.planInput);
+    const transcript = await executeDirectPlan({
+        plan,
+        payloads: {
+            [plan.payload.id]: {
+                kind: 'typed-data',
+                typedData: input.planInput.typedData,
+            },
+        },
+        signerInvoker: input.signerInvoker,
+        checkpoints: input.checkpoints,
+        artifactId: 'nexus-eip7702-init-signature',
+    });
+    const signature = transcript.stages[0].outputs['nexus-eip7702-init-signature'];
+    return { signature, transcript };
+}
+export function createAuthorizationListPlan(input) {
+    const chains = dedupeEvmChains(input.chains);
+    const payloadId = keccak256(encodeAbiParameters([{ type: 'address' }, { type: 'uint256[]' }], [input.contract, chains.map(({ id }) => BigInt(id))]));
+    const payloads = {};
+    const stages = chains.map((chain) => {
+        const nonce = input.nonceByChain[chain.id];
+        if (nonce === undefined) {
+            throw new Error(`Authorization nonce for chain ${chain.id} is missing`);
+        }
+        const chainPayloadId = keccak256(encodeAbiParameters([{ type: 'bytes32' }, { type: 'uint256' }], [payloadId, BigInt(chain.id)]));
+        payloads[chainPayloadId] = {
+            kind: 'authorization',
+            authorization: {
+                contractAddress: input.contract,
+                chainId: chain.id,
+                nonce,
+            },
+        };
+        const taskId = `authorization-${chain.id}`;
+        const factId = `delegation-${chain.id}`;
+        return {
+            id: `authorization-chain-${chain.id}`,
+            checkpoint: {
+                kind: 'delegation-code',
+                id: factId,
+                chain,
+                account: input.account,
+            },
+            priorOutputs: [],
+            taskTemplates: [
+                {
+                    id: taskId,
+                    signer: input.signer,
+                    role: 'authorization',
+                    chain,
+                    invocationKind: 'sign-authorization',
+                    payload: {
+                        source: 'plan-payload',
+                        payloadId: chainPayloadId,
+                    },
+                    when: {
+                        kind: 'delegation-required',
+                        factId,
+                        contract: input.contract,
+                    },
+                    contribution: { kind: 'authorization' },
+                },
+            ],
+            schedule: [
+                {
+                    id: `authorization-prompt-${chain.id}`,
+                    execution: 'serial',
+                    taskIds: [taskId],
+                },
+            ],
+            artifacts: [],
+        };
+    });
+    const plan = {
+        version: 1,
+        kind: 'eip7702-authorization-list',
+        payload: { kind: 'authorization', id: payloadId },
+        configuredTopology: emptyTopology,
+        effectiveSelection: emptySelection,
+        stages,
+        publicOutputs: stages.map((stage) => ({
+            id: `${stage.id}-result`,
+            source: { kind: 'task-result', taskId: stage.taskTemplates[0].id },
+            exposedForIndependentSigning: false,
+        })),
+    };
+    return { plan, payloads };
+}
+export async function signAuthorizationList(input) {
+    const { plan, payloads } = createAuthorizationListPlan(input.planInput);
+    const transcript = await executeSigningPlan({
+        plan,
+        payloads,
+        signerInvoker: input.signerInvoker,
+        checkpoints: input.checkpoints,
+        assembleStage: () => ({}),
+    });
+    const authorizations = transcript.stages.flatMap(({ results }) => Object.values(results).flatMap((result) => result.kind === 'signed-authorization' ? [result.authorization] : []));
+    return { authorizations, transcript };
+}
+function directSigningPlan(input) {
+    return {
+        version: 1,
+        kind: input.kind,
+        payload: input.payload,
+        configuredTopology: emptyTopology,
+        effectiveSelection: emptySelection,
+        stages: [
+            {
+                id: input.stageId,
+                checkpoint: { kind: 'none', id: `${input.stageId}-no-read` },
+                priorOutputs: [],
+                taskTemplates: [input.task],
+                schedule: [
+                    {
+                        id: `${input.stageId}-signer`,
+                        execution: 'serial',
+                        taskIds: [input.task.id],
+                    },
+                ],
+                artifacts: [
+                    {
+                        id: input.artifactId,
+                        stageId: input.stageId,
+                        usage: 'erc1271',
+                        input: { kind: 'task-results', taskIds: [input.task.id] },
+                        validatorCodec: { kind: 'none' },
+                        erc7739: { kind: 'none' },
+                        accountEnvelope: { kind: 'none' },
+                        erc6492: { kind: 'none' },
+                    },
+                ],
+            },
+        ],
+        publicOutputs: [
+            {
+                id: input.artifactId,
+                source: { kind: 'artifact', artifactId: input.artifactId },
+                exposedForIndependentSigning: false,
+            },
+        ],
+    };
+}
+async function executeDirectPlan(input) {
+    return executeSigningPlan({
+        plan: input.plan,
+        payloads: input.payloads,
+        signerInvoker: input.signerInvoker,
+        checkpoints: input.checkpoints,
+        assembleStage: ({ results }) => {
+            const result = Object.values(results)[0];
+            if (result?.kind !== 'ecdsa-signature') {
+                throw new Error('Direct signing task did not return an ECDSA signature');
+            }
+            return { [input.artifactId]: result.signature };
+        },
+    });
+}
+function dedupeEvmChains(chains) {
+    const seen = new Set();
+    return chains.flatMap((chain) => {
+        if (chain.kind !== 'evm' || seen.has(chain.id))
+            return [];
+        seen.add(chain.id);
+        return [chain];
+    });
+}
+const emptyTopology = {
+    rootValidatorId: 'none',
+    validators: [],
+    threshold: 0,
+};
+const emptySelection = {
+    validatorIds: [],
+    signerIds: [],
+    threshold: 0,
+};

package/dist/src/signing/error.d.ts

@@ -0,0 +1,27 @@
+import type { EvmChainReference } from '../chains/types.js';
+import type { SignatureUsage, SigningPayloadKind, SigningPlan, SigningPlanKind, SigningTaskRole } from './types.js';
+export type SigningFailureStage = 'plan' | 'read' | 'invoke' | 'validator-encode' | 'account-envelope' | 'protocol-operation' | 'final-assembly';
+export interface SigningErrorContext {
+    readonly planKind: SigningPlanKind;
+    readonly payloadKind: SigningPayloadKind;
+    readonly failureStage: SigningFailureStage;
+    readonly stageId?: string;
+    readonly taskId?: string;
+    readonly artifactId?: string;
+    readonly usage?: SignatureUsage;
+    readonly signerRole?: SigningTaskRole;
+    readonly chain?: EvmChainReference;
+}
+export declare class SigningPipelineError extends Error {
+    readonly context: SigningErrorContext;
+    constructor(message: string, context: SigningErrorContext, options?: ErrorOptions);
+}
+export declare function runSigningStep<Result>(input: {
+    readonly plan: SigningPlan;
+    readonly failureStage: SigningFailureStage;
+    readonly stageId: string;
+    readonly artifactId: string;
+    readonly usage: SignatureUsage;
+    readonly operation: () => Result;
+}): Result;
+//# sourceMappingURL=error.d.ts.map

package/dist/src/signing/error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"error.d.ts","sourceRoot":"","sources":["../../../signing/error.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAA;AACxD,OAAO,KAAK,EACV,cAAc,EACd,kBAAkB,EAClB,WAAW,EACX,eAAe,EACf,eAAe,EAChB,MAAM,SAAS,CAAA;AAEhB,MAAM,MAAM,mBAAmB,GAC3B,MAAM,GACN,MAAM,GACN,QAAQ,GACR,kBAAkB,GAClB,kBAAkB,GAClB,oBAAoB,GACpB,gBAAgB,CAAA;AAEpB,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAA;IAClC,QAAQ,CAAC,WAAW,EAAE,kBAAkB,CAAA;IACxC,QAAQ,CAAC,YAAY,EAAE,mBAAmB,CAAA;IAC1C,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,KAAK,CAAC,EAAE,cAAc,CAAA;IAC/B,QAAQ,CAAC,UAAU,CAAC,EAAE,eAAe,CAAA;IACrC,QAAQ,CAAC,KAAK,CAAC,EAAE,iBAAiB,CAAA;CACnC;AAED,qBAAa,oBAAqB,SAAQ,KAAK;IAC7C,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAA;gBAGnC,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,mBAAmB,EAC5B,OAAO,CAAC,EAAE,YAAY;CAMzB;AAED,wBAAgB,cAAc,CAAC,MAAM,EAAE,KAAK,EAAE;IAC5C,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;IAC1B,QAAQ,CAAC,YAAY,EAAE,mBAAmB,CAAA;IAC1C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAA;IAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,MAAM,CAAA;CACjC,GAAG,MAAM,CAkBT"}

package/dist/src/signing/error.js

@@ -0,0 +1,25 @@
+export class SigningPipelineError extends Error {
+    context;
+    constructor(message, context, options) {
+        super(message, options);
+        this.name = 'SigningPipelineError';
+        this.context = context;
+    }
+}
+export function runSigningStep(input) {
+    try {
+        return input.operation();
+    }
+    catch (cause) {
+        if (cause instanceof SigningPipelineError)
+            throw cause;
+        throw new SigningPipelineError(`Signing artifact ${input.artifactId} failed during ${input.failureStage}`, {
+            planKind: input.plan.kind,
+            payloadKind: input.plan.payload.kind,
+            failureStage: input.failureStage,
+            stageId: input.stageId,
+            artifactId: input.artifactId,
+            usage: input.usage,
+        }, { cause });
+    }
+}

package/dist/src/signing/execute.d.ts

@@ -0,0 +1,17 @@
+import type { MaterializedSigningStage, RawSignerResult, SigningArtifact, SigningCheckpointPort, SigningPayloadRegistry, SigningPlan, SigningStagePlan, SigningTranscript } from './types.js';
+export interface SigningStageAssemblyInput {
+    readonly plan: SigningPlan;
+    readonly stagePlan: SigningStagePlan;
+    readonly stage: MaterializedSigningStage;
+    readonly results: Readonly<Record<string, RawSignerResult>>;
+    readonly priorOutputs: Readonly<Record<string, SigningArtifact>>;
+}
+export type SigningStageAssembler = (input: SigningStageAssemblyInput) => Readonly<Record<string, SigningArtifact>>;
+export declare function executeSigningPlan(input: {
+    readonly plan: SigningPlan;
+    readonly payloads: SigningPayloadRegistry;
+    readonly checkpoints: SigningCheckpointPort;
+    readonly signerInvoker: import('./types.js').SignerInvocationPort;
+    readonly assembleStage: SigningStageAssembler;
+}): Promise<SigningTranscript>;
+//# sourceMappingURL=execute.d.ts.map

package/dist/src/signing/execute.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"execute.d.ts","sourceRoot":"","sources":["../../../signing/execute.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,wBAAwB,EACxB,eAAe,EACf,eAAe,EACf,qBAAqB,EACrB,sBAAsB,EACtB,WAAW,EACX,gBAAgB,EAChB,iBAAiB,EAClB,MAAM,SAAS,CAAA;AAEhB,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;IAC1B,QAAQ,CAAC,SAAS,EAAE,gBAAgB,CAAA;IACpC,QAAQ,CAAC,KAAK,EAAE,wBAAwB,CAAA;IACxC,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC,CAAA;IAC3D,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC,CAAA;CACjE;AAED,MAAM,MAAM,qBAAqB,GAAG,CAClC,KAAK,EAAE,yBAAyB,KAC7B,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC,CAAA;AAE9C,wBAAsB,kBAAkB,CAAC,KAAK,EAAE;IAC9C,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;IAC1B,QAAQ,CAAC,QAAQ,EAAE,sBAAsB,CAAA;IACzC,QAAQ,CAAC,WAAW,EAAE,qBAAqB,CAAA;IAC3C,QAAQ,CAAC,aAAa,EAAE,OAAO,SAAS,EAAE,oBAAoB,CAAA;IAC9D,QAAQ,CAAC,aAAa,EAAE,qBAAqB,CAAA;CAC9C,GAAG,OAAO,CAAC,iBAAiB,CAAC,CA+J7B"}