@rhinestone/sdk 2.0.0-beta.9 → 2.1.0

package/dist/src/signing/execute.js

@@ -0,0 +1,138 @@
+import { SigningPipelineError } from './error.js';
+import { materializeSigningStage, validateSigningPlan } from './plan.js';
+export async function executeSigningPlan(input) {
+    try {
+        validateSigningPlan(input.plan);
+    }
+    catch (cause) {
+        if (cause instanceof SigningPipelineError)
+            throw cause;
+        throw pipelineError(input.plan, 'plan', 'Signing plan validation failed', {}, cause);
+    }
+    for (const stage of input.plan.stages) {
+        for (const task of stage.taskTemplates) {
+            if (!task.when &&
+                input.signerInvoker.has &&
+                !input.signerInvoker.has(task.signer)) {
+                throw pipelineError(input.plan, 'invoke', `Missing signer ${task.signer.id}`, {
+                    stageId: stage.id,
+                    taskId: task.id,
+                    signerRole: task.role,
+                    ...(task.chain ? { chain: task.chain } : {}),
+                });
+            }
+        }
+    }
+    const priorOutputs = {};
+    const transcripts = [];
+    for (const stagePlan of input.plan.stages) {
+        let facts = [];
+        if (stagePlan.checkpoint.kind !== 'none') {
+            try {
+                facts = await input.checkpoints.read(stagePlan.checkpoint);
+            }
+            catch (cause) {
+                throw pipelineError(input.plan, 'read', `Signing checkpoint ${stagePlan.checkpoint.id} failed`, { stageId: stagePlan.id }, cause);
+            }
+        }
+        let declaredPriorOutputs;
+        let stage;
+        try {
+            declaredPriorOutputs = selectDeclaredPriorOutputs(stagePlan, priorOutputs);
+            stage = materializeSigningStage({
+                plan: input.plan,
+                stage: stagePlan,
+                payloads: input.payloads,
+                facts,
+                priorOutputs: declaredPriorOutputs,
+            });
+        }
+        catch (cause) {
+            throw pipelineError(input.plan, 'plan', `Signing stage ${stagePlan.id} materialization failed`, { stageId: stagePlan.id }, cause);
+        }
+        for (const task of stage.tasks) {
+            if (task.when &&
+                input.signerInvoker.has &&
+                !input.signerInvoker.has(task.signer)) {
+                throw pipelineError(input.plan, 'invoke', `Missing signer ${task.signer.id}`, {
+                    stageId: stage.stageId,
+                    taskId: task.id,
+                    signerRole: task.role,
+                    ...(task.chain ? { chain: task.chain } : {}),
+                });
+            }
+        }
+        const results = {};
+        const invoke = async (taskId) => {
+            const task = stage.tasks.find(({ id }) => id === taskId);
+            if (!task)
+                throw new Error(`Unknown materialized signing task ${taskId}`);
+            try {
+                results[task.id] = await input.signerInvoker.invoke(task.signer, task.invocation);
+            }
+            catch (cause) {
+                throw pipelineError(input.plan, 'invoke', `Signing task ${task.id} failed`, {
+                    stageId: stage.stageId,
+                    taskId: task.id,
+                    signerRole: task.role,
+                    ...(task.chain ? { chain: task.chain } : {}),
+                }, cause);
+            }
+        };
+        for (const batch of stage.schedule) {
+            if (batch.execution === 'parallel') {
+                await Promise.all(batch.taskIds.map(invoke));
+            }
+            else {
+                for (const taskId of batch.taskIds)
+                    await invoke(taskId);
+            }
+        }
+        let outputs;
+        try {
+            outputs = input.assembleStage({
+                plan: input.plan,
+                stagePlan,
+                stage,
+                results,
+                priorOutputs: declaredPriorOutputs,
+            });
+        }
+        catch (cause) {
+            if (cause instanceof SigningPipelineError)
+                throw cause;
+            throw pipelineError(input.plan, 'final-assembly', `Signing stage ${stage.stageId} assembly failed`, { stageId: stage.stageId }, cause);
+        }
+        for (const artifact of stagePlan.artifacts) {
+            const output = outputs[artifact.id];
+            if (output === undefined) {
+                throw pipelineError(input.plan, 'final-assembly', `Assembler omitted artifact ${artifact.id}`, { stageId: stage.stageId, artifactId: artifact.id });
+            }
+            priorOutputs[`${stage.stageId}:${artifact.id}`] = output;
+        }
+        transcripts.push({ stage, results, outputs });
+    }
+    return {
+        planKind: input.plan.kind,
+        payloadId: input.plan.payload.id,
+        stages: transcripts,
+    };
+}
+function selectDeclaredPriorOutputs(stage, outputs) {
+    return Object.fromEntries(stage.priorOutputs.map((reference) => {
+        const key = `${reference.stageId}:${reference.outputId}`;
+        const output = outputs[key];
+        if (output === undefined) {
+            throw new Error(`Declared prior output ${key} is unavailable`);
+        }
+        return [key, output];
+    }));
+}
+function pipelineError(plan, failureStage, message, context, cause) {
+    return new SigningPipelineError(message, {
+        planKind: plan.kind,
+        payloadKind: plan.payload.kind,
+        failureStage,
+        ...context,
+    }, cause === undefined ? undefined : { cause });
+}

package/dist/src/signing/intent-plans/assemble.d.ts

@@ -0,0 +1,15 @@
+import type { Hex } from 'viem';
+import type { SigningContext } from '../context.js';
+import type { SigningStageAssemblyInput } from '../execute.js';
+import type { ArtifactAssemblyPlan, SigningArtifact } from '../types.js';
+export declare function assembleIntentStage(input: SigningStageAssemblyInput, context: SigningContext): Readonly<Record<string, SigningArtifact>>;
+export declare function assembleIntentValidatorArtifact(input: {
+    readonly artifact: ArtifactAssemblyPlan;
+    readonly context: SigningContext;
+    readonly validatorContribution: Hex;
+    readonly diagnostics?: {
+        readonly plan: SigningStageAssemblyInput['plan'];
+        readonly stageId: string;
+    };
+}): Hex;
+//# sourceMappingURL=assemble.d.ts.map

package/dist/src/signing/intent-plans/assemble.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"assemble.d.ts","sourceRoot":"","sources":["../../../../signing/intent-plans/assemble.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,MAAM,CAAA;AAC/B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAGhD,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,YAAY,CAAA;AAE3D,OAAO,KAAK,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,UAAU,CAAA;AAErE,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,yBAAyB,EAChC,OAAO,EAAE,cAAc,GACtB,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC,CAsB3C;AAED,wBAAgB,+BAA+B,CAAC,KAAK,EAAE;IACrD,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,CAAA;IACvC,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAA;IAChC,QAAQ,CAAC,qBAAqB,EAAE,GAAG,CAAA;IACnC,QAAQ,CAAC,WAAW,CAAC,EAAE;QACrB,QAAQ,CAAC,IAAI,EAAE,yBAAyB,CAAC,MAAM,CAAC,CAAA;QAChD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;KACzB,CAAA;CACF,GAAG,GAAG,CAsCN"}

package/dist/src/signing/intent-plans/assemble.js

@@ -0,0 +1,96 @@
+import { encodePlannedValidatorContribution } from '../contribution.js';
+import { runSigningStep } from '../error.js';
+import { wrapErc7739TypedDataSignature } from '../protocols/erc7739.js';
+export function assembleIntentStage(input, context) {
+    const outputs = {};
+    for (const artifact of input.stagePlan.artifacts) {
+        if (artifact.input.kind === 'session-claim-pair')
+            continue;
+        outputs[artifact.id] =
+            artifact.input.kind === 'reuse-artifact'
+                ? resolveReusedArtifact(artifact.id, artifact.input, input.priorOutputs)
+                : assembleSignedArtifact(input, artifact, context);
+    }
+    for (const artifact of input.stagePlan.artifacts) {
+        if (artifact.input.kind !== 'session-claim-pair')
+            continue;
+        const preClaimSig = outputs[artifact.input.preClaimArtifactId];
+        const notarizedClaimSig = outputs[artifact.input.notarizedClaimArtifactId];
+        if (typeof preClaimSig !== 'string' ||
+            typeof notarizedClaimSig !== 'string') {
+            throw new Error(`Session claim pair ${artifact.id} is incomplete`);
+        }
+        outputs[artifact.id] = { preClaimSig, notarizedClaimSig };
+    }
+    return outputs;
+}
+export function assembleIntentValidatorArtifact(input) {
+    if (input.artifact.erc6492.kind !== 'none') {
+        throw new Error('ERC-6492 is forbidden for intent signatures');
+    }
+    const step = (failureStage, operation) => input.diagnostics
+        ? runSigningStep({
+            plan: input.diagnostics.plan,
+            failureStage,
+            stageId: input.diagnostics.stageId,
+            artifactId: input.artifact.id,
+            usage: input.artifact.usage,
+            operation,
+        })
+        : operation();
+    let contribution = input.validatorContribution;
+    const erc7739 = input.artifact.erc7739;
+    if (erc7739.kind === 'wrap-typed-data') {
+        contribution = step('protocol-operation', () => wrapErc7739TypedDataSignature({
+            typedData: erc7739.typedData,
+            signature: contribution,
+        }));
+    }
+    return input.artifact.accountEnvelope.kind === 'none'
+        ? contribution
+        : step('account-envelope', () => input.context.accountAdapter.encodeSignatureEnvelope({
+            account: input.context.account,
+            envelope: input.artifact.accountEnvelope,
+            validatorContribution: contribution,
+            purpose: 'intent',
+        }));
+}
+function assembleSignedArtifact(input, artifact, context) {
+    if (artifact.validatorCodec.kind === 'none') {
+        if (artifact.input.kind !== 'task-results' ||
+            artifact.input.taskIds.length !== 1) {
+            throw new Error(`Direct artifact ${artifact.id} requires one task`);
+        }
+        const result = input.results[artifact.input.taskIds[0]];
+        if (result?.kind !== 'ecdsa-signature') {
+            throw new Error(`Direct artifact ${artifact.id} requires an ECDSA result`);
+        }
+        return result.signature;
+    }
+    return assembleIntentValidatorArtifact({
+        artifact,
+        context,
+        validatorContribution: runSigningStep({
+            plan: input.plan,
+            failureStage: 'validator-encode',
+            stageId: input.stage.stageId,
+            artifactId: artifact.id,
+            usage: artifact.usage,
+            operation: () => encodePlannedValidatorContribution({
+                artifact,
+                stage: input.stage,
+                results: input.results,
+            }),
+        }),
+        diagnostics: { plan: input.plan, stageId: input.stage.stageId },
+    });
+}
+function resolveReusedArtifact(artifactId, route, priorOutputs) {
+    const source = priorOutputs[`${route.stageId}:${route.artifactId}`];
+    if (typeof source === 'string')
+        return source;
+    if (source && route.selection === 'pre-claim' && 'preClaimSig' in source) {
+        return source.preClaimSig;
+    }
+    throw new Error(`Reused artifact ${route.artifactId} is unavailable for ${artifactId}`);
+}

package/dist/src/signing/intent-plans/independent.d.ts

@@ -0,0 +1,48 @@
+import type { Account, Address, Hex } from 'viem';
+import type { WebAuthnAccount } from 'viem/account-abstraction';
+import type { SigningContext } from '../context.js';
+import type { ArtifactAssemblyPlan } from '../types.js';
+export interface IndependentOwnerDescriptor {
+    readonly ownerId: string;
+    readonly identity: Address | Hex;
+    readonly kind: 'ecdsa' | 'webauthn';
+    readonly factorId?: string;
+    readonly factorPublicId?: number | Hex;
+}
+export type IndependentOwnerSignatureData = {
+    readonly kind: 'ecdsa';
+    readonly signer: Address;
+    readonly origin: readonly Hex[];
+} | {
+    readonly kind: 'passkey';
+    readonly publicKey: Hex;
+    readonly origin: readonly {
+        readonly webauthn: {
+            readonly authenticatorData: Hex;
+            readonly challengeIndex?: number;
+            readonly clientDataJSON: string;
+            readonly typeIndex?: number;
+            readonly userVerificationRequired?: boolean;
+        };
+        readonly signature: Hex;
+    }[];
+};
+export type IndependentOwnerSignature = ({
+    readonly intentId: string;
+} & IndependentOwnerSignatureData) | {
+    readonly intentId: string;
+    readonly kind: 'multi-factor';
+    readonly validatorId: number | Hex;
+    readonly signature: IndependentOwnerSignatureData;
+};
+export declare function assembleIndependentIntentArtifact(input: {
+    readonly intentId: string;
+    readonly originIndex: number;
+    readonly originCount: number;
+    readonly signatures: readonly IndependentOwnerSignature[];
+    readonly owners: readonly IndependentOwnerDescriptor[];
+    readonly artifact: ArtifactAssemblyPlan;
+    readonly context: SigningContext;
+}): Hex;
+export type IndependentSigner = Account | WebAuthnAccount;
+//# sourceMappingURL=independent.d.ts.map

package/dist/src/signing/intent-plans/independent.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"independent.d.ts","sourceRoot":"","sources":["../../../../signing/intent-plans/independent.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,MAAM,CAAA;AACjD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAA;AAY/D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAChD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAA;AAGpD,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,QAAQ,EAAE,OAAO,GAAG,GAAG,CAAA;IAChC,QAAQ,CAAC,IAAI,EAAE,OAAO,GAAG,UAAU,CAAA;IACnC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,GAAG,CAAA;CACvC;AAED,MAAM,MAAM,6BAA6B,GACrC;IACE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAA;IACxB,QAAQ,CAAC,MAAM,EAAE,SAAS,GAAG,EAAE,CAAA;CAChC,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;IACxB,QAAQ,CAAC,SAAS,EAAE,GAAG,CAAA;IACvB,QAAQ,CAAC,MAAM,EAAE,SAAS;QACxB,QAAQ,CAAC,QAAQ,EAAE;YACjB,QAAQ,CAAC,iBAAiB,EAAE,GAAG,CAAA;YAC/B,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;YAChC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;YAC/B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;YAC3B,QAAQ,CAAC,wBAAwB,CAAC,EAAE,OAAO,CAAA;SAC5C,CAAA;QACD,QAAQ,CAAC,SAAS,EAAE,GAAG,CAAA;KACxB,EAAE,CAAA;CACJ,CAAA;AAEL,MAAM,MAAM,yBAAyB,GACjC,CAAC;IAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG,6BAA6B,CAAC,GAC/D;IACE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAA;IAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,GAAG,CAAA;IAClC,QAAQ,CAAC,SAAS,EAAE,6BAA6B,CAAA;CAClD,CAAA;AAEL,wBAAgB,iCAAiC,CAAC,KAAK,EAAE;IACvD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,UAAU,EAAE,SAAS,yBAAyB,EAAE,CAAA;IACzD,QAAQ,CAAC,MAAM,EAAE,SAAS,0BAA0B,EAAE,CAAA;IACtD,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,CAAA;IACvC,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAA;CACjC,GAAG,GAAG,CA2BN;AAoLD,MAAM,MAAM,iBAAiB,GAAG,OAAO,GAAG,eAAe,CAAA"}

package/dist/src/signing/intent-plans/independent.js

@@ -0,0 +1,150 @@
+import { InsufficientOwnerSignaturesError, MismatchedOwnerSignaturesError, UnknownOwnerError, } from '../../errors/execution.js';
+import { encodeValidatorContribution } from '../../modules/validators/contribution.js';
+import { encodeValidatorId } from '../../modules/validators/multi-factor.js';
+import { assembleIntentValidatorArtifact } from './assemble.js';
+export function assembleIndependentIntentArtifact(input) {
+    if (input.artifact.validatorCodec.kind === 'none') {
+        throw new Error('Independent signing requires a validator codec');
+    }
+    if (input.artifact.validatorCodec.kind === 'smart-session-state') {
+        throw new Error('Smart Session state cannot be signed independently');
+    }
+    const contributions = importOwnerContributions(input);
+    const codec = input.artifact.validatorCodec;
+    if (codec.kind === 'smart-session') {
+        throw new Error('Smart Session state cannot be signed independently');
+    }
+    const validatorContribution = input.artifact.validatorFactors
+        ? encodeIndependentFactors(codec, input.artifact.validatorFactors, contributions)
+        : encodeAtomicContributions(codec, contributions.map(({ contribution }) => contribution));
+    return assembleIntentValidatorArtifact({
+        artifact: input.artifact,
+        context: input.context,
+        validatorContribution,
+    });
+}
+function importOwnerContributions(input) {
+    const seen = new Set();
+    return input.signatures.map((value) => {
+        if (value.intentId !== input.intentId) {
+            throw new MismatchedOwnerSignaturesError({
+                context: { intentIds: [input.intentId, value.intentId] },
+            });
+        }
+        const signature = value.kind === 'multi-factor' ? value.signature : value;
+        if (signature.origin.length !== input.originCount) {
+            throw new MismatchedOwnerSignaturesError({
+                context: { expectedOriginCount: input.originCount },
+            });
+        }
+        const identity = signature.kind === 'ecdsa'
+            ? signature.signer.toLowerCase()
+            : signature.publicKey.toLowerCase();
+        const owner = input.owners.find((candidate) => candidate.identity.toLowerCase() === identity &&
+            (value.kind === 'multi-factor'
+                ? candidate.factorPublicId !== undefined &&
+                    sameValidatorId(candidate.factorPublicId, value.validatorId)
+                : candidate.factorId === undefined));
+        if (!owner) {
+            const matchingIdentity = input.owners.filter((candidate) => candidate.identity.toLowerCase() === identity);
+            if (matchingIdentity.length > 0 &&
+                (value.kind === 'multi-factor' ||
+                    matchingIdentity.some(({ factorId }) => factorId !== undefined))) {
+                throw new MismatchedOwnerSignaturesError({
+                    context: value.kind === 'multi-factor'
+                        ? { validatorId: value.validatorId }
+                        : { expectedKind: 'multi-factor' },
+                });
+            }
+            throw new UnknownOwnerError({
+                context: signature.kind === 'passkey'
+                    ? { publicKey: signature.publicKey }
+                    : { signer: signature.signer },
+            });
+        }
+        const contributionKey = `${owner.factorId ?? 'root'}:${identity}`;
+        if (seen.has(contributionKey))
+            throw new MismatchedOwnerSignaturesError({
+                context: { duplicateOwner: identity },
+            });
+        seen.add(contributionKey);
+        if ((signature.kind === 'ecdsa' && owner.kind !== 'ecdsa') ||
+            (signature.kind === 'passkey' && owner.kind !== 'webauthn')) {
+            throw new MismatchedOwnerSignaturesError({
+                context: { owner: identity },
+            });
+        }
+        const contribution = signature.kind === 'ecdsa'
+            ? {
+                kind: 'ecdsa',
+                ownerId: owner.ownerId,
+                signature: signature.origin[input.originIndex],
+                encoding: 'validator-contribution',
+            }
+            : {
+                kind: 'webauthn',
+                ownerId: owner.ownerId,
+                publicKey: signature.publicKey,
+                signature: signature.origin[input.originIndex].signature,
+                authenticatorData: signature.origin[input.originIndex].webauthn.authenticatorData,
+                clientDataJSON: signature.origin[input.originIndex].webauthn.clientDataJSON,
+                challengeIndex: signature.origin[input.originIndex].webauthn.challengeIndex ?? 0,
+                typeIndex: signature.origin[input.originIndex].webauthn.typeIndex ?? 0,
+                userVerificationRequired: signature.origin[input.originIndex].webauthn
+                    .userVerificationRequired ?? false,
+            };
+        return {
+            ...(owner.factorId ? { factorId: owner.factorId } : {}),
+            contribution,
+        };
+    });
+}
+function sameValidatorId(left, right) {
+    try {
+        return (encodeValidatorId(left).toLowerCase() ===
+            encodeValidatorId(right).toLowerCase());
+    }
+    catch {
+        return false;
+    }
+}
+function encodeIndependentFactors(codec, factors, contributions) {
+    const factorContributions = factors.flatMap((factor) => {
+        const selected = contributions.flatMap((entry) => entry.factorId === factor.id ? [entry.contribution] : []);
+        if (selected.length === 0)
+            return [];
+        if (selected.length < factor.codec.threshold) {
+            throw new InsufficientOwnerSignaturesError({
+                required: factor.codec.threshold,
+                provided: selected.length,
+                validatorId: factor.publicId,
+            });
+        }
+        return [
+            {
+                kind: 'factor',
+                factorId: factor.id,
+                publicId: factor.publicId,
+                validator: factor.validator,
+                contribution: encodeValidatorContribution(factor.codec, selected),
+            },
+        ];
+    });
+    if (factorContributions.length < codec.threshold) {
+        throw new InsufficientOwnerSignaturesError({
+            required: codec.threshold,
+            provided: factorContributions.length,
+        });
+    }
+    return encodeValidatorContribution(codec, factorContributions);
+}
+function encodeAtomicContributions(codec, contributions) {
+    if (codec.kind === 'ordered-threshold' &&
+        contributions.length < codec.threshold) {
+        throw new InsufficientOwnerSignaturesError({
+            required: codec.threshold,
+            provided: contributions.length,
+        });
+    }
+    return encodeValidatorContribution(codec, contributions);
+}

package/dist/src/signing/intent-plans/plan.d.ts

@@ -0,0 +1,14 @@
+import type { SigningContext } from '../context.js';
+import type { SigningCheckpointPort, SigningPlan, SigningTranscript } from '../types.js';
+import type { IndependentSigningProjection, IntentSigningPlanCreationInput } from './types.js';
+export declare function createIntentSigningPlan(input: IntentSigningPlanCreationInput): SigningPlan;
+export declare function projectIndependentSigning(plan: SigningPlan, signerIds: readonly string[], ownerIds?: readonly string[]): {
+    readonly plan: SigningPlan;
+    readonly projection: IndependentSigningProjection;
+};
+export declare function executeIntentSigning(input: {
+    readonly planInput: IntentSigningPlanCreationInput;
+    readonly context: SigningContext;
+    readonly checkpoints: SigningCheckpointPort;
+}): Promise<SigningTranscript>;
+//# sourceMappingURL=plan.d.ts.map

package/dist/src/signing/intent-plans/plan.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plan.d.ts","sourceRoot":"","sources":["../../../../signing/intent-plans/plan.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAEhD,OAAO,KAAK,EACV,qBAAqB,EACrB,WAAW,EACX,iBAAiB,EAClB,MAAM,UAAU,CAAA;AAEjB,OAAO,KAAK,EACV,4BAA4B,EAC5B,8BAA8B,EAC/B,MAAM,SAAS,CAAA;AAEhB,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,8BAA8B,GACpC,WAAW,CAoEb;AAED,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,WAAW,EACjB,SAAS,EAAE,SAAS,MAAM,EAAE,EAC5B,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,GAC3B;IACD,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;IAC1B,QAAQ,CAAC,UAAU,EAAE,4BAA4B,CAAA;CAClD,CA8DA;AAoFD,wBAAsB,oBAAoB,CAAC,KAAK,EAAE;IAChD,QAAQ,CAAC,SAAS,EAAE,8BAA8B,CAAA;IAClD,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAA;IAChC,QAAQ,CAAC,WAAW,EAAE,qBAAqB,CAAA;CAC5C,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAS7B"}

package/dist/src/signing/intent-plans/plan.js

@@ -0,0 +1,187 @@
+import { executeSigningPlan } from '../execute.js';
+import { assembleIntentStage } from './assemble.js';
+export function createIntentSigningPlan(input) {
+    const targetArtifact = input.intent.target
+        ? requireSingleArtifact(input.intent.artifacts.filter(({ usage, payloadId }) => usage === 'intent-target' && payloadId === input.intent.target?.id), 'target')
+        : undefined;
+    const plan = {
+        version: 1,
+        kind: 'intent-full',
+        payload: { kind: 'intent', id: input.intent.id },
+        configuredTopology: input.intent.configuredTopology,
+        effectiveSelection: input.intent.effectiveSelection,
+        preparedIntent: {
+            signatureMode: input.intent.preparedSignatureMode,
+            artifacts: input.intent.artifacts.map(({ id, usage, payloadId, cardinality, shape }) => ({
+                id,
+                usage,
+                payloadId,
+                cardinality,
+                shape,
+            })),
+            ...(input.intent.destination
+                ? {
+                    destination: input.intent.destination.mode === 'sign'
+                        ? {
+                            mode: 'sign',
+                            artifactId: input.intent.destination.artifactId,
+                            payloadId: input.intent.destination.payload.id,
+                        }
+                        : input.intent.destination,
+                }
+                : {}),
+            ...(targetArtifact
+                ? {
+                    target: {
+                        artifactId: targetArtifact.id,
+                        payloadId: targetArtifact.payloadId,
+                    },
+                }
+                : {}),
+        },
+        stages: input.stages.map((stage) => ({
+            id: stage.id,
+            checkpoint: stage.checkpoint,
+            priorOutputs: stage.priorOutputs,
+            taskTemplates: stage.tasks,
+            schedule: stage.schedule,
+            artifacts: stage.artifacts.map((artifact) => ({
+                ...artifact,
+                stageId: stage.id,
+            })),
+        })),
+        publicOutputs: input.intent.artifacts.map((artifact) => ({
+            id: artifact.id,
+            source: { kind: 'artifact', artifactId: artifact.id },
+            exposedForIndependentSigning: artifact.exposedForIndependentSigning,
+        })),
+    };
+    assertPreparedMode(input);
+    assertIntentRoutes(input, plan);
+    return plan;
+}
+export function projectIndependentSigning(plan, signerIds, ownerIds) {
+    if (plan.kind !== 'intent-full') {
+        throw new Error('Independent signing requires a full intent plan');
+    }
+    const selected = new Set(signerIds);
+    const selectedOwners = ownerIds ? new Set(ownerIds) : undefined;
+    if (selected.size !== signerIds.length) {
+        throw new Error('Independent signer selection contains duplicates');
+    }
+    for (const signerId of selected) {
+        if (!plan.effectiveSelection.signerIds.includes(signerId)) {
+            throw new Error(`Independent signer ${signerId} is not in the plan`);
+        }
+    }
+    const stages = plan.stages.map((stage) => {
+        const taskTemplates = stage.taskTemplates.filter((task) => selected.has(task.signer.id) &&
+            (!selectedOwners ||
+                [...selectedOwners].some((ownerId) => task.id.includes(ownerId))));
+        const taskIds = new Set(taskTemplates.map(({ id }) => id));
+        return {
+            ...stage,
+            priorOutputs: [],
+            taskTemplates,
+            schedule: stage.schedule
+                .map((batch) => ({
+                ...batch,
+                taskIds: batch.taskIds.filter((taskId) => taskIds.has(taskId)),
+            }))
+                .filter(({ taskIds: ids }) => ids.length > 0),
+            artifacts: [],
+        };
+    });
+    const projected = {
+        ...plan,
+        kind: 'intent-independent',
+        effectiveSelection: {
+            ...plan.effectiveSelection,
+            signerIds: plan.effectiveSelection.signerIds.filter((id) => selected.has(id)),
+        },
+        stages,
+        publicOutputs: stages.flatMap((stage) => stage.taskTemplates.map((task) => ({
+            id: `${task.id}-contribution`,
+            source: { kind: 'task-result', taskId: task.id },
+            exposedForIndependentSigning: true,
+        }))),
+    };
+    return {
+        plan: projected,
+        projection: {
+            planKind: 'intent-independent',
+            sourceIntentId: plan.payload.id,
+            exposedArtifactIds: projected.publicOutputs.map(({ id }) => id),
+            selectedSignerIds: [...signerIds],
+        },
+    };
+}
+function assertIntentRoutes(input, plan) {
+    const artifacts = plan.stages.flatMap((stage) => stage.artifacts);
+    const requirements = new Map(input.intent.artifacts.map((artifact) => [artifact.id, artifact]));
+    if (requirements.size !== input.intent.artifacts.length) {
+        throw new Error('Intent artifact requirements contain duplicate ids');
+    }
+    for (const requirement of input.intent.artifacts) {
+        if (!artifacts.some(({ id }) => id === requirement.id)) {
+            throw new Error(`Intent artifact ${requirement.id} has no assembly route`);
+        }
+    }
+    const destination = input.intent.destination;
+    if (!destination)
+        return;
+    const requirement = requirements.get(destination.artifactId);
+    if (!requirement || requirement.usage !== 'intent-destination') {
+        throw new Error('Intent destination artifact requirement is missing');
+    }
+    const route = artifacts.find(({ id }) => id === destination.artifactId);
+    if (!route)
+        throw new Error('Intent destination assembly route is missing');
+    if (destination.mode === 'sign') {
+        if (requirement.payloadId !== destination.payload.id ||
+            route.input.kind !== 'task-results') {
+            throw new Error('Intent destination signing route is incompatible');
+        }
+        return;
+    }
+    if (route.input.kind !== 'reuse-artifact' ||
+        route.input.artifactId !== destination.originArtifactId ||
+        route.input.selection !== destination.selection) {
+        throw new Error('Intent destination reuse route is incompatible');
+    }
+}
+function requireSingleArtifact(artifacts, role) {
+    if (artifacts.length !== 1) {
+        throw new Error(`Intent ${role} requires exactly one artifact`);
+    }
+    return artifacts[0];
+}
+function assertPreparedMode(input) {
+    const originArtifacts = input.intent.artifacts.filter(({ usage }) => usage === 'intent-origin' ||
+        usage === 'intent-pre-claim' ||
+        usage === 'intent-notarized-claim');
+    const expectedPerOrigin = 1;
+    const expected = input.intent.origins.length * expectedPerOrigin;
+    if (originArtifacts.length !== expected) {
+        throw new Error(`Prepared signature mode requires ${expected} origin artifacts, received ${originArtifacts.length}`);
+    }
+    const invalidShape = originArtifacts.some(({ shape }) => input.intent.preparedSignatureMode === 'default'
+        ? shape !== 'hex'
+        : !['hex', 'session-claims'].includes(shape));
+    if (invalidShape) {
+        const expectedShape = input.intent.preparedSignatureMode === 'default'
+            ? 'hex'
+            : 'hex or session-claims';
+        throw new Error(`Prepared signature mode requires ${expectedShape} origin artifacts`);
+    }
+}
+export async function executeIntentSigning(input) {
+    const plan = createIntentSigningPlan(input.planInput);
+    return executeSigningPlan({
+        plan,
+        payloads: input.planInput.payloads,
+        signerInvoker: input.context.signerInvoker,
+        checkpoints: input.checkpoints,
+        assembleStage: (stage) => assembleIntentStage(stage, input.context),
+    });
+}