@rhinestone/sdk 2.0.0-beta.9 → 2.1.0

package/dist/src/signing/intent-plans/types.d.ts

@@ -0,0 +1,63 @@
+import type { Hex, TypedDataDefinition } from 'viem';
+import type { EvmChainReference } from '../../chains/types.js';
+import type { ArtifactAssemblyPlan, ConfiguredValidatorTopology, EffectiveSignerSelection, SignatureUsage, SigningBatch, SigningPayloadRegistry, SigningReadCheckpoint, SigningTaskTemplate } from '../types.js';
+export type PreparedIntentSignatureMode = 'default' | 'session' | 'session-with-execution-verification';
+export interface IntentSigningPayload {
+    readonly id: Hex;
+    readonly chain: EvmChainReference;
+    readonly role: 'origin' | 'destination' | 'target';
+    readonly typedData: TypedDataDefinition;
+    readonly usage: SignatureUsage;
+}
+export type DestinationSigningRequirement = {
+    readonly mode: 'sign';
+    readonly payload: IntentSigningPayload;
+    readonly artifactId: string;
+} | {
+    readonly mode: 'reuse-origin';
+    readonly artifactId: string;
+    readonly originArtifactId: string;
+    readonly selection: 'whole' | 'pre-claim';
+};
+export interface IntentArtifactRequirement {
+    readonly id: string;
+    readonly usage: SignatureUsage;
+    readonly payloadId: Hex;
+    readonly cardinality: 'one' | 'per-origin';
+    readonly shape: 'hex' | 'session-claims';
+    readonly exposedForIndependentSigning: boolean;
+}
+export interface IntentSigningInput {
+    readonly id: Hex;
+    readonly preparedSignatureMode: PreparedIntentSignatureMode;
+    readonly configuredTopology: ConfiguredValidatorTopology;
+    readonly effectiveSelection: EffectiveSignerSelection;
+    readonly origins: readonly IntentSigningPayload[];
+    readonly destination?: DestinationSigningRequirement;
+    readonly target?: IntentSigningPayload;
+    readonly artifacts: readonly IntentArtifactRequirement[];
+}
+export interface IndependentSigningProjection {
+    readonly planKind: 'intent-independent';
+    readonly sourceIntentId: Hex;
+    readonly exposedArtifactIds: readonly string[];
+    readonly selectedSignerIds: readonly string[];
+}
+export interface IntentSigningStageInput {
+    readonly id: string;
+    readonly checkpoint: SigningReadCheckpoint;
+    readonly priorOutputs: readonly {
+        readonly stageId: string;
+        readonly outputId: string;
+        readonly selection: 'whole' | 'pre-claim';
+    }[];
+    readonly tasks: readonly SigningTaskTemplate[];
+    readonly schedule: readonly SigningBatch[];
+    readonly artifacts: readonly Omit<ArtifactAssemblyPlan, 'stageId'>[];
+}
+export interface IntentSigningPlanCreationInput {
+    readonly intent: IntentSigningInput;
+    readonly stages: readonly IntentSigningStageInput[];
+    readonly payloads: SigningPayloadRegistry;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/src/signing/intent-plans/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../signing/intent-plans/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,GAAG,EAAE,mBAAmB,EAAE,MAAM,MAAM,CAAA;AACpD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAA;AAC3D,OAAO,KAAK,EACV,oBAAoB,EACpB,2BAA2B,EAC3B,wBAAwB,EACxB,cAAc,EACd,YAAY,EACZ,sBAAsB,EACtB,qBAAqB,EACrB,mBAAmB,EACpB,MAAM,UAAU,CAAA;AAEjB,MAAM,MAAM,2BAA2B,GACnC,SAAS,GACT,SAAS,GACT,qCAAqC,CAAA;AAEzC,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAA;IAChB,QAAQ,CAAC,KAAK,EAAE,iBAAiB,CAAA;IACjC,QAAQ,CAAC,IAAI,EAAE,QAAQ,GAAG,aAAa,GAAG,QAAQ,CAAA;IAClD,QAAQ,CAAC,SAAS,EAAE,mBAAmB,CAAA;IACvC,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAA;CAC/B;AAED,MAAM,MAAM,6BAA6B,GACrC;IACE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,OAAO,EAAE,oBAAoB,CAAA;IACtC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAC5B,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAA;IAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;IACjC,QAAQ,CAAC,SAAS,EAAE,OAAO,GAAG,WAAW,CAAA;CAC1C,CAAA;AAEL,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAA;IAC9B,QAAQ,CAAC,SAAS,EAAE,GAAG,CAAA;IACvB,QAAQ,CAAC,WAAW,EAAE,KAAK,GAAG,YAAY,CAAA;IAC1C,QAAQ,CAAC,KAAK,EAAE,KAAK,GAAG,gBAAgB,CAAA;IACxC,QAAQ,CAAC,4BAA4B,EAAE,OAAO,CAAA;CAC/C;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAA;IAChB,QAAQ,CAAC,qBAAqB,EAAE,2BAA2B,CAAA;IAC3D,QAAQ,CAAC,kBAAkB,EAAE,2BAA2B,CAAA;IACxD,QAAQ,CAAC,kBAAkB,EAAE,wBAAwB,CAAA;IACrD,QAAQ,CAAC,OAAO,EAAE,SAAS,oBAAoB,EAAE,CAAA;IACjD,QAAQ,CAAC,WAAW,CAAC,EAAE,6BAA6B,CAAA;IACpD,QAAQ,CAAC,MAAM,CAAC,EAAE,oBAAoB,CAAA;IACtC,QAAQ,CAAC,SAAS,EAAE,SAAS,yBAAyB,EAAE,CAAA;CACzD;AAED,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,CAAA;IACvC,QAAQ,CAAC,cAAc,EAAE,GAAG,CAAA;IAC5B,QAAQ,CAAC,kBAAkB,EAAE,SAAS,MAAM,EAAE,CAAA;IAC9C,QAAQ,CAAC,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAA;CAC9C;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,UAAU,EAAE,qBAAqB,CAAA;IAC1C,QAAQ,CAAC,YAAY,EAAE,SAAS;QAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;QACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;QACzB,QAAQ,CAAC,SAAS,EAAE,OAAO,GAAG,WAAW,CAAA;KAC1C,EAAE,CAAA;IACH,QAAQ,CAAC,KAAK,EAAE,SAAS,mBAAmB,EAAE,CAAA;IAC9C,QAAQ,CAAC,QAAQ,EAAE,SAAS,YAAY,EAAE,CAAA;IAC1C,QAAQ,CAAC,SAAS,EAAE,SAAS,IAAI,CAAC,oBAAoB,EAAE,SAAS,CAAC,EAAE,CAAA;CACrE;AAED,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAA;IACnC,QAAQ,CAAC,MAAM,EAAE,SAAS,uBAAuB,EAAE,CAAA;IACnD,QAAQ,CAAC,QAAQ,EAAE,sBAAsB,CAAA;CAC1C"}

package/dist/src/signing/intent-plans/types.js

@@ -0,0 +1 @@
+export {};

package/dist/src/signing/message.d.ts

@@ -0,0 +1,28 @@
+import { type Hex, type SignableMessage } from 'viem';
+import type { EvmChainReference } from '../chains/types.js';
+import type { SigningContext } from './context.js';
+import type { ArtifactAssemblyPlan, ConfiguredValidatorTopology, EffectiveSignerSelection, PayloadSigningTask, SigningCheckpointPort, SigningPayloadMaterial, SigningPlan, SigningTranscript } from './types.js';
+export interface MessageSigningPlanInput {
+    readonly message: SignableMessage;
+    readonly signingMaterial?: Extract<SigningPayloadMaterial, {
+        readonly kind: 'message';
+    }>;
+    readonly chain: EvmChainReference;
+    readonly configuredTopology: ConfiguredValidatorTopology;
+    readonly effectiveSelection: EffectiveSignerSelection;
+    readonly tasks: readonly PayloadSigningTask[];
+    readonly route: Omit<ArtifactAssemblyPlan, 'id' | 'stageId' | 'input' | 'usage'>;
+    readonly checkpoint?: Extract<import('./types.js').SigningReadCheckpoint, {
+        readonly kind: 'account-deployment';
+    }>;
+}
+export declare function createMessageSigningPlan(input: MessageSigningPlanInput): SigningPlan;
+export declare function signAccountMessage(input: {
+    readonly planInput: MessageSigningPlanInput;
+    readonly context: SigningContext;
+    readonly checkpoints: SigningCheckpointPort;
+}): Promise<{
+    readonly signature: Hex;
+    readonly transcript: SigningTranscript;
+}>;
+//# sourceMappingURL=message.d.ts.map

package/dist/src/signing/message.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"message.d.ts","sourceRoot":"","sources":["../../../signing/message.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,GAAG,EAAe,KAAK,eAAe,EAAE,MAAM,MAAM,CAAA;AAElE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAA;AACxD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAM/C,OAAO,KAAK,EACV,oBAAoB,EACpB,2BAA2B,EAC3B,wBAAwB,EACxB,kBAAkB,EAClB,qBAAqB,EACrB,sBAAsB,EACtB,WAAW,EACX,iBAAiB,EAClB,MAAM,SAAS,CAAA;AAEhB,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAA;IACjC,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAChC,sBAAsB,EACtB;QAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;KAAE,CAC7B,CAAA;IACD,QAAQ,CAAC,KAAK,EAAE,iBAAiB,CAAA;IACjC,QAAQ,CAAC,kBAAkB,EAAE,2BAA2B,CAAA;IACxD,QAAQ,CAAC,kBAAkB,EAAE,wBAAwB,CAAA;IACrD,QAAQ,CAAC,KAAK,EAAE,SAAS,kBAAkB,EAAE,CAAA;IAC7C,QAAQ,CAAC,KAAK,EAAE,IAAI,CAClB,oBAAoB,EACpB,IAAI,GAAG,SAAS,GAAG,OAAO,GAAG,OAAO,CACrC,CAAA;IACD,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAC3B,OAAO,SAAS,EAAE,qBAAqB,EACvC;QAAE,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAA;KAAE,CACxC,CAAA;CACF;AAED,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,uBAAuB,GAC7B,WAAW,CAkBb;AAED,wBAAsB,kBAAkB,CAAC,KAAK,EAAE;IAC9C,QAAQ,CAAC,SAAS,EAAE,uBAAuB,CAAA;IAC3C,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAA;IAChC,QAAQ,CAAC,WAAW,EAAE,qBAAqB,CAAA;CAC5C,GAAG,OAAO,CAAC;IACV,QAAQ,CAAC,SAAS,EAAE,GAAG,CAAA;IACvB,QAAQ,CAAC,UAAU,EAAE,iBAAiB,CAAA;CACvC,CAAC,CAqBD"}

package/dist/src/signing/message.js

@@ -0,0 +1,90 @@
+import { hashMessage } from 'viem';
+import { EoaSigningNotSupportedError } from '../accounts/error.js';
+import { encodePlannedValidatorContribution } from './contribution.js';
+import { runSigningStep } from './error.js';
+import { executeSigningPlan } from './execute.js';
+import { createSingleStageSigningPlan } from './plan.js';
+import { wrapErc6492Signature } from './protocols/erc6492.js';
+export function createMessageSigningPlan(input) {
+    return createSingleStageSigningPlan({
+        kind: 'account-message',
+        payload: { kind: 'message', id: hashMessage(input.message) },
+        configuredTopology: input.configuredTopology,
+        effectiveSelection: input.effectiveSelection,
+        stageId: 'message',
+        ...(input.checkpoint ? { checkpoint: input.checkpoint } : {}),
+        chain: input.chain,
+        tasks: input.tasks,
+        artifacts: [
+            {
+                id: 'message-signature',
+                usage: 'erc1271',
+                ...input.route,
+            },
+        ],
+    });
+}
+export async function signAccountMessage(input) {
+    if (input.context.account.definition.kind === 'eoa') {
+        throw new EoaSigningNotSupportedError('packed signatures');
+    }
+    const plan = createMessageSigningPlan(input.planInput);
+    const transcript = await executeSigningPlan({
+        plan,
+        payloads: {
+            [plan.payload.id]: {
+                kind: 'message',
+                message: input.planInput.signingMaterial?.message ??
+                    { raw: plan.payload.id },
+            },
+        },
+        checkpoints: input.checkpoints,
+        signerInvoker: input.context.signerInvoker,
+        assembleStage: (stage) => assembleMessageStage(stage, input.context),
+    });
+    const signature = transcript.stages[0].outputs['message-signature'];
+    return { signature, transcript };
+}
+function assembleMessageStage(input, context) {
+    const artifact = input.stagePlan.artifacts[0];
+    if (!artifact)
+        throw new Error('Message plan has no artifact');
+    if (artifact.erc7739.kind !== 'none') {
+        throw new Error('ERC-7739 is not a message-signing operation');
+    }
+    const step = (failureStage, operation) => runSigningStep({
+        plan: input.plan,
+        failureStage,
+        stageId: input.stage.stageId,
+        artifactId: artifact.id,
+        usage: artifact.usage,
+        operation,
+    });
+    const contribution = step('validator-encode', () => encodePlannedValidatorContribution({
+        artifact,
+        stage: input.stage,
+        results: input.results,
+    }));
+    const accountSignature = artifact.accountEnvelope.kind === 'none'
+        ? contribution
+        : step('account-envelope', () => context.accountAdapter.encodeSignatureEnvelope({
+            account: context.account,
+            envelope: artifact.accountEnvelope,
+            validatorContribution: contribution,
+            purpose: 'erc1271',
+        }));
+    const erc6492 = artifact.erc6492;
+    if (erc6492.kind === 'none') {
+        return { [artifact.id]: accountSignature };
+    }
+    const deployed = input.stage.facts.find((fact) => fact.kind === 'account-deployed');
+    return {
+        [artifact.id]: deployed?.kind === 'account-deployed' && deployed.deployed
+            ? accountSignature
+            : step('protocol-operation', () => wrapErc6492Signature({
+                factory: erc6492.factory,
+                factoryData: erc6492.factoryData,
+                signature: accountSignature,
+            })),
+    };
+}

package/dist/src/signing/passkeys.d.ts

@@ -0,0 +1,28 @@
+import type { Address, Hex } from 'viem';
+import { type WebAuthnSignature } from '../modules/validators/webauthn.js';
+export declare function parsePublicKey(publicKey: Hex | Uint8Array): {
+    x: bigint;
+    y: bigint;
+};
+export declare function parseSignature(signature: Hex | Uint8Array): {
+    r: bigint;
+    s: bigint;
+};
+export declare function generateCredentialId(pubKeyX: bigint, pubKeyY: bigint, account: Address): `0x${string}`;
+export declare function packSignature(credIds: Hex[], usePrecompile: boolean, webAuthns: {
+    authenticatorData: Hex;
+    clientDataJSON: string;
+    challengeIndex: bigint;
+    typeIndex: bigint;
+    r: bigint;
+    s: bigint;
+}[]): Hex;
+export declare function packSignatureV0(webauthn: {
+    authenticatorData: Hex;
+    clientDataJSON: string;
+    typeIndex: number | bigint;
+    r: bigint;
+    s: bigint;
+}, usePrecompiled: boolean): `0x${string}`;
+export type { WebAuthnSignature };
+//# sourceMappingURL=passkeys.d.ts.map

package/dist/src/signing/passkeys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"passkeys.d.ts","sourceRoot":"","sources":["../../../signing/passkeys.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,MAAM,CAAA;AACxC,OAAO,EAML,KAAK,iBAAiB,EACvB,MAAM,gCAAgC,CAAA;AAEvC,wBAAgB,cAAc,CAAC,SAAS,EAAE,GAAG,GAAG,UAAU,GAAG;IAC3D,CAAC,EAAE,MAAM,CAAA;IACT,CAAC,EAAE,MAAM,CAAA;CACV,CAGA;AAED,wBAAgB,cAAc,CAAC,SAAS,EAAE,GAAG,GAAG,UAAU,GAAG;IAC3D,CAAC,EAAE,MAAM,CAAA;IACT,CAAC,EAAE,MAAM,CAAA;CACV,CAEA;AAED,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,OAAO,GACf,KAAK,MAAM,EAAE,CAEf;AAED,wBAAgB,aAAa,CAC3B,OAAO,EAAE,GAAG,EAAE,EACd,aAAa,EAAE,OAAO,EACtB,SAAS,EAAE;IACT,iBAAiB,EAAE,GAAG,CAAA;IACtB,cAAc,EAAE,MAAM,CAAA;IACtB,cAAc,EAAE,MAAM,CAAA;IACtB,SAAS,EAAE,MAAM,CAAA;IACjB,CAAC,EAAE,MAAM,CAAA;IACT,CAAC,EAAE,MAAM,CAAA;CACV,EAAE,GACF,GAAG,CAEL;AAED,wBAAgB,eAAe,CAC7B,QAAQ,EAAE;IACR,iBAAiB,EAAE,GAAG,CAAA;IACtB,cAAc,EAAE,MAAM,CAAA;IACtB,SAAS,EAAE,MAAM,GAAG,MAAM,CAAA;IAC1B,CAAC,EAAE,MAAM,CAAA;IACT,CAAC,EAAE,MAAM,CAAA;CACV,EACD,cAAc,EAAE,OAAO,GACtB,KAAK,MAAM,EAAE,CAKf;AAED,YAAY,EAAE,iBAAiB,EAAE,CAAA"}

package/dist/src/signing/passkeys.js

@@ -0,0 +1,17 @@
+import { encodeWebauthnSignatures, encodeWebauthnSignatureV0, generateWebauthnCredentialId, parseWebauthnPublicKey, parseWebauthnSignature, } from '../modules/validators/webauthn.js';
+export function parsePublicKey(publicKey) {
+    const { x, y } = parseWebauthnPublicKey(publicKey);
+    return { x, y };
+}
+export function parseSignature(signature) {
+    return parseWebauthnSignature(signature);
+}
+export function generateCredentialId(pubKeyX, pubKeyY, account) {
+    return generateWebauthnCredentialId(pubKeyX, pubKeyY, account);
+}
+export function packSignature(credIds, usePrecompile, webAuthns) {
+    return encodeWebauthnSignatures(credIds, usePrecompile, webAuthns);
+}
+export function packSignatureV0(webauthn, usePrecompiled) {
+    return encodeWebauthnSignatureV0({ ...webauthn, typeIndex: BigInt(webauthn.typeIndex) }, usePrecompiled);
+}

package/dist/src/signing/plan.d.ts

@@ -0,0 +1,35 @@
+import type { ResolvedValidatorDefinition } from '../modules/validators/types.js';
+import type { ArtifactAssemblyPlan, ConfiguredValidatorTopology, EffectiveSignerSelection, MaterializedSigningStage, PayloadSigningTask, SigningArtifact, SigningPayloadIdentity, SigningPayloadRegistry, SigningPlan, SigningPlanKind, SigningReadCheckpoint, SigningRuntimeFact, SigningStagePlan } from './types.js';
+export declare function validateSigningPlan(plan: SigningPlan): void;
+export declare function materializeSigningStage(input: {
+    readonly plan: SigningPlan;
+    readonly stage: SigningStagePlan;
+    readonly payloads: SigningPayloadRegistry;
+    readonly facts: readonly SigningRuntimeFact[];
+    readonly priorOutputs: Readonly<Record<string, SigningArtifact>>;
+}): MaterializedSigningStage;
+export declare function createSingleStageSigningPlan(input: {
+    readonly kind: SigningPlanKind;
+    readonly payload: SigningPayloadIdentity;
+    readonly configuredTopology: ConfiguredValidatorTopology;
+    readonly effectiveSelection: EffectiveSignerSelection;
+    readonly stageId: string;
+    readonly checkpoint?: SigningReadCheckpoint;
+    readonly chain?: import('../chains/types.js').EvmChainReference;
+    readonly tasks: readonly PayloadSigningTask[];
+    readonly artifacts: readonly Omit<ArtifactAssemblyPlan, 'stageId' | 'input'>[];
+}): SigningPlan;
+export declare function createValidatorSigningTasks(input: {
+    readonly validator: ResolvedValidatorDefinition;
+    readonly signerReferences: Readonly<Record<string, import('./types.js').SignerReference>>;
+    readonly taskPrefix: string;
+    readonly ecdsaInvocation: 'ecdsa-sign-message' | 'ecdsa-sign-typed-data';
+    readonly webauthnInvocation: 'webauthn-sign-hash' | 'webauthn-sign-typed-data';
+    readonly role?: import('./types.js').SigningTaskRole;
+    readonly selectedSignerIds?: readonly string[];
+}): readonly PayloadSigningTask[];
+export declare function signingTopology(validator: ResolvedValidatorDefinition, selectedSignerIds?: readonly string[]): {
+    readonly configuredTopology: ConfiguredValidatorTopology;
+    readonly effectiveSelection: EffectiveSignerSelection;
+};
+//# sourceMappingURL=plan.d.ts.map

package/dist/src/signing/plan.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plan.d.ts","sourceRoot":"","sources":["../../../signing/plan.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,6BAA6B,CAAA;AAE9E,OAAO,KAAK,EACV,oBAAoB,EACpB,2BAA2B,EAC3B,wBAAwB,EACxB,wBAAwB,EACxB,kBAAkB,EAClB,eAAe,EACf,sBAAsB,EAEtB,sBAAsB,EACtB,WAAW,EACX,eAAe,EACf,qBAAqB,EACrB,kBAAkB,EAClB,gBAAgB,EAGjB,MAAM,SAAS,CAAA;AAEhB,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,WAAW,GAAG,IAAI,CAiO3D;AAUD,wBAAgB,uBAAuB,CAAC,KAAK,EAAE;IAC7C,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;IAC1B,QAAQ,CAAC,KAAK,EAAE,gBAAgB,CAAA;IAChC,QAAQ,CAAC,QAAQ,EAAE,sBAAsB,CAAA;IACzC,QAAQ,CAAC,KAAK,EAAE,SAAS,kBAAkB,EAAE,CAAA;IAC7C,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC,CAAA;CACjE,GAAG,wBAAwB,CAmB3B;AAED,wBAAgB,4BAA4B,CAAC,KAAK,EAAE;IAClD,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAA;IAC9B,QAAQ,CAAC,OAAO,EAAE,sBAAsB,CAAA;IACxC,QAAQ,CAAC,kBAAkB,EAAE,2BAA2B,CAAA;IACxD,QAAQ,CAAC,kBAAkB,EAAE,wBAAwB,CAAA;IACrD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,UAAU,CAAC,EAAE,qBAAqB,CAAA;IAC3C,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,iBAAiB,EAAE,iBAAiB,CAAA;IAC5D,QAAQ,CAAC,KAAK,EAAE,SAAS,kBAAkB,EAAE,CAAA;IAC7C,QAAQ,CAAC,SAAS,EAAE,SAAS,IAAI,CAAC,oBAAoB,EAAE,SAAS,GAAG,OAAO,CAAC,EAAE,CAAA;CAC/E,GAAG,WAAW,CAiDd;AAED,wBAAgB,2BAA2B,CAAC,KAAK,EAAE;IACjD,QAAQ,CAAC,SAAS,EAAE,2BAA2B,CAAA;IAC/C,QAAQ,CAAC,gBAAgB,EAAE,QAAQ,CACjC,MAAM,CAAC,MAAM,EAAE,OAAO,SAAS,EAAE,eAAe,CAAC,CAClD,CAAA;IACD,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,eAAe,EAAE,oBAAoB,GAAG,uBAAuB,CAAA;IACxE,QAAQ,CAAC,kBAAkB,EAAE,oBAAoB,GAAG,0BAA0B,CAAA;IAC9E,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,SAAS,EAAE,eAAe,CAAA;IACjD,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAC/C,GAAG,SAAS,kBAAkB,EAAE,CAqDhC;AAED,wBAAgB,eAAe,CAC7B,SAAS,EAAE,2BAA2B,EACtC,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,GACpC;IACD,QAAQ,CAAC,kBAAkB,EAAE,2BAA2B,CAAA;IACxD,QAAQ,CAAC,kBAAkB,EAAE,wBAAwB,CAAA;CACtD,CA8BA"}

package/dist/src/signing/plan.js

@@ -0,0 +1,377 @@
+import { SigningPipelineError } from './error.js';
+export function validateSigningPlan(plan) {
+    const stageIds = new Set();
+    const taskIds = new Set();
+    const artifactIds = new Set();
+    const artifactStages = new Map();
+    for (const stage of plan.stages) {
+        assertUnique(stageIds, stage.id, `Duplicate signing stage ${stage.id}`);
+        const declaredPriorOutputs = new Set();
+        for (const prior of stage.priorOutputs) {
+            const key = priorOutputKey(prior);
+            assertUnique(declaredPriorOutputs, key, `Duplicate prior output ${prior.stageId}:${prior.outputId}`);
+            if (artifactStages.get(prior.outputId) !== prior.stageId) {
+                fail(plan, `Prior output ${prior.stageId}:${prior.outputId} is unavailable`, stage.id);
+            }
+        }
+        const scheduled = new Set();
+        const stageTasks = new Set();
+        for (const task of stage.taskTemplates) {
+            assertUnique(taskIds, task.id, `Duplicate signing task ${task.id}`);
+            stageTasks.add(task.id);
+            if (task.payload.source === 'prior-output' &&
+                !declaredPriorOutputs.has(priorOutputKey(task.payload))) {
+                fail(plan, `Signing task ${task.id} uses an undeclared prior output`, stage.id);
+            }
+            if (task.payload.source === 'checkpoint-fact' &&
+                (stage.checkpoint.kind === 'none' ||
+                    task.payload.checkpointId !== stage.checkpoint.id)) {
+                fail(plan, `Signing task ${task.id} uses an undeclared checkpoint`, stage.id);
+            }
+            if (task.when &&
+                (stage.checkpoint.kind !== 'delegation-code' ||
+                    task.when.factId !== stage.checkpoint.id)) {
+                fail(plan, `Signing task ${task.id} uses an undeclared delegation fact`, stage.id);
+            }
+        }
+        for (const batch of stage.schedule) {
+            for (const taskId of batch.taskIds) {
+                if (!stageTasks.has(taskId)) {
+                    fail(plan, `Schedule references unknown task ${taskId}`, stage.id);
+                }
+                assertUnique(scheduled, taskId, `Signing task ${taskId} is scheduled more than once`);
+            }
+        }
+        if (scheduled.size !== stageTasks.size) {
+            fail(plan, `Stage ${stage.id} has unscheduled signing tasks`, stage.id);
+        }
+        for (const artifact of stage.artifacts) {
+            if (artifact.stageId !== stage.id) {
+                fail(plan, `Artifact ${artifact.id} belongs to another stage`, stage.id);
+            }
+            assertUnique(artifactIds, artifact.id, `Duplicate signing artifact ${artifact.id}`);
+            artifactStages.set(artifact.id, stage.id);
+            switch (artifact.input.kind) {
+                case 'task-results':
+                    for (const taskId of artifact.input.taskIds) {
+                        if (!stageTasks.has(taskId)) {
+                            fail(plan, `Artifact ${artifact.id} references a task outside its stage`, stage.id, artifact.id);
+                        }
+                    }
+                    break;
+                case 'reuse-artifact': {
+                    const reference = {
+                        stageId: artifact.input.stageId,
+                        outputId: artifact.input.artifactId,
+                        selection: artifact.input.selection,
+                    };
+                    if (!declaredPriorOutputs.has(priorOutputKey(reference))) {
+                        fail(plan, `Artifact ${artifact.id} uses an undeclared prior output`, stage.id, artifact.id);
+                    }
+                    break;
+                }
+                case 'session-claim-pair':
+                    for (const componentId of [
+                        artifact.input.preClaimArtifactId,
+                        artifact.input.notarizedClaimArtifactId,
+                    ]) {
+                        if (componentId === artifact.id ||
+                            artifactStages.get(componentId) !== stage.id) {
+                            fail(plan, `Session claim pair ${artifact.id} references an unavailable component`, stage.id, artifact.id);
+                        }
+                    }
+                    break;
+            }
+            if (artifact.validatorCodec.kind === 'smart-session-state' &&
+                (stage.checkpoint.kind !== 'session-enabled' ||
+                    stage.checkpoint.id !== artifact.validatorCodec.factId)) {
+                fail(plan, `Artifact ${artifact.id} uses an undeclared session-state fact`, stage.id, artifact.id);
+            }
+            if (artifact.validatorCodec.kind === 'smart-session-state') {
+                const { whenEnabled, whenDisabled } = artifact.validatorCodec;
+                if (whenEnabled.validator.address.toLowerCase() !==
+                    whenDisabled.validator.address.toLowerCase() ||
+                    whenEnabled.permissionId.toLowerCase() !==
+                        whenDisabled.permissionId.toLowerCase()) {
+                    fail(plan, `Artifact ${artifact.id} changes Smart Session identity by state`, stage.id, artifact.id);
+                }
+                if (whenEnabled.mode === 'enable-and-use' ||
+                    whenDisabled.mode !== 'enable-and-use' ||
+                    !whenDisabled.enableData) {
+                    fail(plan, `Artifact ${artifact.id} has an invalid Smart Session state route`, stage.id, artifact.id);
+                }
+            }
+            else if (artifact.validatorCodec.kind === 'smart-session' &&
+                artifact.validatorCodec.mode === 'enable-and-use' &&
+                !artifact.validatorCodec.enableData) {
+                fail(plan, `Artifact ${artifact.id} has no Smart Session enable data`, stage.id, artifact.id);
+            }
+            if (artifact.erc6492.kind !== 'none' && artifact.usage !== 'erc1271') {
+                fail(plan, `ERC-6492 is not permitted for ${artifact.usage}`, stage.id, artifact.id);
+            }
+            if (plan.kind === 'account-message' && artifact.erc7739.kind !== 'none') {
+                fail(plan, 'ERC-7739 is not a message-signing operation', stage.id, artifact.id);
+            }
+        }
+    }
+    const outputIds = new Set();
+    for (const output of plan.publicOutputs) {
+        assertUnique(outputIds, output.id, `Duplicate public output ${output.id}`);
+        if (output.source.kind === 'artifact' &&
+            !artifactIds.has(output.source.artifactId)) {
+            fail(plan, `Public output references unknown artifact ${output.source.artifactId}`);
+        }
+        if (output.source.kind === 'task-result' &&
+            !taskIds.has(output.source.taskId)) {
+            fail(plan, `Public output references unknown task ${output.source.taskId}`);
+        }
+    }
+}
+function priorOutputKey(input) {
+    return `${input.stageId}:${input.outputId}:${input.selection}`;
+}
+export function materializeSigningStage(input) {
+    return {
+        stageId: input.stage.id,
+        facts: input.facts,
+        tasks: input.stage.taskTemplates
+            .filter((template) => taskIsRequired(template, input.facts))
+            .map((template) => materializeTask(template, input)),
+        schedule: input.stage.schedule
+            .map((batch) => ({
+            ...batch,
+            taskIds: batch.taskIds.filter((taskId) => {
+                const template = input.stage.taskTemplates.find(({ id }) => id === taskId);
+                return template && taskIsRequired(template, input.facts);
+            }),
+        }))
+            .filter(({ taskIds }) => taskIds.length > 0),
+    };
+}
+export function createSingleStageSigningPlan(input) {
+    const taskTemplates = input.tasks.map((task) => ({
+        ...task,
+        ...(input.chain ? { chain: input.chain } : {}),
+        payload: { source: 'plan-payload', payloadId: input.payload.id },
+    }));
+    return {
+        version: 1,
+        kind: input.kind,
+        payload: input.payload,
+        configuredTopology: input.configuredTopology,
+        effectiveSelection: input.effectiveSelection,
+        stages: [
+            {
+                id: input.stageId,
+                checkpoint: input.checkpoint ?? {
+                    kind: 'none',
+                    id: `${input.stageId}-no-read`,
+                },
+                priorOutputs: [],
+                taskTemplates,
+                schedule: taskTemplates.length === 0
+                    ? []
+                    : [
+                        {
+                            id: `${input.stageId}-signers`,
+                            execution: 'parallel',
+                            taskIds: taskTemplates.map(({ id }) => id),
+                        },
+                    ],
+                artifacts: input.artifacts.map((artifact) => ({
+                    ...artifact,
+                    stageId: input.stageId,
+                    input: {
+                        kind: 'task-results',
+                        taskIds: taskTemplates.map(({ id }) => id),
+                    },
+                })),
+            },
+        ],
+        publicOutputs: input.artifacts.map((artifact) => ({
+            id: artifact.id,
+            source: { kind: 'artifact', artifactId: artifact.id },
+            exposedForIndependentSigning: false,
+        })),
+    };
+}
+export function createValidatorSigningTasks(input) {
+    const selectedSignerIds = input.selectedSignerIds;
+    const factors = input.validator.kind === 'multi-factor'
+        ? input.validator.validators.map((validator) => ({
+            factorId: validator.id,
+            owners: validator.owners,
+        }))
+        : [{ factorId: undefined, owners: input.validator.owners }];
+    const tasks = factors.flatMap((factor) => factor.owners.flatMap((owner) => {
+        if (selectedSignerIds && !selectedSignerIds.includes(owner.signerId)) {
+            return [];
+        }
+        const signer = input.signerReferences[owner.signerId];
+        if (!signer)
+            throw new Error(`Signer reference ${owner.signerId} is missing`);
+        const webauthn = owner.kind === 'webauthn';
+        return [
+            {
+                id: `${input.taskPrefix}:${owner.id}`,
+                signer,
+                role: input.role ?? (factor.factorId ? 'factor' : 'owner'),
+                invocationKind: webauthn
+                    ? input.webauthnInvocation
+                    : input.ecdsaInvocation,
+                contribution: webauthn
+                    ? {
+                        kind: 'webauthn',
+                        ownerId: owner.id,
+                        publicKey: owner.account.publicKey,
+                        ...(factor.factorId ? { factorId: factor.factorId } : {}),
+                    }
+                    : {
+                        kind: 'ecdsa',
+                        ownerId: owner.id,
+                        encoding: 'raw-signer',
+                        ...(factor.factorId ? { factorId: factor.factorId } : {}),
+                    },
+            },
+        ];
+    }));
+    return input.validator.kind === 'multi-factor'
+        ? [...tasks].sort((left, right) => left.invocationKind.startsWith('ecdsa') ===
+            right.invocationKind.startsWith('ecdsa')
+            ? 0
+            : left.invocationKind.startsWith('ecdsa')
+                ? -1
+                : 1)
+        : tasks;
+}
+export function signingTopology(validator, selectedSignerIds) {
+    const validators = validator.kind === 'multi-factor' ? validator.validators : [validator];
+    return {
+        configuredTopology: {
+            rootValidatorId: validator.id,
+            validators: validators.map((item) => ({
+                id: item.id,
+                ownerIds: item.owners.map(({ id }) => id),
+                threshold: item.threshold,
+            })),
+            threshold: validator.threshold,
+        },
+        effectiveSelection: {
+            validatorIds: validators.flatMap((item) => selectedSignerIds &&
+                !item.owners.some(({ signerId }) => selectedSignerIds.includes(signerId))
+                ? []
+                : [item.id]),
+            signerIds: selectedSignerIds ??
+                validators.flatMap((item) => item.owners.map(({ signerId }) => signerId)),
+            threshold: validator.threshold,
+        },
+    };
+}
+function taskIsRequired(template, facts) {
+    if (!template.when)
+        return true;
+    const fact = facts.find(({ id }) => id === template.when?.factId);
+    if (fact?.kind !== 'delegation-code') {
+        throw new Error(`Delegation fact ${template.when.factId} is missing`);
+    }
+    return (fact.code?.toLowerCase() !==
+        `0xef0100${template.when.contract.slice(2)}`.toLowerCase());
+}
+function materializeTask(template, input) {
+    const material = resolvePayloadMaterial(template, input);
+    const chain = template.chain;
+    switch (template.invocationKind) {
+        case 'ecdsa-sign-message':
+            requireMaterial(template, material, 'message');
+            return {
+                ...template,
+                invocation: {
+                    kind: 'ecdsa-sign-message',
+                    ...(chain ? { chain } : {}),
+                    message: material.message,
+                },
+            };
+        case 'ecdsa-sign-typed-data':
+            requireMaterial(template, material, 'typed-data');
+            return {
+                ...template,
+                invocation: {
+                    kind: 'ecdsa-sign-typed-data',
+                    ...(chain ? { chain } : {}),
+                    typedData: material.typedData,
+                },
+            };
+        case 'webauthn-sign-hash':
+            requireMaterial(template, material, 'message');
+            return {
+                ...template,
+                invocation: { kind: 'webauthn-sign-hash', hash: material.message.raw },
+            };
+        case 'webauthn-sign-typed-data':
+            requireMaterial(template, material, 'typed-data');
+            return {
+                ...template,
+                invocation: {
+                    kind: 'webauthn-sign-typed-data',
+                    typedData: material.typedData,
+                },
+            };
+        case 'sign-authorization':
+            requireMaterial(template, material, 'authorization');
+            if (!chain)
+                throw new Error(`Authorization task ${template.id} has no chain`);
+            return {
+                ...template,
+                invocation: {
+                    kind: 'sign-authorization',
+                    chain,
+                    authorization: material.authorization,
+                },
+            };
+    }
+}
+function resolvePayloadMaterial(template, input) {
+    const reference = template.payload;
+    if (reference.source === 'plan-payload') {
+        const material = input.payloads[reference.payloadId];
+        if (!material)
+            throw new Error(`No payload material for ${reference.payloadId}`);
+        return material;
+    }
+    if (reference.source === 'prior-output') {
+        const artifact = input.priorOutputs[`${reference.stageId}:${reference.outputId}`];
+        const selected = reference.selection === 'pre-claim' &&
+            typeof artifact === 'object' &&
+            'preClaimSig' in artifact
+            ? artifact.preClaimSig
+            : artifact;
+        if (typeof selected !== 'string') {
+            throw new Error(`Prior output ${reference.outputId} is not signable bytes`);
+        }
+        return { kind: 'message', message: { raw: selected } };
+    }
+    const fact = input.facts.find(({ id }) => id === reference.factId);
+    if (fact?.kind !== 'delegation-code' || !fact.code) {
+        throw new Error(`Checkpoint fact ${reference.factId} is not signable bytes`);
+    }
+    return { kind: 'message', message: { raw: fact.code } };
+}
+function requireMaterial(template, material, kind) {
+    if (material.kind !== kind) {
+        throw new Error(`Signing task ${template.id} requires ${kind}, received ${material.kind}`);
+    }
+}
+function assertUnique(values, value, message) {
+    if (values.has(value))
+        throw new Error(message);
+    values.add(value);
+}
+function fail(plan, message, stageId, artifactId) {
+    throw new SigningPipelineError(message, {
+        planKind: plan.kind,
+        payloadKind: plan.payload.kind,
+        failureStage: 'plan',
+        ...(stageId ? { stageId } : {}),
+        ...(artifactId ? { artifactId } : {}),
+    });
+}