kawasekit 0.2.0 → 0.3.0

package/dist/index.d.cts

@@ -7,11 +7,11 @@ import { S as SupportedChainId } from './index-2fEOL83n.cjs';
 export { C as ChainNotSupportedError, g as getChain, i as isSupportedChainId, s as supportedChains } from './index-2fEOL83n.cjs';
 export { C as ConfiguredKernelClient, I as IssueSessionKeyParams, K as KAWASEKIT_SESSION_ENVELOPE_VERSION, a as KawasekitSessionEnvelope, b as KawasekitSessionEnvelopeVersion, c as KawasekitSessionPolicySummary, R as RestoreSessionAccountParams, d as RevokeSessionKeyParams, e as RevokeSessionKeyResult, f as RotateSessionKeyParams, g as RotateSessionKeyResult, S as SessionEnvelopeChainMismatchError, h as SessionEnvelopeParseError, i as SessionEnvelopeSignerMismatchError, j as SessionEnvelopeVersionError, T as TransferJpycInputError, k as TransferJpycParams, l as TransferJpycResult, m as issueSessionKey, p as parseSessionEnvelope, r as restoreSessionAccount, n as revokeSessionKey, o as rotateSessionKey, s as serializeSessionEnvelope, t as transferJpyc } from './index-DFChv_fT.cjs';
 export { CreateJpycDailyLimitPoliciesParams, ONE_DAY_SECONDS, createJpycDailyLimitPolicies } from './policy/index.cjs';
-export { C as CreateSpendingPolicyParams, P as PolicyDecision, S as SpendState, a as SpendingPolicy, b as SpendingPolicyConfigError, T as TokenLimit, c as createSpendingPolicy, e as evaluateSpendingPolicy, m as mergeSpendState } from './spending-policy-DaajDg9B.cjs';
-export { CreateLocalPolicyGatedSignerParams, PolicyGatedSignerConfigError, assertNonBypassable, createLocalPolicyGatedSigner, requireNonBypassable } from './signer/index.cjs';
-export { E as EnforcementLevel, N as NonBypassableEnforcement, P as PaymentIntent, a as PolicyGatedSigner, b as PolicyRejection, S as SignResult, c as SignerDescription } from './types-IEl-iOIx.cjs';
+export { C as CreateSpendingPolicyParams, P as PolicyDecision, S as SpendState, a as SpendingPolicy, b as SpendingPolicyConfigError, T as TokenLimit, c as createSpendingPolicy, e as evaluateSpendingPolicy, m as mergeSpendState } from './spending-policy-CGIaBpg-.cjs';
+export { CoSignConnection, CoSignFrame, CoSignRequestAuthenticator, CoSignTransport, CoSignUnavailableError, CreateLocalPolicyGatedSignerParams, Mpc2pCoSignAgent, Mpc2pSignerParams, Mpc2pStepOutcome, PolicyGatedSignerConfigError, WIRE_VERSION, WireIntent, assertNonBypassable, canonicalIntentBytes, createLocalPolicyGatedSigner, createMpc2pPolicyGatedSigner, requireNonBypassable, toWireIntent } from './signer/index.cjs';
+export { E as EnforcementLevel, N as NonBypassableEnforcement, P as PaymentIntent, a as PolicyGatedSigner, b as PolicyRejection, S as SignResult, c as SignerDescription } from './types-BLJU67HZ.cjs';
 export { C as CancelAuthorizationMessage, E as Eip3009Domain, K as KnownAssetDomain, a as KnownAssetId, R as ReceiveWithAuthorizationMessage, b as ResolvedAsset, S as SignedAuthorization, T as TransferWithAuthorizationMessage, X as X402AssetParam, c as X402TokenDomain, d as authorizationDeadlineFromNow, e as cancelAuthorizationTypes, f as deriveAuthorizationNonce, g as generateAuthorizationNonce, h as getKnownAssetDomain, l as listKnownAssetIds, r as receiveWithAuthorizationTypes, i as resolvedAssetToEip3009Domain, s as signCancelAuthorization, j as signReceiveWithAuthorization, k as signTransferWithAuthorization, t as transferWithAuthorizationTypes } from './asset-domain-4Ioxqn28.cjs';
-export { B as BuildPaymentRequiredResponseParams, a as BuildPaymentRequirementsParams, C as CreateCoinbaseFacilitatorParams, b as CreateHttpFacilitatorParams, c as CreateSelfFacilitatorParams, d as CreateX402PaymentSignerParams, K as KawaseChain, S as SignX402PaymentParams, W as WrapFetchParams, X as X402Fetch, e as X402InvalidConfigError, f as X402InvalidPayloadError, g as X402PaymentSigner, h as X402PolicyRejectedError, i as X402_DEFAULT_AUTHORIZATION_LIFETIME_SECONDS, j as X402_DEFAULT_MAX_TIMEOUT_SECONDS, k as X402_FACILITATOR_ERROR_CODES, l as X402_HEADER_IDEMPOTENCY_KEY, m as X402_HEADER_PAYMENT_REQUIRED, n as X402_HEADER_PAYMENT_RESPONSE, o as X402_HEADER_PAYMENT_SIGNATURE, p as buildPaymentRequiredResponse, q as buildPaymentRequirements, r as createCoinbaseFacilitator, s as createHttpFacilitator, t as createSelfFacilitator, u as createX402PaymentSigner, v as decodePaymentRequiredHeader, w as decodePaymentResponseHeader, x as decodePaymentSignatureHeader, y as deriveReceiptTimeoutMs, z as encodePaymentRequiredHeader, A as encodePaymentResponseHeader, D as encodePaymentSignatureHeader, E as wrapFetch, F as zerodevRpcUrl } from './index-Cn6kg7KH.cjs';
+export { B as BuildPaymentRequiredResponseParams, a as BuildPaymentRequirementsParams, C as CreateCoinbaseFacilitatorParams, b as CreateHttpFacilitatorParams, c as CreateSelfFacilitatorParams, d as CreateX402PaymentSignerParams, K as KawaseChain, S as SignX402PaymentParams, W as WrapFetchParams, X as X402Fetch, e as X402InvalidConfigError, f as X402InvalidPayloadError, g as X402PaymentSigner, h as X402PolicyRejectedError, i as X402_DEFAULT_AUTHORIZATION_LIFETIME_SECONDS, j as X402_DEFAULT_MAX_TIMEOUT_SECONDS, k as X402_FACILITATOR_ERROR_CODES, l as X402_HEADER_IDEMPOTENCY_KEY, m as X402_HEADER_PAYMENT_REQUIRED, n as X402_HEADER_PAYMENT_RESPONSE, o as X402_HEADER_PAYMENT_SIGNATURE, p as buildPaymentRequiredResponse, q as buildPaymentRequirements, r as createCoinbaseFacilitator, s as createHttpFacilitator, t as createSelfFacilitator, u as createX402PaymentSigner, v as decodePaymentRequiredHeader, w as decodePaymentResponseHeader, x as decodePaymentSignatureHeader, y as deriveReceiptTimeoutMs, z as encodePaymentRequiredHeader, A as encodePaymentResponseHeader, D as encodePaymentSignatureHeader, E as wrapFetch, F as zerodevRpcUrl } from './index-CAmTA8xR.cjs';
 export { C as CreateX402HandlerParams, I as IdempotencyServerConfig, X as X402HandlerContext, a as X402InnerHandler, b as X402RequestHandler, c as createX402Handler } from './server-ov8YstNS.cjs';
 export { F as Facilitator, X as X402AssetTransferMethod, a as X402ExactEvmAuthorization, b as X402ExactEvmExtra, c as X402ExactEvmPayload, d as X402Network, e as X402PaymentPayload, f as X402PaymentRequiredResponse, g as X402PaymentRequirements, h as X402ResourceInfo, i as X402Scheme, j as X402SettleRequest, k as X402SettleResponse, l as X402SettlementResponse, m as X402SupportedKind, n as X402SupportedResponse, o as X402VerifyRequest, p as X402VerifyResponse, q as X402Version, r as X402_VERSION, s as chainIdToX402Network, t as isX402Network, x as x402NetworkToChainId } from './types-TpS_8ztt.cjs';
 export { ClientPaymentEvent, HookCallback, ObservabilityEvent, ObservabilityEventBase, ObservabilityHooks, PaymentAcceptedEvent, PaymentRequiredEvent, SettleEvent, VerifyEvent, extractAcceptedNetworks, invokeHookSafely } from './observability/index.cjs';

package/dist/index.d.ts

@@ -7,11 +7,11 @@ import { S as SupportedChainId } from './index-2fEOL83n.js';
 export { C as ChainNotSupportedError, g as getChain, i as isSupportedChainId, s as supportedChains } from './index-2fEOL83n.js';
 export { C as ConfiguredKernelClient, I as IssueSessionKeyParams, K as KAWASEKIT_SESSION_ENVELOPE_VERSION, a as KawasekitSessionEnvelope, b as KawasekitSessionEnvelopeVersion, c as KawasekitSessionPolicySummary, R as RestoreSessionAccountParams, d as RevokeSessionKeyParams, e as RevokeSessionKeyResult, f as RotateSessionKeyParams, g as RotateSessionKeyResult, S as SessionEnvelopeChainMismatchError, h as SessionEnvelopeParseError, i as SessionEnvelopeSignerMismatchError, j as SessionEnvelopeVersionError, T as TransferJpycInputError, k as TransferJpycParams, l as TransferJpycResult, m as issueSessionKey, p as parseSessionEnvelope, r as restoreSessionAccount, n as revokeSessionKey, o as rotateSessionKey, s as serializeSessionEnvelope, t as transferJpyc } from './index-CSpNGigO.js';
 export { CreateJpycDailyLimitPoliciesParams, ONE_DAY_SECONDS, createJpycDailyLimitPolicies } from './policy/index.js';
-export { C as CreateSpendingPolicyParams, P as PolicyDecision, S as SpendState, a as SpendingPolicy, b as SpendingPolicyConfigError, T as TokenLimit, c as createSpendingPolicy, e as evaluateSpendingPolicy, m as mergeSpendState } from './spending-policy-DKZN3Sg8.js';
-export { CreateLocalPolicyGatedSignerParams, PolicyGatedSignerConfigError, assertNonBypassable, createLocalPolicyGatedSigner, requireNonBypassable } from './signer/index.js';
-export { E as EnforcementLevel, N as NonBypassableEnforcement, P as PaymentIntent, a as PolicyGatedSigner, b as PolicyRejection, S as SignResult, c as SignerDescription } from './types-IEl-iOIx.js';
+export { C as CreateSpendingPolicyParams, P as PolicyDecision, S as SpendState, a as SpendingPolicy, b as SpendingPolicyConfigError, T as TokenLimit, c as createSpendingPolicy, e as evaluateSpendingPolicy, m as mergeSpendState } from './spending-policy-BD2Mpm-L.js';
+export { CoSignConnection, CoSignFrame, CoSignRequestAuthenticator, CoSignTransport, CoSignUnavailableError, CreateLocalPolicyGatedSignerParams, Mpc2pCoSignAgent, Mpc2pSignerParams, Mpc2pStepOutcome, PolicyGatedSignerConfigError, WIRE_VERSION, WireIntent, assertNonBypassable, canonicalIntentBytes, createLocalPolicyGatedSigner, createMpc2pPolicyGatedSigner, requireNonBypassable, toWireIntent } from './signer/index.js';
+export { E as EnforcementLevel, N as NonBypassableEnforcement, P as PaymentIntent, a as PolicyGatedSigner, b as PolicyRejection, S as SignResult, c as SignerDescription } from './types-BLJU67HZ.js';
 export { C as CancelAuthorizationMessage, E as Eip3009Domain, K as KnownAssetDomain, a as KnownAssetId, R as ReceiveWithAuthorizationMessage, b as ResolvedAsset, S as SignedAuthorization, T as TransferWithAuthorizationMessage, X as X402AssetParam, c as X402TokenDomain, d as authorizationDeadlineFromNow, e as cancelAuthorizationTypes, f as deriveAuthorizationNonce, g as generateAuthorizationNonce, h as getKnownAssetDomain, l as listKnownAssetIds, r as receiveWithAuthorizationTypes, i as resolvedAssetToEip3009Domain, s as signCancelAuthorization, j as signReceiveWithAuthorization, k as signTransferWithAuthorization, t as transferWithAuthorizationTypes } from './asset-domain-4Ioxqn28.js';
-export { B as BuildPaymentRequiredResponseParams, a as BuildPaymentRequirementsParams, C as CreateCoinbaseFacilitatorParams, b as CreateHttpFacilitatorParams, c as CreateSelfFacilitatorParams, d as CreateX402PaymentSignerParams, K as KawaseChain, S as SignX402PaymentParams, W as WrapFetchParams, X as X402Fetch, e as X402InvalidConfigError, f as X402InvalidPayloadError, g as X402PaymentSigner, h as X402PolicyRejectedError, i as X402_DEFAULT_AUTHORIZATION_LIFETIME_SECONDS, j as X402_DEFAULT_MAX_TIMEOUT_SECONDS, k as X402_FACILITATOR_ERROR_CODES, l as X402_HEADER_IDEMPOTENCY_KEY, m as X402_HEADER_PAYMENT_REQUIRED, n as X402_HEADER_PAYMENT_RESPONSE, o as X402_HEADER_PAYMENT_SIGNATURE, p as buildPaymentRequiredResponse, q as buildPaymentRequirements, r as createCoinbaseFacilitator, s as createHttpFacilitator, t as createSelfFacilitator, u as createX402PaymentSigner, v as decodePaymentRequiredHeader, w as decodePaymentResponseHeader, x as decodePaymentSignatureHeader, y as deriveReceiptTimeoutMs, z as encodePaymentRequiredHeader, A as encodePaymentResponseHeader, D as encodePaymentSignatureHeader, E as wrapFetch, F as zerodevRpcUrl } from './index-f-Xg86P9.js';
+export { B as BuildPaymentRequiredResponseParams, a as BuildPaymentRequirementsParams, C as CreateCoinbaseFacilitatorParams, b as CreateHttpFacilitatorParams, c as CreateSelfFacilitatorParams, d as CreateX402PaymentSignerParams, K as KawaseChain, S as SignX402PaymentParams, W as WrapFetchParams, X as X402Fetch, e as X402InvalidConfigError, f as X402InvalidPayloadError, g as X402PaymentSigner, h as X402PolicyRejectedError, i as X402_DEFAULT_AUTHORIZATION_LIFETIME_SECONDS, j as X402_DEFAULT_MAX_TIMEOUT_SECONDS, k as X402_FACILITATOR_ERROR_CODES, l as X402_HEADER_IDEMPOTENCY_KEY, m as X402_HEADER_PAYMENT_REQUIRED, n as X402_HEADER_PAYMENT_RESPONSE, o as X402_HEADER_PAYMENT_SIGNATURE, p as buildPaymentRequiredResponse, q as buildPaymentRequirements, r as createCoinbaseFacilitator, s as createHttpFacilitator, t as createSelfFacilitator, u as createX402PaymentSigner, v as decodePaymentRequiredHeader, w as decodePaymentResponseHeader, x as decodePaymentSignatureHeader, y as deriveReceiptTimeoutMs, z as encodePaymentRequiredHeader, A as encodePaymentResponseHeader, D as encodePaymentSignatureHeader, E as wrapFetch, F as zerodevRpcUrl } from './index-C9tbaHPF.js';
 export { C as CreateX402HandlerParams, I as IdempotencyServerConfig, X as X402HandlerContext, a as X402InnerHandler, b as X402RequestHandler, c as createX402Handler } from './server-D_rZc-cW.js';
 export { F as Facilitator, X as X402AssetTransferMethod, a as X402ExactEvmAuthorization, b as X402ExactEvmExtra, c as X402ExactEvmPayload, d as X402Network, e as X402PaymentPayload, f as X402PaymentRequiredResponse, g as X402PaymentRequirements, h as X402ResourceInfo, i as X402Scheme, j as X402SettleRequest, k as X402SettleResponse, l as X402SettlementResponse, m as X402SupportedKind, n as X402SupportedResponse, o as X402VerifyRequest, p as X402VerifyResponse, q as X402Version, r as X402_VERSION, s as chainIdToX402Network, t as isX402Network, x as x402NetworkToChainId } from './types-BR9UcvJO.js';
 export { ClientPaymentEvent, HookCallback, ObservabilityEvent, ObservabilityEventBase, ObservabilityHooks, PaymentAcceptedEvent, PaymentRequiredEvent, SettleEvent, VerifyEvent, extractAcceptedNetworks, invokeHookSafely } from './observability/index.js';

package/dist/index.js

@@ -1,12 +1,12 @@
-export { TransferJpycInputError, transferJpyc } from './chunk-XRSZTZVZ.js';
-export { X402_DEFAULT_AUTHORIZATION_LIFETIME_SECONDS, X402_FACILITATOR_ERROR_CODES, createCoinbaseFacilitator, createHttpFacilitator, createSelfFacilitator, createX402PaymentSigner, deriveReceiptTimeoutMs, wrapFetch } from './chunk-SMAZUZFO.js';
+export { TransferJpycInputError, transferJpyc } from './chunk-RJLDKDWL.js';
+export { X402_DEFAULT_AUTHORIZATION_LIFETIME_SECONDS, X402_FACILITATOR_ERROR_CODES, createCoinbaseFacilitator, createHttpFacilitator, createSelfFacilitator, createX402PaymentSigner, deriveReceiptTimeoutMs, wrapFetch } from './chunk-G3UC6SME.js';
 export { X402_DEFAULT_MAX_TIMEOUT_SECONDS, X402_HEADER_IDEMPOTENCY_KEY, X402_HEADER_PAYMENT_REQUIRED, X402_HEADER_PAYMENT_RESPONSE, X402_HEADER_PAYMENT_SIGNATURE, buildPaymentRequiredResponse, buildPaymentRequirements, createX402Handler, decodePaymentRequiredHeader, decodePaymentResponseHeader, decodePaymentSignatureHeader, encodePaymentRequiredHeader, encodePaymentResponseHeader, encodePaymentSignatureHeader } from './chunk-PVUKX6IF.js';
 export { extractAcceptedNetworks, invokeHookSafely } from './chunk-LEHWRDVS.js';
 export { createIdempotencyKeyBuilder, createInMemoryIdempotencyStore, deriveIdempotencyKey, normalizeIntentText } from './chunk-TTX3RBIZ.js';
 export { IdempotencyConfigError, IdempotencyRecordParseError, IdempotencyRecordVersionError, KAWASEKIT_IDEMPOTENCY_RECORD_VERSION, X402_VERSION, chainIdToX402Network, isX402Network, parseIdempotencyRecord, serializeIdempotencyRecord, x402NetworkToChainId } from './chunk-QHUCU5YX.js';
 export { KAWASEKIT_SESSION_ENVELOPE_VERSION, SessionEnvelopeChainMismatchError, SessionEnvelopeParseError, SessionEnvelopeSignerMismatchError, SessionEnvelopeVersionError, createAgentSmartAccount, issueSessionKey, parseSessionEnvelope, restoreSessionAccount, revokeSessionKey, rotateSessionKey, serializeSessionEnvelope } from './chunk-N3CVLISJ.js';
-export { createLocalPolicyGatedSigner } from './chunk-THTVJZ2Q.js';
-export { PolicyGatedSignerConfigError, assertNonBypassable, authorizationDeadlineFromNow, cancelAuthorizationTypes, deriveAuthorizationNonce, generateAuthorizationNonce, getKnownAssetDomain, listKnownAssetIds, receiveWithAuthorizationTypes, requireNonBypassable, resolvedAssetToEip3009Domain, signCancelAuthorization, signReceiveWithAuthorization, signTransferWithAuthorization, transferWithAuthorizationTypes } from './chunk-VXZHS74W.js';
+export { WIRE_VERSION, canonicalIntentBytes, createLocalPolicyGatedSigner, createMpc2pPolicyGatedSigner, toWireIntent } from './chunk-EUW7AZ4P.js';
+export { CoSignUnavailableError, PolicyGatedSignerConfigError, assertNonBypassable, authorizationDeadlineFromNow, cancelAuthorizationTypes, deriveAuthorizationNonce, generateAuthorizationNonce, getKnownAssetDomain, listKnownAssetIds, receiveWithAuthorizationTypes, requireNonBypassable, resolvedAssetToEip3009Domain, signCancelAuthorization, signReceiveWithAuthorization, signTransferWithAuthorization, transferWithAuthorizationTypes } from './chunk-5TTOAVHE.js';
 export { X402InvalidConfigError, X402InvalidPayloadError, X402PolicyRejectedError } from './chunk-WMVJNPX2.js';
 export { ONE_DAY_SECONDS, createJpycDailyLimitPolicies } from './chunk-E47SIVFY.js';
 export { SpendingPolicyConfigError, createSpendingPolicy, evaluateSpendingPolicy, mergeSpendState } from './chunk-6CNAYQOL.js';

package/dist/policy/index.d.cts

@@ -1,8 +1,8 @@
 import { Policy } from '@zerodev/permissions';
 import { CallPolicyVersion } from '@zerodev/permissions/policies';
 import { Address } from 'viem';
-export { C as CreateSpendingPolicyParams, P as PolicyDecision, S as SpendState, a as SpendingPolicy, b as SpendingPolicyConfigError, T as TokenLimit, c as createSpendingPolicy, e as evaluateSpendingPolicy, m as mergeSpendState } from '../spending-policy-DaajDg9B.cjs';
-import '../types-IEl-iOIx.cjs';
+export { C as CreateSpendingPolicyParams, P as PolicyDecision, S as SpendState, a as SpendingPolicy, b as SpendingPolicyConfigError, T as TokenLimit, c as createSpendingPolicy, e as evaluateSpendingPolicy, m as mergeSpendState } from '../spending-policy-CGIaBpg-.cjs';
+import '../types-BLJU67HZ.cjs';
 
 /**
  * Daily-limit spending policy for JPYC, built on ZeroDev's Permission System.

package/dist/policy/index.d.ts

@@ -1,8 +1,8 @@
 import { Policy } from '@zerodev/permissions';
 import { CallPolicyVersion } from '@zerodev/permissions/policies';
 import { Address } from 'viem';
-export { C as CreateSpendingPolicyParams, P as PolicyDecision, S as SpendState, a as SpendingPolicy, b as SpendingPolicyConfigError, T as TokenLimit, c as createSpendingPolicy, e as evaluateSpendingPolicy, m as mergeSpendState } from '../spending-policy-DKZN3Sg8.js';
-import '../types-IEl-iOIx.js';
+export { C as CreateSpendingPolicyParams, P as PolicyDecision, S as SpendState, a as SpendingPolicy, b as SpendingPolicyConfigError, T as TokenLimit, c as createSpendingPolicy, e as evaluateSpendingPolicy, m as mergeSpendState } from '../spending-policy-BD2Mpm-L.js';
+import '../types-BLJU67HZ.js';
 
 /**
  * Daily-limit spending policy for JPYC, built on ZeroDev's Permission System.

package/dist/signer/index.cjs

@@ -16,6 +16,12 @@ var PolicyGatedSignerConfigError = class extends Error {
     this.reason = reason;
   }
 };
+var CoSignUnavailableError = class extends Error {
+  constructor(message, options) {
+    super(message, options);
+    this.name = "CoSignUnavailableError";
+  }
+};
 
 // src/signer/gate.ts
 function requireNonBypassable(signer) {
@@ -355,9 +361,221 @@ function createLocalPolicyGatedSigner(params) {
   };
 }
 
+// src/signer/mpc-2p-wire.ts
+var WIRE_VERSION = 1;
+function toWireIntent(intent) {
+  return {
+    token: intent.token.toLowerCase(),
+    chain_id: intent.chainId,
+    from: intent.from.toLowerCase(),
+    to: intent.to.toLowerCase(),
+    value: intent.value.toString(),
+    valid_after: intent.validAfter.toString(),
+    valid_before: intent.validBefore.toString(),
+    nonce: intent.nonce.toLowerCase()
+  };
+}
+function canonicalIntentBytes(intent) {
+  const lines = [
+    "kawasekit-mpc-2p/cosign-request/v2",
+    `token=${intent.token.toLowerCase()}`,
+    `chainId=${intent.chainId}`,
+    `from=${intent.from.toLowerCase()}`,
+    `to=${intent.to.toLowerCase()}`,
+    `value=${intent.value}`,
+    `validAfter=${intent.validAfter}`,
+    `validBefore=${intent.validBefore}`,
+    `nonce=${intent.nonce.toLowerCase()}`
+  ];
+  return new TextEncoder().encode(lines.map((l) => `${l}
+`).join(""));
+}
+
+// src/signer/mpc-2p.ts
+var POLICY_REASONS = /* @__PURE__ */ new Set([
+  "revoked",
+  "expired",
+  "token_not_allowed",
+  "recipient_not_allowed",
+  "amount_exceeds_per_sign",
+  "amount_exceeds_cumulative",
+  "intent_digest_mismatch",
+  "unauthenticated",
+  "from_mismatch",
+  "nonce_reuse_conflict"
+]);
+function rejection(reason, detail) {
+  return { ok: false, rejection: { reason, detail } };
+}
+function createMpc2pPolicyGatedSigner(params) {
+  const { agent, transport, authenticator, session } = params;
+  const pinned = resolveAssetParam(params.asset);
+  const from = viem.getAddress(params.from);
+  const agentEoa = viem.getAddress(agent.groupEoa());
+  if (agentEoa !== from) {
+    throw new PolicyGatedSignerConfigError(
+      "from",
+      `the agent share controls ${agentEoa} but params.from is ${from}`
+    );
+  }
+  return {
+    enforcement: "cryptographic",
+    from,
+    async sign(intent) {
+      if (viem.getAddress(intent.from) !== from) {
+        return rejection(
+          "from_mismatch",
+          `intent.from ${viem.getAddress(intent.from)} does not equal signer.from ${from}`
+        );
+      }
+      if (viem.getAddress(intent.token) !== pinned.verifyingContract) {
+        return rejection(
+          "token_not_allowed",
+          `intent.token ${viem.getAddress(intent.token)} does not equal the signer's pinned verifyingContract ${pinned.verifyingContract}`
+        );
+      }
+      const digest = viem.hashTypedData({
+        domain: resolvedAssetToEip3009Domain(pinned, intent.chainId),
+        types: transferWithAuthorizationTypes,
+        primaryType: "TransferWithAuthorization",
+        message: {
+          from,
+          to: intent.to,
+          value: intent.value,
+          validAfter: intent.validAfter,
+          validBefore: intent.validBefore,
+          nonce: intent.nonce
+        }
+      });
+      const authTag = await authenticator.tag(canonicalIntentBytes(intent));
+      const conn = await openConnection(transport);
+      try {
+        return await runCeremony(conn, agent, session.id, intent, digest, authTag);
+      } finally {
+        try {
+          await conn.close();
+        } catch {
+        }
+      }
+    },
+    describe() {
+      return {
+        enforcement: "cryptographic",
+        from,
+        policyId: session.id,
+        notAfter: session.notAfter,
+        // The backend owns authoritative revocation (a revoked session → a
+        // rejection at sign time); this metadata field is best-effort.
+        revoked: false
+      };
+    }
+  };
+}
+async function openConnection(transport) {
+  try {
+    return await transport.connect();
+  } catch (cause) {
+    throw new CoSignUnavailableError("co-signer connection failed", { cause });
+  }
+}
+async function runCeremony(conn, agent, sessionId, intent, digest, authTag) {
+  const send = async (frame) => {
+    try {
+      await conn.send(frame);
+    } catch (cause) {
+      throw new CoSignUnavailableError("co-sign connection dropped while sending", { cause });
+    }
+  };
+  const recv = async () => {
+    let frame;
+    try {
+      frame = await conn.recv();
+    } catch (cause) {
+      throw new CoSignUnavailableError("co-sign connection dropped mid-ceremony", { cause });
+    }
+    if (frame.wire_version !== WIRE_VERSION) {
+      throw new CoSignUnavailableError(
+        `co-signer spoke wire_version ${frame.wire_version}, expected ${WIRE_VERSION}`
+      );
+    }
+    return frame;
+  };
+  await send({
+    wire_version: WIRE_VERSION,
+    kind: "request",
+    session_id: sessionId,
+    intent: toWireIntent(intent),
+    auth_tag: authTag
+  });
+  let first;
+  try {
+    first = agent.start(digest);
+  } catch (cause) {
+    throw new CoSignUnavailableError("the agent failed to start the ceremony", { cause });
+  }
+  await send({ wire_version: WIRE_VERSION, kind: "round", payload: first });
+  let agentSig = null;
+  for (; ; ) {
+    const frame = await recv();
+    switch (frame.kind) {
+      case "round": {
+        let step;
+        try {
+          step = agent.step(frame.payload);
+        } catch (cause) {
+          throw new CoSignUnavailableError("the agent rejected a round frame", { cause });
+        }
+        if ("outbound" in step) {
+          await send({ wire_version: WIRE_VERSION, kind: "round", payload: step.outbound });
+        } else {
+          agentSig = step.signature;
+        }
+        break;
+      }
+      case "result": {
+        if (agentSig === null) {
+          throw new CoSignUnavailableError(
+            "the backend returned a result before the agent derived a signature"
+          );
+        }
+        if (frame.r.toLowerCase() !== agentSig.r.toLowerCase() || frame.s.toLowerCase() !== agentSig.s.toLowerCase() || frame.v !== agentSig.v) {
+          throw new CoSignUnavailableError("the backend and agent derived different signatures");
+        }
+        return { ok: true, signature: assembleSignature(agentSig), intent };
+      }
+      case "rejection": {
+        if (POLICY_REASONS.has(frame.reason)) {
+          return rejection(frame.reason, frame.detail);
+        }
+        throw new CoSignUnavailableError(
+          `co-signer returned a non-policy rejection (${frame.reason}): ${frame.detail}`
+        );
+      }
+      case "error": {
+        throw new CoSignUnavailableError(`co-signer error: ${frame.message}`);
+      }
+      default: {
+        throw new CoSignUnavailableError("co-signer sent an unexpected frame");
+      }
+    }
+  }
+}
+function assembleSignature(sig) {
+  const yParity = sig.v - 27;
+  if (yParity !== 0 && yParity !== 1) {
+    throw new CoSignUnavailableError(`malformed recovery id v=${sig.v} (expected 27 or 28)`);
+  }
+  return viem.serializeSignature({ r: sig.r, s: sig.s, yParity });
+}
+
+exports.CoSignUnavailableError = CoSignUnavailableError;
 exports.PolicyGatedSignerConfigError = PolicyGatedSignerConfigError;
+exports.WIRE_VERSION = WIRE_VERSION;
 exports.assertNonBypassable = assertNonBypassable;
+exports.canonicalIntentBytes = canonicalIntentBytes;
 exports.createLocalPolicyGatedSigner = createLocalPolicyGatedSigner;
+exports.createMpc2pPolicyGatedSigner = createMpc2pPolicyGatedSigner;
 exports.requireNonBypassable = requireNonBypassable;
+exports.toWireIntent = toWireIntent;
 //# sourceMappingURL=index.cjs.map
 //# sourceMappingURL=index.cjs.map