kawasekit 0.2.0 → 0.4.0

package/dist/signer/index.d.cts

@@ -1,7 +1,7 @@
-import { a as PolicyGatedSigner, N as NonBypassableEnforcement } from '../types-IEl-iOIx.cjs';
-export { E as EnforcementLevel, P as PaymentIntent, b as PolicyRejection, S as SignResult, c as SignerDescription } from '../types-IEl-iOIx.cjs';
-import { Account } from 'viem';
-import { a as SpendingPolicy, S as SpendState } from '../spending-policy-DaajDg9B.cjs';
+import { a as PolicyGatedSigner, N as NonBypassableEnforcement, P as PaymentIntent } from '../types-BLJU67HZ.cjs';
+export { E as EnforcementLevel, b as PolicyRejection, S as SignResult, c as SignerDescription } from '../types-BLJU67HZ.cjs';
+import { Account, Hex, Address } from 'viem';
+import { a as SpendingPolicy, S as SpendState } from '../spending-policy-CGIaBpg-.cjs';
 import { X as X402AssetParam } from '../asset-domain-4Ioxqn28.cjs';
 
 /**
@@ -39,6 +39,36 @@ declare class PolicyGatedSignerConfigError extends Error {
         cause?: unknown;
     });
 }
+/**
+ * Thrown by the `mpc-2p` cryptographic adapter when the co-signer is
+ * **unreachable or the ceremony could not complete** — endpoint down, TLS
+ * failure, connection dropped mid-ceremony, timeout, a malformed/missing
+ * terminal frame, or an internal protocol anomaly. It is a transient / internal
+ * error on the throws channel (M6-0: throws are reserved for internal/config
+ * errors), **distinct from a policy denial**.
+ *
+ * This is the **no-silent-fallback** guarantee (RFC m6-3a constraint 3 / W8):
+ * the adapter has no local-signing path, so an unavailable wire NEVER yields an
+ * `{ ok: true }` signature and NEVER a {@link PolicyRejection}. A `rejection`
+ * means "the owner decided no" (audit-meaningful); a `CoSignUnavailableError`
+ * means "the owner did not decide" — the caller may retry the *same* intent
+ * (the backend's idempotency keeps a retry safe).
+ *
+ * @example
+ * ```ts
+ * try {
+ *   const result = await mpc2pSigner.sign(intent);
+ *   if (!result.ok) handleDenial(result.rejection); // owner said no
+ * } catch (error) {
+ *   if (error instanceof CoSignUnavailableError) retryLater(); // wire was down
+ * }
+ * ```
+ */
+declare class CoSignUnavailableError extends Error {
+    constructor(message: string, options?: {
+        cause?: unknown;
+    });
+}
 
 /**
  * The enforcement-level type-gate — the compile-time (and runtime) mechanism
@@ -128,4 +158,209 @@ interface CreateLocalPolicyGatedSignerParams {
  */
 declare function createLocalPolicyGatedSigner(params: CreateLocalPolicyGatedSignerParams): PolicyGatedSigner<"advisory">;
 
-export { type CreateLocalPolicyGatedSignerParams, NonBypassableEnforcement, PolicyGatedSigner, PolicyGatedSignerConfigError, assertNonBypassable, createLocalPolicyGatedSigner, requireNonBypassable };
+/**
+ * The `mpc-2p` cross-process **wire** (v2) — the versioned `CoSignFrame` control
+ * envelope + the A3 canonical-request encoding, as TypeScript source-of-truth.
+ *
+ * This is the public, TS-interpreted half of the two-layer wire (RFC m6-3a §4.2):
+ * a small, versioned envelope carries the decoded {@link PaymentIntent} (never a
+ * digest — A4) + a per-ceremony id + ssid + a freshness element, plus the opaque
+ * DKLs round payloads (hex, produced/consumed only by the WASM crypto agent). The
+ * shapes here mirror the deployed `kawasekit-mpc-2p` Rust serde **byte-for-byte**
+ * (snake_case `wire_version`, `session_id`, `ceremony_id`, `ssid`, `freshness_ts`,
+ * `freshness_nonce`, `auth_tag`; the string-encoded {@link WireIntent}), so a frame
+ * the SDK builds round-trips through the backend's `serde_json`.
+ *
+ * `canonicalRequestBytes` is the A3 analog of the EIP-712 digest corpus: it
+ * reproduces the backend's `auth::canonical_request_bytes` exactly, so the injected
+ * authenticator's HMAC equals what the co-signer verifies (RFC §4.6:
+ * `HMAC_k(wireVersion ‖ ceremonyId ‖ ssid ‖ canonical(intent) ‖ freshness)`).
+ *
+ * @packageDocumentation
+ */
+
+/** The wire protocol version. A frame whose `wire_version` differs is rejected. */
+declare const WIRE_VERSION: 2;
+/**
+ * The string-encoded EIP-3009 intent as it crosses the wire — lowercase `0x`
+ * addresses, **decimal** integer strings, `0x` hex nonce. Decoupled from any
+ * library's native serde so a stdlib client reproduces it trivially; matches the
+ * Rust `WireIntent` field names + encoding exactly.
+ */
+interface WireIntent {
+    readonly token: string;
+    readonly chain_id: number;
+    readonly from: string;
+    readonly to: string;
+    readonly value: string;
+    readonly valid_after: string;
+    readonly valid_before: string;
+    readonly nonce: string;
+}
+/** Encode a decoded {@link PaymentIntent} for the wire. */
+declare function toWireIntent(intent: PaymentIntent): WireIntent;
+/**
+ * The A3 request envelope the adapter generates per `sign()` and authenticates: a
+ * per-ceremony id + ssid (bound into the A3 tag) + the intent + a freshness element
+ * (a timestamp + a per-request nonce distinct from the EIP-3009 nonce).
+ */
+interface CoSignRequestEnvelope {
+    readonly ceremonyId: string;
+    readonly ssid: string;
+    readonly intent: PaymentIntent;
+    /** Unix seconds; the backend checks it against a clock-skew window. */
+    readonly freshnessTs: number;
+    /** `0x` hex, distinct from the EIP-3009 nonce — the anti-replay key. */
+    readonly freshnessNonce: Hex;
+}
+/**
+ * A versioned control frame: the only cross-language content of the wire. The
+ * DKLs round bytes ride opaque inside `payload`; everything else is the small,
+ * pinned envelope. Internally tagged by `kind` (matches the Rust serde).
+ */
+type CoSignFrame = {
+    readonly wire_version: typeof WIRE_VERSION;
+} & ({
+    readonly kind: "request";
+    readonly session_id: string;
+    readonly ceremony_id: string;
+    readonly ssid: string;
+    readonly intent: WireIntent;
+    readonly freshness_ts: number;
+    readonly freshness_nonce: Hex;
+    /** A3 authenticator over {@link canonicalRequestBytes}, `0x`-hex. */
+    readonly auth_tag: Hex;
+} | {
+    readonly kind: "round";
+    readonly payload: Hex;
+} | {
+    readonly kind: "result";
+    readonly r: Hex;
+    readonly s: Hex;
+    readonly v: number;
+} | {
+    readonly kind: "rejection";
+    readonly reason: string;
+    readonly detail: string;
+} | {
+    readonly kind: "error";
+    readonly message: string;
+});
+/**
+ * The A3 canonical encoding of a request — a byte-exact mirror of the backend's
+ * `auth::canonical_request_bytes` (domain-tag `kawasekit-mpc-2p/cosign-request/v3`,
+ * one `key=value\n` line per field: `wireVersion ‖ ceremonyId ‖ ssid ‖
+ * canonical(intent) ‖ freshness`; lowercase `0x` addresses + freshness nonce,
+ * decimal integers, trailing newline). The injected authenticator HMACs these
+ * bytes; because the encoding is shared, the tag equals the co-signer's.
+ */
+declare function canonicalRequestBytes(env: CoSignRequestEnvelope): Uint8Array;
+
+/**
+ * The `mpc-2p` PolicyGatedSigner adapter — `enforcement: "cryptographic"`.
+ *
+ * A 2-of-2 MPC co-signer: the agent holds ONE DKLs share, the owner backend holds
+ * the other + the authoritative policy gate. No valid signature exists without a
+ * **policy-passing co-sign**, so — unlike `local` — a single key-holder cannot
+ * bypass the policy. That is what earns the non-bypassable `"cryptographic"` label
+ * and lets the M6-0 type-gate (`requireNonBypassable`) reject an advisory signer at
+ * compile time in bounded flows.
+ *
+ * **Open-core / thin adapter.** This module is pure orchestration over injected
+ * interfaces — it ships in the public SDK with **no crypto, no socket, no key**:
+ *
+ * - {@link Mpc2pCoSignAgent} — the WASM DKLs share (the private package's compiled
+ *   `crypto-core`); drives the agent's half of the ceremony round-by-round.
+ * - {@link CoSignTransport} — the authenticated, encrypted (wss/mTLS) frame channel
+ *   to the owner backend (the private package's transport).
+ * - {@link CoSignRequestAuthenticator} — the A3 HMAC (the pre-shared key never
+ *   enters this module).
+ *
+ * The adapter owns the protocol: it pins the EIP-712 domain, **re-derives the
+ * digest from the intent (A4)** via the shared `transferWithAuthorizationTypes`
+ * source-of-truth, computes the A3 canonical bytes, frames the versioned
+ * {@link CoSignFrame} envelope, pumps the ceremony, and maps the terminal frame to
+ * a {@link SignResult}. Crucially it has **no local-signing path**: any
+ * transport/availability failure throws {@link CoSignUnavailableError}, never an
+ * `{ ok: true }` and never a {@link PolicyRejection} (the no-silent-fallback
+ * guarantee, RFC m6-3a constraint 3 / W8).
+ *
+ * @packageDocumentation
+ */
+
+/** The agent's half of the 2-of-2 ceremony (the injected WASM DKLs share). */
+interface Mpc2pCoSignAgent {
+    /** The group 2-of-2 EOA this share controls — must equal the signer's `from`. */
+    groupEoa(): Address;
+    /** Begin signing the 32-byte EIP-712 `digest`; returns the first outbound round (hex). */
+    start(digest: Hex): Hex;
+    /** Feed one inbound round (hex); returns the next outbound round, or the final signature. */
+    step(incoming: Hex): Mpc2pStepOutcome;
+}
+/** The result of one {@link Mpc2pCoSignAgent.step}. */
+type Mpc2pStepOutcome = {
+    readonly outbound: Hex;
+} | {
+    readonly signature: {
+        readonly r: Hex;
+        readonly s: Hex;
+        readonly v: number;
+    };
+};
+/** One authenticated, encrypted ceremony connection to the owner backend. */
+interface CoSignConnection {
+    /** Send one control frame. */
+    send(frame: CoSignFrame): Promise<void>;
+    /** Receive the next control frame (resolves per round). */
+    recv(): Promise<CoSignFrame>;
+    /** Release the connection (best-effort; errors here are ignored). */
+    close(): void | Promise<void>;
+}
+/** Opens a wss/mTLS {@link CoSignConnection} for a single co-sign ceremony. */
+interface CoSignTransport {
+    connect(): Promise<CoSignConnection>;
+}
+/** The A3 request authenticator — HMAC (or signature) over the canonical request bytes. */
+interface CoSignRequestAuthenticator {
+    /** Authenticator tag over {@link canonicalRequestBytes}; the key stays inside. */
+    tag(canonicalRequest: Uint8Array): Hex | Promise<Hex>;
+}
+/** Parameters for {@link createMpc2pPolicyGatedSigner}. */
+interface Mpc2pSignerParams {
+    /** The group 2-of-2 EOA; every `intent.from` must equal this (asserted vs the agent). */
+    readonly from: Address;
+    /** Asset binding — pins the EIP-712 domain `name`/`version`/`verifyingContract` (A4). */
+    readonly asset: X402AssetParam;
+    /** The bound policy session, for `describe()` (the backend holds the authoritative policy). */
+    readonly session: {
+        readonly id: string;
+        readonly notAfter: bigint;
+    };
+    /** The injected WASM DKLs share (private package). */
+    readonly agent: Mpc2pCoSignAgent;
+    /** The injected wss/mTLS frame channel (private package). */
+    readonly transport: CoSignTransport;
+    /** The injected A3 authenticator (the pre-shared key never enters the SDK). */
+    readonly authenticator: CoSignRequestAuthenticator;
+}
+/**
+ * Construct an `mpc-2p` (cryptographic) PolicyGatedSigner over injected agent +
+ * transport + authenticator.
+ *
+ * @example
+ * ```ts
+ * // The agent, transport and authenticator come from the private `kawasekit-mpc-2p`
+ * // package (the WASM share, the wss/mTLS client, the HMAC key) — never bundled here.
+ * const signer = createMpc2pPolicyGatedSigner({
+ *   from: groupEoa,
+ *   asset: { kind: "known", id: "jpyc-v2" },
+ *   session: { id: "sess-1", notAfter: 2_000_000_000n },
+ *   agent, transport, authenticator,
+ * });
+ * requireNonBypassable(signer); // ✓ "cryptographic" — passes the type-gate
+ * const result = await signer.sign(intent);
+ * ```
+ */
+declare function createMpc2pPolicyGatedSigner(params: Mpc2pSignerParams): PolicyGatedSigner<"cryptographic">;
+
+export { type CoSignConnection, type CoSignFrame, type CoSignRequestAuthenticator, type CoSignRequestEnvelope, type CoSignTransport, CoSignUnavailableError, type CreateLocalPolicyGatedSignerParams, type Mpc2pCoSignAgent, type Mpc2pSignerParams, type Mpc2pStepOutcome, NonBypassableEnforcement, PaymentIntent, PolicyGatedSigner, PolicyGatedSignerConfigError, WIRE_VERSION, type WireIntent, assertNonBypassable, canonicalRequestBytes, createLocalPolicyGatedSigner, createMpc2pPolicyGatedSigner, requireNonBypassable, toWireIntent };

package/dist/signer/index.d.ts

@@ -1,7 +1,7 @@
-import { a as PolicyGatedSigner, N as NonBypassableEnforcement } from '../types-IEl-iOIx.js';
-export { E as EnforcementLevel, P as PaymentIntent, b as PolicyRejection, S as SignResult, c as SignerDescription } from '../types-IEl-iOIx.js';
-import { Account } from 'viem';
-import { a as SpendingPolicy, S as SpendState } from '../spending-policy-DKZN3Sg8.js';
+import { a as PolicyGatedSigner, N as NonBypassableEnforcement, P as PaymentIntent } from '../types-BLJU67HZ.js';
+export { E as EnforcementLevel, b as PolicyRejection, S as SignResult, c as SignerDescription } from '../types-BLJU67HZ.js';
+import { Account, Hex, Address } from 'viem';
+import { a as SpendingPolicy, S as SpendState } from '../spending-policy-BD2Mpm-L.js';
 import { X as X402AssetParam } from '../asset-domain-4Ioxqn28.js';
 
 /**
@@ -39,6 +39,36 @@ declare class PolicyGatedSignerConfigError extends Error {
         cause?: unknown;
     });
 }
+/**
+ * Thrown by the `mpc-2p` cryptographic adapter when the co-signer is
+ * **unreachable or the ceremony could not complete** — endpoint down, TLS
+ * failure, connection dropped mid-ceremony, timeout, a malformed/missing
+ * terminal frame, or an internal protocol anomaly. It is a transient / internal
+ * error on the throws channel (M6-0: throws are reserved for internal/config
+ * errors), **distinct from a policy denial**.
+ *
+ * This is the **no-silent-fallback** guarantee (RFC m6-3a constraint 3 / W8):
+ * the adapter has no local-signing path, so an unavailable wire NEVER yields an
+ * `{ ok: true }` signature and NEVER a {@link PolicyRejection}. A `rejection`
+ * means "the owner decided no" (audit-meaningful); a `CoSignUnavailableError`
+ * means "the owner did not decide" — the caller may retry the *same* intent
+ * (the backend's idempotency keeps a retry safe).
+ *
+ * @example
+ * ```ts
+ * try {
+ *   const result = await mpc2pSigner.sign(intent);
+ *   if (!result.ok) handleDenial(result.rejection); // owner said no
+ * } catch (error) {
+ *   if (error instanceof CoSignUnavailableError) retryLater(); // wire was down
+ * }
+ * ```
+ */
+declare class CoSignUnavailableError extends Error {
+    constructor(message: string, options?: {
+        cause?: unknown;
+    });
+}
 
 /**
  * The enforcement-level type-gate — the compile-time (and runtime) mechanism
@@ -128,4 +158,209 @@ interface CreateLocalPolicyGatedSignerParams {
  */
 declare function createLocalPolicyGatedSigner(params: CreateLocalPolicyGatedSignerParams): PolicyGatedSigner<"advisory">;
 
-export { type CreateLocalPolicyGatedSignerParams, NonBypassableEnforcement, PolicyGatedSigner, PolicyGatedSignerConfigError, assertNonBypassable, createLocalPolicyGatedSigner, requireNonBypassable };
+/**
+ * The `mpc-2p` cross-process **wire** (v2) — the versioned `CoSignFrame` control
+ * envelope + the A3 canonical-request encoding, as TypeScript source-of-truth.
+ *
+ * This is the public, TS-interpreted half of the two-layer wire (RFC m6-3a §4.2):
+ * a small, versioned envelope carries the decoded {@link PaymentIntent} (never a
+ * digest — A4) + a per-ceremony id + ssid + a freshness element, plus the opaque
+ * DKLs round payloads (hex, produced/consumed only by the WASM crypto agent). The
+ * shapes here mirror the deployed `kawasekit-mpc-2p` Rust serde **byte-for-byte**
+ * (snake_case `wire_version`, `session_id`, `ceremony_id`, `ssid`, `freshness_ts`,
+ * `freshness_nonce`, `auth_tag`; the string-encoded {@link WireIntent}), so a frame
+ * the SDK builds round-trips through the backend's `serde_json`.
+ *
+ * `canonicalRequestBytes` is the A3 analog of the EIP-712 digest corpus: it
+ * reproduces the backend's `auth::canonical_request_bytes` exactly, so the injected
+ * authenticator's HMAC equals what the co-signer verifies (RFC §4.6:
+ * `HMAC_k(wireVersion ‖ ceremonyId ‖ ssid ‖ canonical(intent) ‖ freshness)`).
+ *
+ * @packageDocumentation
+ */
+
+/** The wire protocol version. A frame whose `wire_version` differs is rejected. */
+declare const WIRE_VERSION: 2;
+/**
+ * The string-encoded EIP-3009 intent as it crosses the wire — lowercase `0x`
+ * addresses, **decimal** integer strings, `0x` hex nonce. Decoupled from any
+ * library's native serde so a stdlib client reproduces it trivially; matches the
+ * Rust `WireIntent` field names + encoding exactly.
+ */
+interface WireIntent {
+    readonly token: string;
+    readonly chain_id: number;
+    readonly from: string;
+    readonly to: string;
+    readonly value: string;
+    readonly valid_after: string;
+    readonly valid_before: string;
+    readonly nonce: string;
+}
+/** Encode a decoded {@link PaymentIntent} for the wire. */
+declare function toWireIntent(intent: PaymentIntent): WireIntent;
+/**
+ * The A3 request envelope the adapter generates per `sign()` and authenticates: a
+ * per-ceremony id + ssid (bound into the A3 tag) + the intent + a freshness element
+ * (a timestamp + a per-request nonce distinct from the EIP-3009 nonce).
+ */
+interface CoSignRequestEnvelope {
+    readonly ceremonyId: string;
+    readonly ssid: string;
+    readonly intent: PaymentIntent;
+    /** Unix seconds; the backend checks it against a clock-skew window. */
+    readonly freshnessTs: number;
+    /** `0x` hex, distinct from the EIP-3009 nonce — the anti-replay key. */
+    readonly freshnessNonce: Hex;
+}
+/**
+ * A versioned control frame: the only cross-language content of the wire. The
+ * DKLs round bytes ride opaque inside `payload`; everything else is the small,
+ * pinned envelope. Internally tagged by `kind` (matches the Rust serde).
+ */
+type CoSignFrame = {
+    readonly wire_version: typeof WIRE_VERSION;
+} & ({
+    readonly kind: "request";
+    readonly session_id: string;
+    readonly ceremony_id: string;
+    readonly ssid: string;
+    readonly intent: WireIntent;
+    readonly freshness_ts: number;
+    readonly freshness_nonce: Hex;
+    /** A3 authenticator over {@link canonicalRequestBytes}, `0x`-hex. */
+    readonly auth_tag: Hex;
+} | {
+    readonly kind: "round";
+    readonly payload: Hex;
+} | {
+    readonly kind: "result";
+    readonly r: Hex;
+    readonly s: Hex;
+    readonly v: number;
+} | {
+    readonly kind: "rejection";
+    readonly reason: string;
+    readonly detail: string;
+} | {
+    readonly kind: "error";
+    readonly message: string;
+});
+/**
+ * The A3 canonical encoding of a request — a byte-exact mirror of the backend's
+ * `auth::canonical_request_bytes` (domain-tag `kawasekit-mpc-2p/cosign-request/v3`,
+ * one `key=value\n` line per field: `wireVersion ‖ ceremonyId ‖ ssid ‖
+ * canonical(intent) ‖ freshness`; lowercase `0x` addresses + freshness nonce,
+ * decimal integers, trailing newline). The injected authenticator HMACs these
+ * bytes; because the encoding is shared, the tag equals the co-signer's.
+ */
+declare function canonicalRequestBytes(env: CoSignRequestEnvelope): Uint8Array;
+
+/**
+ * The `mpc-2p` PolicyGatedSigner adapter — `enforcement: "cryptographic"`.
+ *
+ * A 2-of-2 MPC co-signer: the agent holds ONE DKLs share, the owner backend holds
+ * the other + the authoritative policy gate. No valid signature exists without a
+ * **policy-passing co-sign**, so — unlike `local` — a single key-holder cannot
+ * bypass the policy. That is what earns the non-bypassable `"cryptographic"` label
+ * and lets the M6-0 type-gate (`requireNonBypassable`) reject an advisory signer at
+ * compile time in bounded flows.
+ *
+ * **Open-core / thin adapter.** This module is pure orchestration over injected
+ * interfaces — it ships in the public SDK with **no crypto, no socket, no key**:
+ *
+ * - {@link Mpc2pCoSignAgent} — the WASM DKLs share (the private package's compiled
+ *   `crypto-core`); drives the agent's half of the ceremony round-by-round.
+ * - {@link CoSignTransport} — the authenticated, encrypted (wss/mTLS) frame channel
+ *   to the owner backend (the private package's transport).
+ * - {@link CoSignRequestAuthenticator} — the A3 HMAC (the pre-shared key never
+ *   enters this module).
+ *
+ * The adapter owns the protocol: it pins the EIP-712 domain, **re-derives the
+ * digest from the intent (A4)** via the shared `transferWithAuthorizationTypes`
+ * source-of-truth, computes the A3 canonical bytes, frames the versioned
+ * {@link CoSignFrame} envelope, pumps the ceremony, and maps the terminal frame to
+ * a {@link SignResult}. Crucially it has **no local-signing path**: any
+ * transport/availability failure throws {@link CoSignUnavailableError}, never an
+ * `{ ok: true }` and never a {@link PolicyRejection} (the no-silent-fallback
+ * guarantee, RFC m6-3a constraint 3 / W8).
+ *
+ * @packageDocumentation
+ */
+
+/** The agent's half of the 2-of-2 ceremony (the injected WASM DKLs share). */
+interface Mpc2pCoSignAgent {
+    /** The group 2-of-2 EOA this share controls — must equal the signer's `from`. */
+    groupEoa(): Address;
+    /** Begin signing the 32-byte EIP-712 `digest`; returns the first outbound round (hex). */
+    start(digest: Hex): Hex;
+    /** Feed one inbound round (hex); returns the next outbound round, or the final signature. */
+    step(incoming: Hex): Mpc2pStepOutcome;
+}
+/** The result of one {@link Mpc2pCoSignAgent.step}. */
+type Mpc2pStepOutcome = {
+    readonly outbound: Hex;
+} | {
+    readonly signature: {
+        readonly r: Hex;
+        readonly s: Hex;
+        readonly v: number;
+    };
+};
+/** One authenticated, encrypted ceremony connection to the owner backend. */
+interface CoSignConnection {
+    /** Send one control frame. */
+    send(frame: CoSignFrame): Promise<void>;
+    /** Receive the next control frame (resolves per round). */
+    recv(): Promise<CoSignFrame>;
+    /** Release the connection (best-effort; errors here are ignored). */
+    close(): void | Promise<void>;
+}
+/** Opens a wss/mTLS {@link CoSignConnection} for a single co-sign ceremony. */
+interface CoSignTransport {
+    connect(): Promise<CoSignConnection>;
+}
+/** The A3 request authenticator — HMAC (or signature) over the canonical request bytes. */
+interface CoSignRequestAuthenticator {
+    /** Authenticator tag over {@link canonicalRequestBytes}; the key stays inside. */
+    tag(canonicalRequest: Uint8Array): Hex | Promise<Hex>;
+}
+/** Parameters for {@link createMpc2pPolicyGatedSigner}. */
+interface Mpc2pSignerParams {
+    /** The group 2-of-2 EOA; every `intent.from` must equal this (asserted vs the agent). */
+    readonly from: Address;
+    /** Asset binding — pins the EIP-712 domain `name`/`version`/`verifyingContract` (A4). */
+    readonly asset: X402AssetParam;
+    /** The bound policy session, for `describe()` (the backend holds the authoritative policy). */
+    readonly session: {
+        readonly id: string;
+        readonly notAfter: bigint;
+    };
+    /** The injected WASM DKLs share (private package). */
+    readonly agent: Mpc2pCoSignAgent;
+    /** The injected wss/mTLS frame channel (private package). */
+    readonly transport: CoSignTransport;
+    /** The injected A3 authenticator (the pre-shared key never enters the SDK). */
+    readonly authenticator: CoSignRequestAuthenticator;
+}
+/**
+ * Construct an `mpc-2p` (cryptographic) PolicyGatedSigner over injected agent +
+ * transport + authenticator.
+ *
+ * @example
+ * ```ts
+ * // The agent, transport and authenticator come from the private `kawasekit-mpc-2p`
+ * // package (the WASM share, the wss/mTLS client, the HMAC key) — never bundled here.
+ * const signer = createMpc2pPolicyGatedSigner({
+ *   from: groupEoa,
+ *   asset: { kind: "known", id: "jpyc-v2" },
+ *   session: { id: "sess-1", notAfter: 2_000_000_000n },
+ *   agent, transport, authenticator,
+ * });
+ * requireNonBypassable(signer); // ✓ "cryptographic" — passes the type-gate
+ * const result = await signer.sign(intent);
+ * ```
+ */
+declare function createMpc2pPolicyGatedSigner(params: Mpc2pSignerParams): PolicyGatedSigner<"cryptographic">;
+
+export { type CoSignConnection, type CoSignFrame, type CoSignRequestAuthenticator, type CoSignRequestEnvelope, type CoSignTransport, CoSignUnavailableError, type CreateLocalPolicyGatedSignerParams, type Mpc2pCoSignAgent, type Mpc2pSignerParams, type Mpc2pStepOutcome, NonBypassableEnforcement, PaymentIntent, PolicyGatedSigner, PolicyGatedSignerConfigError, WIRE_VERSION, type WireIntent, assertNonBypassable, canonicalRequestBytes, createLocalPolicyGatedSigner, createMpc2pPolicyGatedSigner, requireNonBypassable, toWireIntent };

package/dist/signer/index.js

@@ -1,5 +1,5 @@
-export { createLocalPolicyGatedSigner } from '../chunk-THTVJZ2Q.js';
-export { PolicyGatedSignerConfigError, assertNonBypassable, requireNonBypassable } from '../chunk-VXZHS74W.js';
+export { WIRE_VERSION, canonicalRequestBytes, createLocalPolicyGatedSigner, createMpc2pPolicyGatedSigner, toWireIntent } from '../chunk-FD6Q4NB2.js';
+export { CoSignUnavailableError, PolicyGatedSignerConfigError, assertNonBypassable, requireNonBypassable } from '../chunk-5TTOAVHE.js';
 import '../chunk-WMVJNPX2.js';
 import '../chunk-6CNAYQOL.js';
 import '../chunk-KT7XDT2T.js';

package/dist/{spending-policy-DKZN3Sg8.d.ts → spending-policy-BD2Mpm-L.d.ts}

@@ -1,5 +1,5 @@
 import { Address } from 'viem';
-import { b as PolicyRejection, P as PaymentIntent } from './types-IEl-iOIx.js';
+import { b as PolicyRejection, P as PaymentIntent } from './types-BLJU67HZ.js';
 
 /**
  * Spending policy — policy-as-data for the x402 / EIP-3009 PolicyGatedSigner

package/dist/{spending-policy-DaajDg9B.d.cts → spending-policy-CGIaBpg-.d.cts}

@@ -1,5 +1,5 @@
 import { Address } from 'viem';
-import { b as PolicyRejection, P as PaymentIntent } from './types-IEl-iOIx.cjs';
+import { b as PolicyRejection, P as PaymentIntent } from './types-BLJU67HZ.cjs';
 
 /**
  * Spending policy — policy-as-data for the x402 / EIP-3009 PolicyGatedSigner

package/dist/{types-IEl-iOIx.d.cts → types-BLJU67HZ.d.cts}

@@ -77,11 +77,19 @@ interface PaymentIntent {
  * The evaluator (`evaluateSpendingPolicy`) emits the `revoked` / `expired` /
  * `token_not_allowed` / `recipient_not_allowed` / `amount_exceeds_*` reasons;
  * the adapter additionally emits `from_mismatch` and (for `mpc-2p`)
- * `intent_digest_mismatch` / `unauthenticated`. The consumer handles one
- * `SignResult` regardless of adapter.
+ * `intent_digest_mismatch` / `unauthenticated` / `nonce_reuse_conflict`. The
+ * consumer handles one `SignResult` regardless of adapter.
  */
 interface PolicyRejection {
-    readonly reason: "revoked" | "expired" | "token_not_allowed" | "recipient_not_allowed" | "amount_exceeds_per_sign" | "amount_exceeds_cumulative" | "intent_digest_mismatch" | "unauthenticated" | "from_mismatch";
+    readonly reason: "revoked" | "expired" | "token_not_allowed" | "recipient_not_allowed" | "amount_exceeds_per_sign" | "amount_exceeds_cumulative" | "intent_digest_mismatch" | "unauthenticated" | "from_mismatch"
+    /**
+     * (`mpc-2p`) The co-signer was presented a **previously-seen EIP-3009
+     * nonce with different intent fields** — the B7 same-nonce/different-fields
+     * fund-correctness anomaly. The backend denies + audits it; double-pay
+     * protection (same nonce, same fields → cached result) is a separate,
+     * non-rejection path (M5 `deriveAuthorizationNonce` + `authorizationState`).
+     */
+     | "nonce_reuse_conflict";
     /** Human-readable reason; never contains the nonce or a signature. */
     readonly detail: string;
 }

package/dist/{types-IEl-iOIx.d.ts → types-BLJU67HZ.d.ts}

@@ -77,11 +77,19 @@ interface PaymentIntent {
  * The evaluator (`evaluateSpendingPolicy`) emits the `revoked` / `expired` /
  * `token_not_allowed` / `recipient_not_allowed` / `amount_exceeds_*` reasons;
  * the adapter additionally emits `from_mismatch` and (for `mpc-2p`)
- * `intent_digest_mismatch` / `unauthenticated`. The consumer handles one
- * `SignResult` regardless of adapter.
+ * `intent_digest_mismatch` / `unauthenticated` / `nonce_reuse_conflict`. The
+ * consumer handles one `SignResult` regardless of adapter.
  */
 interface PolicyRejection {
-    readonly reason: "revoked" | "expired" | "token_not_allowed" | "recipient_not_allowed" | "amount_exceeds_per_sign" | "amount_exceeds_cumulative" | "intent_digest_mismatch" | "unauthenticated" | "from_mismatch";
+    readonly reason: "revoked" | "expired" | "token_not_allowed" | "recipient_not_allowed" | "amount_exceeds_per_sign" | "amount_exceeds_cumulative" | "intent_digest_mismatch" | "unauthenticated" | "from_mismatch"
+    /**
+     * (`mpc-2p`) The co-signer was presented a **previously-seen EIP-3009
+     * nonce with different intent fields** — the B7 same-nonce/different-fields
+     * fund-correctness anomaly. The backend denies + audits it; double-pay
+     * protection (same nonce, same fields → cached result) is a separate,
+     * non-rejection path (M5 `deriveAuthorizationNonce` + `authorizationState`).
+     */
+     | "nonce_reuse_conflict";
     /** Human-readable reason; never contains the nonce or a signature. */
     readonly detail: string;
 }