kawasekit 0.3.0 → 0.5.0

package/dist/index.d.cts

@@ -8,7 +8,7 @@ export { C as ChainNotSupportedError, g as getChain, i as isSupportedChainId, s
 export { C as ConfiguredKernelClient, I as IssueSessionKeyParams, K as KAWASEKIT_SESSION_ENVELOPE_VERSION, a as KawasekitSessionEnvelope, b as KawasekitSessionEnvelopeVersion, c as KawasekitSessionPolicySummary, R as RestoreSessionAccountParams, d as RevokeSessionKeyParams, e as RevokeSessionKeyResult, f as RotateSessionKeyParams, g as RotateSessionKeyResult, S as SessionEnvelopeChainMismatchError, h as SessionEnvelopeParseError, i as SessionEnvelopeSignerMismatchError, j as SessionEnvelopeVersionError, T as TransferJpycInputError, k as TransferJpycParams, l as TransferJpycResult, m as issueSessionKey, p as parseSessionEnvelope, r as restoreSessionAccount, n as revokeSessionKey, o as rotateSessionKey, s as serializeSessionEnvelope, t as transferJpyc } from './index-DFChv_fT.cjs';
 export { CreateJpycDailyLimitPoliciesParams, ONE_DAY_SECONDS, createJpycDailyLimitPolicies } from './policy/index.cjs';
 export { C as CreateSpendingPolicyParams, P as PolicyDecision, S as SpendState, a as SpendingPolicy, b as SpendingPolicyConfigError, T as TokenLimit, c as createSpendingPolicy, e as evaluateSpendingPolicy, m as mergeSpendState } from './spending-policy-CGIaBpg-.cjs';
-export { CoSignConnection, CoSignFrame, CoSignRequestAuthenticator, CoSignTransport, CoSignUnavailableError, CreateLocalPolicyGatedSignerParams, Mpc2pCoSignAgent, Mpc2pSignerParams, Mpc2pStepOutcome, PolicyGatedSignerConfigError, WIRE_VERSION, WireIntent, assertNonBypassable, canonicalIntentBytes, createLocalPolicyGatedSigner, createMpc2pPolicyGatedSigner, requireNonBypassable, toWireIntent } from './signer/index.cjs';
+export { CoSignConnection, CoSignFrame, CoSignRequestAuthenticator, CoSignRequestEnvelope, CoSignTransport, CoSignUnavailableError, CreateLocalPolicyGatedSignerParams, Mpc2pCoSignAgent, Mpc2pSignerParams, Mpc2pStepOutcome, PolicyGatedSignerConfigError, WIRE_VERSION, WireIntent, assertNonBypassable, canonicalRequestBytes, createLocalPolicyGatedSigner, createMpc2pPolicyGatedSigner, requireNonBypassable, toWireIntent } from './signer/index.cjs';
 export { E as EnforcementLevel, N as NonBypassableEnforcement, P as PaymentIntent, a as PolicyGatedSigner, b as PolicyRejection, S as SignResult, c as SignerDescription } from './types-BLJU67HZ.cjs';
 export { C as CancelAuthorizationMessage, E as Eip3009Domain, K as KnownAssetDomain, a as KnownAssetId, R as ReceiveWithAuthorizationMessage, b as ResolvedAsset, S as SignedAuthorization, T as TransferWithAuthorizationMessage, X as X402AssetParam, c as X402TokenDomain, d as authorizationDeadlineFromNow, e as cancelAuthorizationTypes, f as deriveAuthorizationNonce, g as generateAuthorizationNonce, h as getKnownAssetDomain, l as listKnownAssetIds, r as receiveWithAuthorizationTypes, i as resolvedAssetToEip3009Domain, s as signCancelAuthorization, j as signReceiveWithAuthorization, k as signTransferWithAuthorization, t as transferWithAuthorizationTypes } from './asset-domain-4Ioxqn28.cjs';
 export { B as BuildPaymentRequiredResponseParams, a as BuildPaymentRequirementsParams, C as CreateCoinbaseFacilitatorParams, b as CreateHttpFacilitatorParams, c as CreateSelfFacilitatorParams, d as CreateX402PaymentSignerParams, K as KawaseChain, S as SignX402PaymentParams, W as WrapFetchParams, X as X402Fetch, e as X402InvalidConfigError, f as X402InvalidPayloadError, g as X402PaymentSigner, h as X402PolicyRejectedError, i as X402_DEFAULT_AUTHORIZATION_LIFETIME_SECONDS, j as X402_DEFAULT_MAX_TIMEOUT_SECONDS, k as X402_FACILITATOR_ERROR_CODES, l as X402_HEADER_IDEMPOTENCY_KEY, m as X402_HEADER_PAYMENT_REQUIRED, n as X402_HEADER_PAYMENT_RESPONSE, o as X402_HEADER_PAYMENT_SIGNATURE, p as buildPaymentRequiredResponse, q as buildPaymentRequirements, r as createCoinbaseFacilitator, s as createHttpFacilitator, t as createSelfFacilitator, u as createX402PaymentSigner, v as decodePaymentRequiredHeader, w as decodePaymentResponseHeader, x as decodePaymentSignatureHeader, y as deriveReceiptTimeoutMs, z as encodePaymentRequiredHeader, A as encodePaymentResponseHeader, D as encodePaymentSignatureHeader, E as wrapFetch, F as zerodevRpcUrl } from './index-CAmTA8xR.cjs';

package/dist/index.d.ts

@@ -8,7 +8,7 @@ export { C as ChainNotSupportedError, g as getChain, i as isSupportedChainId, s
 export { C as ConfiguredKernelClient, I as IssueSessionKeyParams, K as KAWASEKIT_SESSION_ENVELOPE_VERSION, a as KawasekitSessionEnvelope, b as KawasekitSessionEnvelopeVersion, c as KawasekitSessionPolicySummary, R as RestoreSessionAccountParams, d as RevokeSessionKeyParams, e as RevokeSessionKeyResult, f as RotateSessionKeyParams, g as RotateSessionKeyResult, S as SessionEnvelopeChainMismatchError, h as SessionEnvelopeParseError, i as SessionEnvelopeSignerMismatchError, j as SessionEnvelopeVersionError, T as TransferJpycInputError, k as TransferJpycParams, l as TransferJpycResult, m as issueSessionKey, p as parseSessionEnvelope, r as restoreSessionAccount, n as revokeSessionKey, o as rotateSessionKey, s as serializeSessionEnvelope, t as transferJpyc } from './index-CSpNGigO.js';
 export { CreateJpycDailyLimitPoliciesParams, ONE_DAY_SECONDS, createJpycDailyLimitPolicies } from './policy/index.js';
 export { C as CreateSpendingPolicyParams, P as PolicyDecision, S as SpendState, a as SpendingPolicy, b as SpendingPolicyConfigError, T as TokenLimit, c as createSpendingPolicy, e as evaluateSpendingPolicy, m as mergeSpendState } from './spending-policy-BD2Mpm-L.js';
-export { CoSignConnection, CoSignFrame, CoSignRequestAuthenticator, CoSignTransport, CoSignUnavailableError, CreateLocalPolicyGatedSignerParams, Mpc2pCoSignAgent, Mpc2pSignerParams, Mpc2pStepOutcome, PolicyGatedSignerConfigError, WIRE_VERSION, WireIntent, assertNonBypassable, canonicalIntentBytes, createLocalPolicyGatedSigner, createMpc2pPolicyGatedSigner, requireNonBypassable, toWireIntent } from './signer/index.js';
+export { CoSignConnection, CoSignFrame, CoSignRequestAuthenticator, CoSignRequestEnvelope, CoSignTransport, CoSignUnavailableError, CreateLocalPolicyGatedSignerParams, Mpc2pCoSignAgent, Mpc2pSignerParams, Mpc2pStepOutcome, PolicyGatedSignerConfigError, WIRE_VERSION, WireIntent, assertNonBypassable, canonicalRequestBytes, createLocalPolicyGatedSigner, createMpc2pPolicyGatedSigner, requireNonBypassable, toWireIntent } from './signer/index.js';
 export { E as EnforcementLevel, N as NonBypassableEnforcement, P as PaymentIntent, a as PolicyGatedSigner, b as PolicyRejection, S as SignResult, c as SignerDescription } from './types-BLJU67HZ.js';
 export { C as CancelAuthorizationMessage, E as Eip3009Domain, K as KnownAssetDomain, a as KnownAssetId, R as ReceiveWithAuthorizationMessage, b as ResolvedAsset, S as SignedAuthorization, T as TransferWithAuthorizationMessage, X as X402AssetParam, c as X402TokenDomain, d as authorizationDeadlineFromNow, e as cancelAuthorizationTypes, f as deriveAuthorizationNonce, g as generateAuthorizationNonce, h as getKnownAssetDomain, l as listKnownAssetIds, r as receiveWithAuthorizationTypes, i as resolvedAssetToEip3009Domain, s as signCancelAuthorization, j as signReceiveWithAuthorization, k as signTransferWithAuthorization, t as transferWithAuthorizationTypes } from './asset-domain-4Ioxqn28.js';
 export { B as BuildPaymentRequiredResponseParams, a as BuildPaymentRequirementsParams, C as CreateCoinbaseFacilitatorParams, b as CreateHttpFacilitatorParams, c as CreateSelfFacilitatorParams, d as CreateX402PaymentSignerParams, K as KawaseChain, S as SignX402PaymentParams, W as WrapFetchParams, X as X402Fetch, e as X402InvalidConfigError, f as X402InvalidPayloadError, g as X402PaymentSigner, h as X402PolicyRejectedError, i as X402_DEFAULT_AUTHORIZATION_LIFETIME_SECONDS, j as X402_DEFAULT_MAX_TIMEOUT_SECONDS, k as X402_FACILITATOR_ERROR_CODES, l as X402_HEADER_IDEMPOTENCY_KEY, m as X402_HEADER_PAYMENT_REQUIRED, n as X402_HEADER_PAYMENT_RESPONSE, o as X402_HEADER_PAYMENT_SIGNATURE, p as buildPaymentRequiredResponse, q as buildPaymentRequirements, r as createCoinbaseFacilitator, s as createHttpFacilitator, t as createSelfFacilitator, u as createX402PaymentSigner, v as decodePaymentRequiredHeader, w as decodePaymentResponseHeader, x as decodePaymentSignatureHeader, y as deriveReceiptTimeoutMs, z as encodePaymentRequiredHeader, A as encodePaymentResponseHeader, D as encodePaymentSignatureHeader, E as wrapFetch, F as zerodevRpcUrl } from './index-C9tbaHPF.js';

package/dist/index.js

@@ -1,12 +1,12 @@
 export { TransferJpycInputError, transferJpyc } from './chunk-RJLDKDWL.js';
-export { X402_DEFAULT_AUTHORIZATION_LIFETIME_SECONDS, X402_FACILITATOR_ERROR_CODES, createCoinbaseFacilitator, createHttpFacilitator, createSelfFacilitator, createX402PaymentSigner, deriveReceiptTimeoutMs, wrapFetch } from './chunk-G3UC6SME.js';
+export { X402_DEFAULT_AUTHORIZATION_LIFETIME_SECONDS, X402_FACILITATOR_ERROR_CODES, createCoinbaseFacilitator, createHttpFacilitator, createSelfFacilitator, createX402PaymentSigner, deriveReceiptTimeoutMs, wrapFetch } from './chunk-P5563RGP.js';
 export { X402_DEFAULT_MAX_TIMEOUT_SECONDS, X402_HEADER_IDEMPOTENCY_KEY, X402_HEADER_PAYMENT_REQUIRED, X402_HEADER_PAYMENT_RESPONSE, X402_HEADER_PAYMENT_SIGNATURE, buildPaymentRequiredResponse, buildPaymentRequirements, createX402Handler, decodePaymentRequiredHeader, decodePaymentResponseHeader, decodePaymentSignatureHeader, encodePaymentRequiredHeader, encodePaymentResponseHeader, encodePaymentSignatureHeader } from './chunk-PVUKX6IF.js';
 export { extractAcceptedNetworks, invokeHookSafely } from './chunk-LEHWRDVS.js';
 export { createIdempotencyKeyBuilder, createInMemoryIdempotencyStore, deriveIdempotencyKey, normalizeIntentText } from './chunk-TTX3RBIZ.js';
 export { IdempotencyConfigError, IdempotencyRecordParseError, IdempotencyRecordVersionError, KAWASEKIT_IDEMPOTENCY_RECORD_VERSION, X402_VERSION, chainIdToX402Network, isX402Network, parseIdempotencyRecord, serializeIdempotencyRecord, x402NetworkToChainId } from './chunk-QHUCU5YX.js';
 export { KAWASEKIT_SESSION_ENVELOPE_VERSION, SessionEnvelopeChainMismatchError, SessionEnvelopeParseError, SessionEnvelopeSignerMismatchError, SessionEnvelopeVersionError, createAgentSmartAccount, issueSessionKey, parseSessionEnvelope, restoreSessionAccount, revokeSessionKey, rotateSessionKey, serializeSessionEnvelope } from './chunk-N3CVLISJ.js';
-export { WIRE_VERSION, canonicalIntentBytes, createLocalPolicyGatedSigner, createMpc2pPolicyGatedSigner, toWireIntent } from './chunk-EUW7AZ4P.js';
-export { CoSignUnavailableError, PolicyGatedSignerConfigError, assertNonBypassable, authorizationDeadlineFromNow, cancelAuthorizationTypes, deriveAuthorizationNonce, generateAuthorizationNonce, getKnownAssetDomain, listKnownAssetIds, receiveWithAuthorizationTypes, requireNonBypassable, resolvedAssetToEip3009Domain, signCancelAuthorization, signReceiveWithAuthorization, signTransferWithAuthorization, transferWithAuthorizationTypes } from './chunk-5TTOAVHE.js';
+export { WIRE_VERSION, canonicalRequestBytes, createLocalPolicyGatedSigner, createMpc2pPolicyGatedSigner, toWireIntent } from './chunk-S2ZSX2VS.js';
+export { CoSignUnavailableError, PolicyGatedSignerConfigError, assertNonBypassable, authorizationDeadlineFromNow, cancelAuthorizationTypes, deriveAuthorizationNonce, generateAuthorizationNonce, getKnownAssetDomain, listKnownAssetIds, receiveWithAuthorizationTypes, requireNonBypassable, resolvedAssetToEip3009Domain, signCancelAuthorization, signReceiveWithAuthorization, signTransferWithAuthorization, transferWithAuthorizationTypes } from './chunk-VJUXTVSW.js';
 export { X402InvalidConfigError, X402InvalidPayloadError, X402PolicyRejectedError } from './chunk-WMVJNPX2.js';
 export { ONE_DAY_SECONDS, createJpycDailyLimitPolicies } from './chunk-E47SIVFY.js';
 export { SpendingPolicyConfigError, createSpendingPolicy, evaluateSpendingPolicy, mergeSpendState } from './chunk-6CNAYQOL.js';

package/dist/signer/index.cjs

@@ -17,9 +17,17 @@ var PolicyGatedSignerConfigError = class extends Error {
   }
 };
 var CoSignUnavailableError = class extends Error {
+  /**
+   * `true` when the failure is the **transient transport class** (connect failed /
+   * connection dropped) — the only class the adapter's bounded retry replays
+   * (RFC m6-3a §4.7: never a delivered rejection, never a ban/identifiable-abort,
+   * never a protocol anomaly or timeout). Defaults to `false`.
+   */
+  transient;
   constructor(message, options) {
-    super(message, options);
+    super(message, options?.cause === void 0 ? void 0 : { cause: options.cause });
     this.name = "CoSignUnavailableError";
+    this.transient = options?.transient ?? false;
   }
 };
 
@@ -362,7 +370,8 @@ function createLocalPolicyGatedSigner(params) {
 }
 
 // src/signer/mpc-2p-wire.ts
-var WIRE_VERSION = 1;
+var WIRE_VERSION = 2;
+var MAX_FRAME_BYTES = 8 * 1024 * 1024;
 function toWireIntent(intent) {
   return {
     token: intent.token.toLowerCase(),
@@ -375,17 +384,23 @@ function toWireIntent(intent) {
     nonce: intent.nonce.toLowerCase()
   };
 }
-function canonicalIntentBytes(intent) {
+function canonicalRequestBytes(env) {
+  const i = env.intent;
   const lines = [
-    "kawasekit-mpc-2p/cosign-request/v2",
-    `token=${intent.token.toLowerCase()}`,
-    `chainId=${intent.chainId}`,
-    `from=${intent.from.toLowerCase()}`,
-    `to=${intent.to.toLowerCase()}`,
-    `value=${intent.value}`,
-    `validAfter=${intent.validAfter}`,
-    `validBefore=${intent.validBefore}`,
-    `nonce=${intent.nonce.toLowerCase()}`
+    "kawasekit-mpc-2p/cosign-request/v3",
+    "wireVersion=2",
+    `ceremonyId=${env.ceremonyId}`,
+    `ssid=${env.ssid}`,
+    `token=${i.token.toLowerCase()}`,
+    `chainId=${i.chainId}`,
+    `from=${i.from.toLowerCase()}`,
+    `to=${i.to.toLowerCase()}`,
+    `value=${i.value}`,
+    `validAfter=${i.validAfter}`,
+    `validBefore=${i.validBefore}`,
+    `nonce=${i.nonce.toLowerCase()}`,
+    `freshnessTs=${env.freshnessTs}`,
+    `freshnessNonce=${env.freshnessNonce.toLowerCase()}`
   ];
   return new TextEncoder().encode(lines.map((l) => `${l}
 `).join(""));
@@ -411,6 +426,12 @@ function createMpc2pPolicyGatedSigner(params) {
   const { agent, transport, authenticator, session } = params;
   const pinned = resolveAssetParam(params.asset);
   const from = viem.getAddress(params.from);
+  const wire = params.wire ?? {};
+  const maxAttempts = Math.max(1, wire.maxAttempts ?? 2);
+  const ceremonyTimeoutMs = wire.ceremonyTimeoutMs ?? 3e4;
+  const minWindowSecs = wire.minWindowSecs ?? 30;
+  const clockSkewBudgetSecs = wire.clockSkewBudgetSecs ?? 30;
+  const maxFrameBytes = wire.maxFrameBytes ?? MAX_FRAME_BYTES;
   const agentEoa = viem.getAddress(agent.groupEoa());
   if (agentEoa !== from) {
     throw new PolicyGatedSignerConfigError(
@@ -447,16 +468,59 @@ function createMpc2pPolicyGatedSigner(params) {
           nonce: intent.nonce
         }
       });
-      const authTag = await authenticator.tag(canonicalIntentBytes(intent));
-      const conn = await openConnection(transport);
-      try {
-        return await runCeremony(conn, agent, session.id, intent, digest, authTag);
-      } finally {
+      const validBeforeSecs = Number(intent.validBefore);
+      const nowSecs = Math.floor(Date.now() / 1e3);
+      if (validBeforeSecs - nowSecs < minWindowSecs + clockSkewBudgetSecs) {
+        throw new CoSignUnavailableError(
+          `intent.validBefore (${validBeforeSecs}) leaves under the minimum ceremony window (${minWindowSecs}s + ${clockSkewBudgetSecs}s clock-skew budget) \u2014 refusing a co-sign that risks being born expired (W11)`
+        );
+      }
+      const deadlineMs = Math.min(
+        Date.now() + ceremonyTimeoutMs,
+        (validBeforeSecs - clockSkewBudgetSecs) * 1e3
+      );
+      let lastTransient;
+      for (let attempt = 1; attempt <= maxAttempts; attempt += 1) {
+        if (Date.now() >= deadlineMs) break;
+        const env = {
+          ceremonyId: globalThis.crypto.randomUUID(),
+          ssid: globalThis.crypto.randomUUID(),
+          intent,
+          freshnessTs: Math.floor(Date.now() / 1e3),
+          freshnessNonce: viem.toHex(globalThis.crypto.getRandomValues(new Uint8Array(16)))
+        };
+        const authTag = await authenticator.tag(canonicalRequestBytes(env));
         try {
-          await conn.close();
-        } catch {
+          const conn = await openConnection(transport);
+          try {
+            return await runCeremony({
+              conn,
+              agent,
+              sessionId: session.id,
+              env,
+              digest,
+              authTag,
+              from,
+              deadlineMs,
+              maxFrameBytes
+            });
+          } finally {
+            try {
+              await conn.close();
+            } catch {
+            }
+          }
+        } catch (error) {
+          if (error instanceof CoSignUnavailableError && error.transient && attempt < maxAttempts) {
+            lastTransient = error;
+            continue;
+          }
+          throw error;
         }
       }
+      throw lastTransient ?? new CoSignUnavailableError(
+        "co-sign ceremony budget exhausted before validBefore (W11) \u2014 no attempt could start"
+      );
     },
     describe() {
       return {
@@ -475,23 +539,32 @@ async function openConnection(transport) {
   try {
     return await transport.connect();
   } catch (cause) {
-    throw new CoSignUnavailableError("co-signer connection failed", { cause });
+    throw new CoSignUnavailableError("co-signer connection failed", { cause, transient: true });
   }
 }
-async function runCeremony(conn, agent, sessionId, intent, digest, authTag) {
+async function runCeremony(ctx) {
+  const { conn, agent, env, digest, from } = ctx;
   const send = async (frame) => {
     try {
-      await conn.send(frame);
+      await withDeadline(conn.send(frame), ctx.deadlineMs);
     } catch (cause) {
-      throw new CoSignUnavailableError("co-sign connection dropped while sending", { cause });
+      if (cause instanceof CoSignUnavailableError) throw cause;
+      throw new CoSignUnavailableError("co-sign connection dropped while sending", {
+        cause,
+        transient: true
+      });
     }
   };
   const recv = async () => {
     let frame;
     try {
-      frame = await conn.recv();
+      frame = await withDeadline(conn.recv(), ctx.deadlineMs);
     } catch (cause) {
-      throw new CoSignUnavailableError("co-sign connection dropped mid-ceremony", { cause });
+      if (cause instanceof CoSignUnavailableError) throw cause;
+      throw new CoSignUnavailableError("co-sign connection dropped mid-ceremony", {
+        cause,
+        transient: true
+      });
     }
     if (frame.wire_version !== WIRE_VERSION) {
       throw new CoSignUnavailableError(
@@ -503,9 +576,13 @@ async function runCeremony(conn, agent, sessionId, intent, digest, authTag) {
   await send({
     wire_version: WIRE_VERSION,
     kind: "request",
-    session_id: sessionId,
-    intent: toWireIntent(intent),
-    auth_tag: authTag
+    session_id: ctx.sessionId,
+    ceremony_id: env.ceremonyId,
+    ssid: env.ssid,
+    intent: toWireIntent(env.intent),
+    freshness_ts: env.freshnessTs,
+    freshness_nonce: env.freshnessNonce,
+    auth_tag: ctx.authTag
   });
   let first;
   try {
@@ -519,6 +596,12 @@ async function runCeremony(conn, agent, sessionId, intent, digest, authTag) {
     const frame = await recv();
     switch (frame.kind) {
       case "round": {
+        const payloadBytes = (frame.payload.length - 2) / 2;
+        if (payloadBytes > ctx.maxFrameBytes) {
+          throw new CoSignUnavailableError(
+            `co-signer sent a ${payloadBytes}-byte round frame (bound ${ctx.maxFrameBytes}) \u2014 refused pre-decode`
+          );
+        }
         let step;
         try {
           step = agent.step(frame.payload);
@@ -533,15 +616,16 @@ async function runCeremony(conn, agent, sessionId, intent, digest, authTag) {
         break;
       }
       case "result": {
+        const signature = assembleSignature({ r: frame.r, s: frame.s, v: frame.v });
         if (agentSig === null) {
-          throw new CoSignUnavailableError(
-            "the backend returned a result before the agent derived a signature"
-          );
+          await verifyRecovers(digest, signature, frame.s, from, "idempotent-replay");
+          return { ok: true, signature, intent: env.intent };
         }
         if (frame.r.toLowerCase() !== agentSig.r.toLowerCase() || frame.s.toLowerCase() !== agentSig.s.toLowerCase() || frame.v !== agentSig.v) {
           throw new CoSignUnavailableError("the backend and agent derived different signatures");
         }
-        return { ok: true, signature: assembleSignature(agentSig), intent };
+        await verifyRecovers(digest, signature, frame.s, from, "co-signed");
+        return { ok: true, signature, intent: env.intent };
       }
       case "rejection": {
         if (POLICY_REASONS.has(frame.reason)) {
@@ -560,6 +644,52 @@ async function runCeremony(conn, agent, sessionId, intent, digest, authTag) {
     }
   }
 }
+function withDeadline(promise, deadlineMs) {
+  const remaining = deadlineMs - Date.now();
+  if (remaining <= 0) {
+    return Promise.reject(
+      new CoSignUnavailableError(
+        "co-sign ceremony timed out (the deadline fires before validBefore \u2014 W11)"
+      )
+    );
+  }
+  return new Promise((resolve, reject) => {
+    const timer = setTimeout(() => {
+      reject(
+        new CoSignUnavailableError(
+          "co-sign ceremony timed out (the deadline fires before validBefore \u2014 W11)"
+        )
+      );
+    }, remaining);
+    promise.then(
+      (value) => {
+        clearTimeout(timer);
+        resolve(value);
+      },
+      (cause) => {
+        clearTimeout(timer);
+        reject(cause);
+      }
+    );
+  });
+}
+var SECP256K1_HALF_N = 0x7fffffffffffffffffffffffffffffff5d576e7357a4501ddfe92f46681b20a0n;
+async function verifyRecovers(digest, signature, s, from, what) {
+  if (BigInt(s) > SECP256K1_HALF_N) {
+    throw new CoSignUnavailableError(`the ${what} signature is not low-S (EIP-2)`);
+  }
+  let recovered;
+  try {
+    recovered = await viem.recoverAddress({ hash: digest, signature });
+  } catch (cause) {
+    throw new CoSignUnavailableError(`the ${what} signature failed to recover`, { cause });
+  }
+  if (viem.getAddress(recovered) !== from) {
+    throw new CoSignUnavailableError(
+      `the ${what} signature recovers to ${viem.getAddress(recovered)}, not the group EOA ${from}`
+    );
+  }
+}
 function assembleSignature(sig) {
   const yParity = sig.v - 27;
   if (yParity !== 0 && yParity !== 1) {
@@ -569,10 +699,11 @@ function assembleSignature(sig) {
 }
 
 exports.CoSignUnavailableError = CoSignUnavailableError;
+exports.MAX_FRAME_BYTES = MAX_FRAME_BYTES;
 exports.PolicyGatedSignerConfigError = PolicyGatedSignerConfigError;
 exports.WIRE_VERSION = WIRE_VERSION;
 exports.assertNonBypassable = assertNonBypassable;
-exports.canonicalIntentBytes = canonicalIntentBytes;
+exports.canonicalRequestBytes = canonicalRequestBytes;
 exports.createLocalPolicyGatedSigner = createLocalPolicyGatedSigner;
 exports.createMpc2pPolicyGatedSigner = createMpc2pPolicyGatedSigner;
 exports.requireNonBypassable = requireNonBypassable;