kawasekit 0.4.0 → 0.6.0

package/dist/cli/index.js

@@ -1,16 +1,16 @@
 #!/usr/bin/env node
 import { transferJpyc } from '../chunk-RJLDKDWL.js';
-import '../chunk-G3UC6SME.js';
+import '../chunk-P5563RGP.js';
 import '../chunk-PVUKX6IF.js';
 import '../chunk-LEHWRDVS.js';
 import '../chunk-TTX3RBIZ.js';
 import '../chunk-QHUCU5YX.js';
 import { issueSessionKey, serializeSessionEnvelope, restoreSessionAccount, revokeSessionKey, rotateSessionKey, parseSessionEnvelope } from '../chunk-N3CVLISJ.js';
-import '../chunk-FD6Q4NB2.js';
-import '../chunk-5TTOAVHE.js';
+import '../chunk-NY6VLXQB.js';
+import '../chunk-VJUXTVSW.js';
 import '../chunk-WMVJNPX2.js';
-import { createJpycDailyLimitPolicies } from '../chunk-E47SIVFY.js';
-import '../chunk-6CNAYQOL.js';
+import { createJpycDailyLimitPolicies } from '../chunk-X54U6GU4.js';
+import '../chunk-7YKRKV6D.js';
 import { JPYC_DECIMALS, getJpycAddress, jpycAbi } from '../chunk-KT7XDT2T.js';
 import { zerodevRpcUrl, polygon, polygonAmoy } from '../chunk-SOTYGX67.js';
 import { __commonJS, __require, __toESM } from '../chunk-7D4SUZUM.js';
@@ -980,7 +980,7 @@ function registerTransferCommand(program2) {
 }
 
 // cli/index.ts
-var CLI_VERSION = "0.4.0" ;
+var CLI_VERSION = "0.6.0" ;
 var program = new Command();
 program.name("kawasekit").description(
   "kawasekit \u2014 CLI for the kawasekit SDK (AI-agent stablecoin payments, Japan-first, JPYC-native)."

package/dist/index.cjs

@@ -363,6 +363,20 @@ async function transferJpyc(kernelClient, params) {
     success: receipt.success
   };
 }
+function normalizeRecipientAllowlist(allowlist) {
+  const seen = /* @__PURE__ */ new Set();
+  const normalized = [];
+  for (const entry of allowlist) {
+    const checksummed = viem.getAddress(entry);
+    if (!seen.has(checksummed)) {
+      seen.add(checksummed);
+      normalized.push(checksummed);
+    }
+  }
+  return normalized;
+}
+
+// src/policy/daily-limit.ts
 var ONE_DAY_SECONDS = 86400;
 function createJpycDailyLimitPolicies(params) {
   if (params.maxPerTransfer <= 0n) {
@@ -375,6 +389,17 @@ function createJpycDailyLimitPolicies(params) {
       `createJpycDailyLimitPolicies: maxTransfersPerDay must be a positive integer, got ${params.maxTransfersPerDay}.`
     );
   }
+  const recipients = params.recipientAllowlist === void 0 || params.recipientAllowlist === "any" ? null : normalizeRecipientAllowlist(params.recipientAllowlist);
+  if (recipients !== null && recipients.length === 0) {
+    throw new Error(
+      'createJpycDailyLimitPolicies: recipientAllowlist must not be empty \u2014 omit it or pass "any" to allow any recipient.'
+    );
+  }
+  if (recipients !== null && params.callPolicyVersion === policies.CallPolicyVersion.V0_0_1) {
+    throw new Error(
+      "createJpycDailyLimitPolicies: recipientAllowlist requires callPolicyVersion V0_0_2 or later (the ONE_OF condition is unsupported on V0_0_1)."
+    );
+  }
   const callPolicy = policies.toCallPolicy({
     policyVersion: params.callPolicyVersion ?? policies.CallPolicyVersion.V0_0_4,
     permissions: [
@@ -383,8 +408,9 @@ function createJpycDailyLimitPolicies(params) {
         abi: jpycAbi,
         functionName: "transfer",
         args: [
-          // Recipient: any address allowed (no allowlist in M2).
-          null,
+          // Recipient (`to`): unrestricted (`null`) unless an allowlist resolved
+          // above, in which case it is constrained via the ONE_OF condition.
+          recipients === null ? null : { condition: policies.ParamCondition.ONE_OF, value: recipients },
           // value: must be ≤ maxPerTransfer.
           {
             condition: policies.ParamCondition.LESS_THAN_OR_EQUAL,
@@ -501,7 +527,7 @@ function createSpendingPolicy(params) {
     }
     return { token, maxPerSign: l.maxPerSign };
   });
-  const recipientAllowlist = params.recipientAllowlist === "any" ? "any" : params.recipientAllowlist.map((a) => viem.getAddress(a));
+  const recipientAllowlist = params.recipientAllowlist === "any" ? "any" : normalizeRecipientAllowlist(params.recipientAllowlist);
   return {
     version: "1",
     session: { id: params.session.id, notAfter: params.session.notAfter },
@@ -533,9 +559,17 @@ var PolicyGatedSignerConfigError = class extends Error {
   }
 };
 var CoSignUnavailableError = class extends Error {
+  /**
+   * `true` when the failure is the **transient transport class** (connect failed /
+   * connection dropped) — the only class the adapter's bounded retry replays
+   * (RFC m6-3a §4.7: never a delivered rejection, never a ban/identifiable-abort,
+   * never a protocol anomaly or timeout). Defaults to `false`.
+   */
+  transient;
   constructor(message, options) {
-    super(message, options);
+    super(message, options?.cause === void 0 ? void 0 : { cause: options.cause });
     this.name = "CoSignUnavailableError";
+    this.transient = options?.transient ?? false;
   }
 };
 
@@ -837,6 +871,7 @@ function createLocalPolicyGatedSigner(params) {
 
 // src/signer/mpc-2p-wire.ts
 var WIRE_VERSION = 2;
+var MAX_FRAME_BYTES = 8 * 1024 * 1024;
 function toWireIntent(intent) {
   return {
     token: intent.token.toLowerCase(),
@@ -891,6 +926,12 @@ function createMpc2pPolicyGatedSigner(params) {
   const { agent, transport, authenticator, session } = params;
   const pinned = resolveAssetParam(params.asset);
   const from = viem.getAddress(params.from);
+  const wire = params.wire ?? {};
+  const maxAttempts = Math.max(1, wire.maxAttempts ?? 2);
+  const ceremonyTimeoutMs = wire.ceremonyTimeoutMs ?? 3e4;
+  const minWindowSecs = wire.minWindowSecs ?? 30;
+  const clockSkewBudgetSecs = wire.clockSkewBudgetSecs ?? 30;
+  const maxFrameBytes = wire.maxFrameBytes ?? MAX_FRAME_BYTES;
   const agentEoa = viem.getAddress(agent.groupEoa());
   if (agentEoa !== from) {
     throw new PolicyGatedSignerConfigError(
@@ -927,23 +968,59 @@ function createMpc2pPolicyGatedSigner(params) {
           nonce: intent.nonce
         }
       });
-      const env = {
-        ceremonyId: globalThis.crypto.randomUUID(),
-        ssid: globalThis.crypto.randomUUID(),
-        intent,
-        freshnessTs: Math.floor(Date.now() / 1e3),
-        freshnessNonce: viem.toHex(globalThis.crypto.getRandomValues(new Uint8Array(16)))
-      };
-      const authTag = await authenticator.tag(canonicalRequestBytes(env));
-      const conn = await openConnection(transport);
-      try {
-        return await runCeremony(conn, agent, session.id, env, digest, authTag);
-      } finally {
+      const validBeforeSecs = Number(intent.validBefore);
+      const nowSecs = Math.floor(Date.now() / 1e3);
+      if (validBeforeSecs - nowSecs < minWindowSecs + clockSkewBudgetSecs) {
+        throw new CoSignUnavailableError(
+          `intent.validBefore (${validBeforeSecs}) leaves under the minimum ceremony window (${minWindowSecs}s + ${clockSkewBudgetSecs}s clock-skew budget) \u2014 refusing a co-sign that risks being born expired (W11)`
+        );
+      }
+      const deadlineMs = Math.min(
+        Date.now() + ceremonyTimeoutMs,
+        (validBeforeSecs - clockSkewBudgetSecs) * 1e3
+      );
+      let lastTransient;
+      for (let attempt = 1; attempt <= maxAttempts; attempt += 1) {
+        if (Date.now() >= deadlineMs) break;
+        const env = {
+          ceremonyId: globalThis.crypto.randomUUID(),
+          ssid: globalThis.crypto.randomUUID(),
+          intent,
+          freshnessTs: Math.floor(Date.now() / 1e3),
+          freshnessNonce: viem.toHex(globalThis.crypto.getRandomValues(new Uint8Array(16)))
+        };
+        const authTag = await authenticator.tag(canonicalRequestBytes(env));
         try {
-          await conn.close();
-        } catch {
+          const conn = await openConnection(transport);
+          try {
+            return await runCeremony({
+              conn,
+              agent,
+              sessionId: session.id,
+              env,
+              digest,
+              authTag,
+              from,
+              deadlineMs,
+              maxFrameBytes
+            });
+          } finally {
+            try {
+              await conn.close();
+            } catch {
+            }
+          }
+        } catch (error) {
+          if (error instanceof CoSignUnavailableError && error.transient && attempt < maxAttempts) {
+            lastTransient = error;
+            continue;
+          }
+          throw error;
         }
       }
+      throw lastTransient ?? new CoSignUnavailableError(
+        "co-sign ceremony budget exhausted before validBefore (W11) \u2014 no attempt could start"
+      );
     },
     describe() {
       return {
@@ -962,23 +1039,32 @@ async function openConnection(transport) {
   try {
     return await transport.connect();
   } catch (cause) {
-    throw new CoSignUnavailableError("co-signer connection failed", { cause });
+    throw new CoSignUnavailableError("co-signer connection failed", { cause, transient: true });
   }
 }
-async function runCeremony(conn, agent, sessionId, env, digest, authTag) {
+async function runCeremony(ctx) {
+  const { conn, agent, env, digest, from } = ctx;
   const send = async (frame) => {
     try {
-      await conn.send(frame);
+      await withDeadline(conn.send(frame), ctx.deadlineMs);
     } catch (cause) {
-      throw new CoSignUnavailableError("co-sign connection dropped while sending", { cause });
+      if (cause instanceof CoSignUnavailableError) throw cause;
+      throw new CoSignUnavailableError("co-sign connection dropped while sending", {
+        cause,
+        transient: true
+      });
     }
   };
   const recv = async () => {
     let frame;
     try {
-      frame = await conn.recv();
+      frame = await withDeadline(conn.recv(), ctx.deadlineMs);
     } catch (cause) {
-      throw new CoSignUnavailableError("co-sign connection dropped mid-ceremony", { cause });
+      if (cause instanceof CoSignUnavailableError) throw cause;
+      throw new CoSignUnavailableError("co-sign connection dropped mid-ceremony", {
+        cause,
+        transient: true
+      });
     }
     if (frame.wire_version !== WIRE_VERSION) {
       throw new CoSignUnavailableError(
@@ -990,13 +1076,13 @@ async function runCeremony(conn, agent, sessionId, env, digest, authTag) {
   await send({
     wire_version: WIRE_VERSION,
     kind: "request",
-    session_id: sessionId,
+    session_id: ctx.sessionId,
     ceremony_id: env.ceremonyId,
     ssid: env.ssid,
     intent: toWireIntent(env.intent),
     freshness_ts: env.freshnessTs,
     freshness_nonce: env.freshnessNonce,
-    auth_tag: authTag
+    auth_tag: ctx.authTag
   });
   let first;
   try {
@@ -1010,6 +1096,12 @@ async function runCeremony(conn, agent, sessionId, env, digest, authTag) {
     const frame = await recv();
     switch (frame.kind) {
       case "round": {
+        const payloadBytes = (frame.payload.length - 2) / 2;
+        if (payloadBytes > ctx.maxFrameBytes) {
+          throw new CoSignUnavailableError(
+            `co-signer sent a ${payloadBytes}-byte round frame (bound ${ctx.maxFrameBytes}) \u2014 refused pre-decode`
+          );
+        }
         let step;
         try {
           step = agent.step(frame.payload);
@@ -1024,15 +1116,16 @@ async function runCeremony(conn, agent, sessionId, env, digest, authTag) {
         break;
       }
       case "result": {
+        const signature = assembleSignature({ r: frame.r, s: frame.s, v: frame.v });
         if (agentSig === null) {
-          throw new CoSignUnavailableError(
-            "the backend returned a result before the agent derived a signature"
-          );
+          await verifyRecovers(digest, signature, frame.s, from, "idempotent-replay");
+          return { ok: true, signature, intent: env.intent };
         }
         if (frame.r.toLowerCase() !== agentSig.r.toLowerCase() || frame.s.toLowerCase() !== agentSig.s.toLowerCase() || frame.v !== agentSig.v) {
           throw new CoSignUnavailableError("the backend and agent derived different signatures");
         }
-        return { ok: true, signature: assembleSignature(agentSig), intent: env.intent };
+        await verifyRecovers(digest, signature, frame.s, from, "co-signed");
+        return { ok: true, signature, intent: env.intent };
       }
       case "rejection": {
         if (POLICY_REASONS.has(frame.reason)) {
@@ -1051,6 +1144,52 @@ async function runCeremony(conn, agent, sessionId, env, digest, authTag) {
     }
   }
 }
+function withDeadline(promise, deadlineMs) {
+  const remaining = deadlineMs - Date.now();
+  if (remaining <= 0) {
+    return Promise.reject(
+      new CoSignUnavailableError(
+        "co-sign ceremony timed out (the deadline fires before validBefore \u2014 W11)"
+      )
+    );
+  }
+  return new Promise((resolve, reject) => {
+    const timer = setTimeout(() => {
+      reject(
+        new CoSignUnavailableError(
+          "co-sign ceremony timed out (the deadline fires before validBefore \u2014 W11)"
+        )
+      );
+    }, remaining);
+    promise.then(
+      (value) => {
+        clearTimeout(timer);
+        resolve(value);
+      },
+      (cause) => {
+        clearTimeout(timer);
+        reject(cause);
+      }
+    );
+  });
+}
+var SECP256K1_HALF_N = 0x7fffffffffffffffffffffffffffffff5d576e7357a4501ddfe92f46681b20a0n;
+async function verifyRecovers(digest, signature, s, from, what) {
+  if (BigInt(s) > SECP256K1_HALF_N) {
+    throw new CoSignUnavailableError(`the ${what} signature is not low-S (EIP-2)`);
+  }
+  let recovered;
+  try {
+    recovered = await viem.recoverAddress({ hash: digest, signature });
+  } catch (cause) {
+    throw new CoSignUnavailableError(`the ${what} signature failed to recover`, { cause });
+  }
+  if (viem.getAddress(recovered) !== from) {
+    throw new CoSignUnavailableError(
+      `the ${what} signature recovers to ${viem.getAddress(recovered)}, not the group EOA ${from}`
+    );
+  }
+}
 function assembleSignature(sig) {
   const yParity = sig.v - 27;
   if (yParity !== 0 && yParity !== 1) {