@oaath/cli 0.3.1 → 0.3.3

package/README.md

@@ -46,14 +46,14 @@ npx @oaath/cli deploy-runtime --chain 143 --rpc https://rpc.monad.xyz
 ```
 
 The command requires an explicit RPC URL. The endpoint must report the requested
-chain and carry the exact EntryPoint 0.7 and singleton CREATE2 deployer runtimes.
+chain and carry the exact EntryPoint 0.7, singleton CREATE2 deployer, ZeroDev
+CallPolicy, operation-limit RateLimitPolicy, ECDSASigner and Daimo P-256 verifier runtimes.
 It deploys only missing core components: Kernel UUPS, the factory's immutable
-ECDSA implementation, factory, OAAth ValidityPolicy, CallPolicy, RateLimitPolicy,
-the fixed-window RateLimitPolicy for windowed operation limits
-and ECDSASigner, plus the passkey-session WebAuthnSigner and P-256 verifier. Every payload uses the canonical `0x4e59…956C` deployer and zero
+ECDSA implementation, factory, OAAth ValidityPolicy, the fixed-window
+RateLimitPolicy for windowed operation limits and the passkey-session WebAuthnSigner. Every payload uses the canonical `0x4e59…956C` deployer and zero
 salt; addresses are derived from the retained creation code and checked against
 SDK bindings. Existing code with a wrong hash or unreadable evidence stops the
-command. EntryPoint, the singleton deployer and the P-256 validator are not deployed.
+command. Externally owned prerequisites and the optional P-256 validator are not deployed.
 
 New transactions use the funded account named by `OAATH_DEPLOYER_PRIVATE_KEY`.
 Keys are never accepted as command-line arguments or saved to the journal.

package/dist/cli.mjs

@@ -108,7 +108,7 @@ parseAbi([
 	"function execute(bytes32 mode, bytes executionData) payable"
 ]);
 //#endregion
-//#region ../sdk/dist/approval-ByZLRrMd.js
+//#region ../sdk/dist/approval-Bj2Vjk01.js
 var OaathKernelRuntimeError = class extends Error {
 	code;
 	constructor(code, message, options) {
@@ -518,8 +518,16 @@ function pinnedSignerModule(kind) {
 function pinnedPolicyModule(kind) {
 	return PINNED_POLICIES[kind] ?? null;
 }
+/** Resolves the reviewed permission signer module for one key kind, or fails closed. */
+function resolvePinnedSigner(kind) {
+	return pinnedSignerModule(kind) ?? runtimeFail("kernel_runtime_signer_unavailable", `Kernel v4 has no reviewed ${kind} permission signer module deployment`);
+}
+/** Resolves the reviewed policy module enforcing one policy axis, or fails closed. */
+function resolvePolicyModule(kind) {
+	return pinnedPolicyModule(kind) ?? runtimeFail("kernel_runtime_policy_unavailable", `Kernel v4 has no reviewed ${kind} policy module deployment`);
+}
 //#endregion
-//#region ../sdk/dist/profiles-kYqbR75m.js
+//#region ../sdk/dist/profiles-C1ZCjafH.js
 /**
 * The version-agnostic Kernel account entry points. Kernel version and
 * EntryPoint version are optional settings: a deployment is selected with
@@ -546,7 +554,7 @@ function kernelDeployment(value) {
 }
 parseAbi(["function isModuleInstalled(uint256 moduleTypeId, address module, bytes additionalContext) view returns (bool)"]);
 //#endregion
-//#region ../sdk/dist/create-kernel-runtime-D6NJ977n.js
+//#region ../sdk/dist/create-kernel-runtime-mOnCZXOz.js
 /**
 * ECDSA (secp256k1) KeyProfile. Owns public material, signing normalization,
 * and local verification only.
@@ -615,17 +623,18 @@ Object.freeze({ status: "approval-replayable" });
 /**
 * The OAAth runtime modules a chain must carry before OAAth grants can use it:
 * the WebAuthn permission signer, the fixed-window RateLimitPolicy, the OAAth
-* validity policy and the P-256 verifier the WebAuthn signer staticcalls. This
+* validity policy, CallPolicy, operation limit, ECDSA signer, and P-256 verifier. This
 * file owns two facts about them: whether one is present on a chain
 * (observeRuntimeModule, shared with createKernelRuntime's session bind) and
-* the exact zero-salt CREATE2 transaction that deploys it (shared with
+* deployment ownership and, for OAAth-owned deployments, the exact zero-salt
+* CREATE2 transaction (shared with
 * `oaath deploy-runtime`).
 *
 * Status vocabulary, closed and fail-closed:
 *
 * - `present`: the address carries exactly the pinned runtime code hash.
 * - `missing`: the address provably carries no code, so the prepared
-*   deployment transaction is the remediation.
+*   deployment transaction is the remediation only for OAAth-owned modules.
 * - `mismatch`: the address carries other code. It is never `present`, and it
 *   is distinct from `missing` because deploying cannot fix it: the CREATE2
 *   address is already occupied.
@@ -654,7 +663,22 @@ const RUNTIME_MODULES = Object.freeze({
 	p256_verifier: Object.freeze({
 		address: KERNEL_P256_VERIFIER,
 		runtimeCodeHash: KERNEL_P256_VERIFIER_RUNTIME_CODE_HASH,
-		deploymentInput: "0x00000000000000000000000000000000000000000000000000000000000000006080806040523461001657610dd1908161001c8239f35b600080fdfe60e06040523461001a57610012366100c7565b602081519101f35b600080fd5b6040810190811067ffffffffffffffff82111761003b57604052565b7f4e487b7100000000000000000000000000000000000000000000000000000000600052604160045260246000fd5b60e0810190811067ffffffffffffffff82111761003b57604052565b90601f7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffe0910116810190811067ffffffffffffffff82111761003b57604052565b60a08103610193578060201161001a57600060409180831161018f578060601161018f578060801161018f5760a01161018c57815182810181811067ffffffffffffffff82111761015f579061013291845260603581526080356020820152833560203584356101ab565b15610156575060ff6001915b5191166020820152602081526101538161001f565b90565b60ff909161013e565b6024837f4e487b710000000000000000000000000000000000000000000000000000000081526041600452fd5b80fd5b5080fd5b5060405160006020820152602081526101538161001f565b909283158015610393575b801561038b575b8015610361575b6103585780519060206101dc818301938451906103bd565b1561034d57604051948186019082825282604088015282606088015260808701527fffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc63254f60a08701527fffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632551958660c082015260c081526102588161006a565b600080928192519060055afa903d15610345573d9167ffffffffffffffff831161031857604051926102b1857fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffe0601f8401160185610086565b83523d828585013e5b156102eb57828280518101031261018c5750015190516102e693929185908181890994099151906104eb565b061490565b807f4e487b7100000000000000000000000000000000000000000000000000000000602492526001600452fd5b6024827f4e487b710000000000000000000000000000000000000000000000000000000081526041600452fd5b6060916102ba565b505050505050600090565b50505050600090565b507fffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc6325518310156101c4565b5082156101bd565b507fffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc6325518410156101b6565b7fffffffff00000001000000000000000000000000ffffffffffffffffffffffff90818110801590610466575b8015610455575b61044d577f5ac635d8aa3a93e7b3ebbd55769886bc651d06b0cc53b0f63bce3c3e27d2604b8282818080957fffffffff00000001000000000000000000000000fffffffffffffffffffffffc0991818180090908089180091490565b505050600090565b50801580156103f1575082156103f1565b50818310156103ea565b7f800000000000000000000000000000000000000000000000000000000000000081146104bc577fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff0190565b7f4e487b7100000000000000000000000000000000000000000000000000000000600052601160045260246000fd5b909192608052600091600160a05260a05193600092811580610718575b61034d57610516838261073d565b95909460ff60c05260005b600060c05112156106ef575b60a05181036106a1575050507f4fe342e2fe1a7f9b8ee7eb4a7c0f9e162bce33576b315ececbb6406837bf51f5957f6b17d1f2e12c4247f8bce6e563a440f277037d812deb33a0f4a13945d898c2969594939291965b600060c05112156105c7575050505050507fffffffff00000001000000000000000000000000ffffffffffffffffffffffff91506105c260a051610ca2565b900990565b956105d9929394959660a05191610a98565b9097929181928960a0528192819a6105f66080518960c051610722565b61060160c051610470565b60c0528061061b5750505050505b96959493929196610583565b969b5061067b96939550919350916001810361068857507f4fe342e2fe1a7f9b8ee7eb4a7c0f9e162bce33576b315ececbb6406837bf51f5937f6b17d1f2e12c4247f8bce6e563a440f277037d812deb33a0f4a13945d898c29693610952565b979297919060a05261060f565b6002036106985786938a93610952565b88938893610952565b600281036106ba57505050829581959493929196610583565b9197917ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffd0161060f575095508495849661060f565b506106ff6080518560c051610722565b8061070b60c051610470565b60c052156105215761052d565b5060805115610508565b91906002600192841c831b16921c1681018091116104bc5790565b8015806107ab575b6107635761075f91610756916107b3565b92919091610c42565b9091565b50507f6b17d1f2e12c4247f8bce6e563a440f277037d812deb33a0f4a13945d898c296907f4fe342e2fe1a7f9b8ee7eb4a7c0f9e162bce33576b315ececbb6406837bf51f590565b508115610745565b919082158061094a575b1561080f57507f6b17d1f2e12c4247f8bce6e563a440f277037d812deb33a0f4a13945d898c29691507f4fe342e2fe1a7f9b8ee7eb4a7c0f9e162bce33576b315ececbb6406837bf51f5906001908190565b7fb01cbd1c01e58065711814b583f061e9d431cca994cea1313449bf97c840ae0a917fffffffff00000001000000000000000000000000ffffffffffffffffffffffff808481600186090894817f94e82e0c1ed3bdb90743191a9c5bbf0d88fc827fd214cc5f0b5ec6ba27673d6981600184090893841561091b575050808084800993840994818460010994828088600109957f6b17d1f2e12c4247f8bce6e563a440f277037d812deb33a0f4a13945d898c29609918784038481116104bc5784908180867fffffffff00000001000000000000000000000000fffffffffffffffffffffffd0991818580090808978885038581116104bc578580949281930994080908935b93929190565b9350935050921560001461093b5761093291610b6d565b91939092610915565b50506000806000926000610915565b5080156107bd565b91949592939095811580610a90575b15610991575050831580610989575b61097a5793929190565b50600093508392508291508190565b508215610970565b85919294951580610a88575b610a78577fffffffff00000001000000000000000000000000ffffffffffffffffffffffff968703918783116104bc5787838189850908938689038981116104bc5789908184840908928315610a5d575050818880959493928180848196099b8c9485099b8c920999099609918784038481116104bc5784908180867fffffffff00000001000000000000000000000000fffffffffffffffffffffffd0991818580090808978885038581116104bc578580949281930994080908929190565b965096505050509093501560001461093b5761093291610b6d565b9550509150915091906001908190565b50851561099d565b508015610961565b939092821580610b65575b61097a577fffffffff00000001000000000000000000000000ffffffffffffffffffffffff908185600209948280878009809709948380888a0998818080808680097fffffffff00000001000000000000000000000000fffffffffffffffffffffffc099280096003090884808a7fffffffff00000001000000000000000000000000fffffffffffffffffffffffd09818380090898898603918683116104bc57888703908782116104bc578780969481809681950994089009089609930990565b508015610aa3565b919091801580610c3a575b610c2d577fffffffff00000001000000000000000000000000ffffffffffffffffffffffff90818460020991808084800980940991817fffffffff00000001000000000000000000000000fffffffffffffffffffffffc81808088860994800960030908958280837fffffffff00000001000000000000000000000000fffffffffffffffffffffffd09818980090896878403918483116104bc57858503928584116104bc5785809492819309940890090892565b5060009150819081908190565b508215610b78565b909392821580610c9a575b610c8d57610c5a90610ca2565b9182917fffffffff00000001000000000000000000000000ffffffffffffffffffffffff80809581940980099009930990565b5050509050600090600090565b508015610c4d565b604051906020918281019183835283604083015283606083015260808201527fffffffff00000001000000000000000000000000fffffffffffffffffffffffd60a08201527fffffffff00000001000000000000000000000000ffffffffffffffffffffffff60c082015260c08152610d1a8161006a565b600080928192519060055afa903d15610d93573d9167ffffffffffffffff83116103185760405192610d73857fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffe0601f8401160185610086565b83523d828585013e5b156102eb57828280518101031261018c5750015190565b606091610d7c56fea2646970667358221220fa55558b04ced380e93d0a46be01bb895ff30f015c50c516e898c341cd0a230264736f6c63430008150033"
+		deploymentInput: null
+	}),
+	call_policy: Object.freeze({
+		address: resolvePolicyModule("call"),
+		runtimeCodeHash: "0x99fc4b02bdbb9a5133728a2bfffb458bf8530b1b068d6d4334f69dcb454ace78",
+		deploymentInput: null
+	}),
+	operation_limit_policy: Object.freeze({
+		address: resolvePolicyModule("operation-limit"),
+		runtimeCodeHash: "0xb4fffdb494637e8e5bfc15d6500202c252392b498e518668f896dc6da0221183",
+		deploymentInput: null
+	}),
+	ecdsa_signer: Object.freeze({
+		address: resolvePinnedSigner("ecdsa"),
+		runtimeCodeHash: "0x510a0a1ab8b3f256a5c90b5fff51a9fd98656bd1c8a29fbd7857faa70c400ccd",
+		deploymentInput: null
 	})
 });
 Object.freeze(Object.keys(RUNTIME_MODULES));
@@ -662,12 +686,13 @@ function capturedModule(value) {
 	if (typeof value !== "string" || !Object.hasOwn(RUNTIME_MODULES, value)) return inputInvalid("Kernel runtime module is unsupported");
 	return value;
 }
-/** The exact CREATE2 deployer transaction that deploys one runtime module. */
+/** The exact CREATE2 transaction for an OAAth-owned deployment, or null for an external module. */
 function prepareRuntimeModuleDeployment(value) {
 	const record = exactInput(value, ["chainId", "module"], "Kernel runtime module deployment", /* @__PURE__ */ new WeakSet());
 	const deployment = kernelV4Deployment(record.chainId);
 	const module = capturedModule(record.module);
 	const row = RUNTIME_MODULES[module];
+	if (row.deploymentInput === null) return null;
 	return Object.freeze({
 		module,
 		address: row.address,
@@ -753,6 +778,15 @@ var ecdsaSigner = {
 		"initCodeHash": "0x5c757305090179fd55d99ade637da3ff267acfc8fcded63e39433c3466660559"
 	}
 };
+var p256Verifier = {
+	"repository": "https://github.com/daimo-eth/p256-verifier",
+	"commit": "607d3ec8377a3f59d65eca60d87dee8485d2ebcc",
+	"source": "src/P256Verifier.sol",
+	"note": "Not an ERC-7579 module: the audited Daimo P-256 verifier singleton the pinned WebAuthnSigner staticcalls at this fixed address when usePrecompiled is false. The deployment input is the exact mainnet broadcast calldata (zero salt + initcode) through the same deterministic CREATE2 proxy, so the address is chain-independent.",
+	"expectedAddress": "0xc2b78104907f722dabac4c69f826a522b2754de4",
+	"deploymentInput": "0x00000000000000000000000000000000000000000000000000000000000000006080806040523461001657610dd1908161001c8239f35b600080fdfe60e06040523461001a57610012366100c7565b602081519101f35b600080fd5b6040810190811067ffffffffffffffff82111761003b57604052565b7f4e487b7100000000000000000000000000000000000000000000000000000000600052604160045260246000fd5b60e0810190811067ffffffffffffffff82111761003b57604052565b90601f7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffe0910116810190811067ffffffffffffffff82111761003b57604052565b60a08103610193578060201161001a57600060409180831161018f578060601161018f578060801161018f5760a01161018c57815182810181811067ffffffffffffffff82111761015f579061013291845260603581526080356020820152833560203584356101ab565b15610156575060ff6001915b5191166020820152602081526101538161001f565b90565b60ff909161013e565b6024837f4e487b710000000000000000000000000000000000000000000000000000000081526041600452fd5b80fd5b5080fd5b5060405160006020820152602081526101538161001f565b909283158015610393575b801561038b575b8015610361575b6103585780519060206101dc818301938451906103bd565b1561034d57604051948186019082825282604088015282606088015260808701527fffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc63254f60a08701527fffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632551958660c082015260c081526102588161006a565b600080928192519060055afa903d15610345573d9167ffffffffffffffff831161031857604051926102b1857fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffe0601f8401160185610086565b83523d828585013e5b156102eb57828280518101031261018c5750015190516102e693929185908181890994099151906104eb565b061490565b807f4e487b7100000000000000000000000000000000000000000000000000000000602492526001600452fd5b6024827f4e487b710000000000000000000000000000000000000000000000000000000081526041600452fd5b6060916102ba565b505050505050600090565b50505050600090565b507fffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc6325518310156101c4565b5082156101bd565b507fffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc6325518410156101b6565b7fffffffff00000001000000000000000000000000ffffffffffffffffffffffff90818110801590610466575b8015610455575b61044d577f5ac635d8aa3a93e7b3ebbd55769886bc651d06b0cc53b0f63bce3c3e27d2604b8282818080957fffffffff00000001000000000000000000000000fffffffffffffffffffffffc0991818180090908089180091490565b505050600090565b50801580156103f1575082156103f1565b50818310156103ea565b7f800000000000000000000000000000000000000000000000000000000000000081146104bc577fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff0190565b7f4e487b7100000000000000000000000000000000000000000000000000000000600052601160045260246000fd5b909192608052600091600160a05260a05193600092811580610718575b61034d57610516838261073d565b95909460ff60c05260005b600060c05112156106ef575b60a05181036106a1575050507f4fe342e2fe1a7f9b8ee7eb4a7c0f9e162bce33576b315ececbb6406837bf51f5957f6b17d1f2e12c4247f8bce6e563a440f277037d812deb33a0f4a13945d898c2969594939291965b600060c05112156105c7575050505050507fffffffff00000001000000000000000000000000ffffffffffffffffffffffff91506105c260a051610ca2565b900990565b956105d9929394959660a05191610a98565b9097929181928960a0528192819a6105f66080518960c051610722565b61060160c051610470565b60c0528061061b5750505050505b96959493929196610583565b969b5061067b96939550919350916001810361068857507f4fe342e2fe1a7f9b8ee7eb4a7c0f9e162bce33576b315ececbb6406837bf51f5937f6b17d1f2e12c4247f8bce6e563a440f277037d812deb33a0f4a13945d898c29693610952565b979297919060a05261060f565b6002036106985786938a93610952565b88938893610952565b600281036106ba57505050829581959493929196610583565b9197917ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffd0161060f575095508495849661060f565b506106ff6080518560c051610722565b8061070b60c051610470565b60c052156105215761052d565b5060805115610508565b91906002600192841c831b16921c1681018091116104bc5790565b8015806107ab575b6107635761075f91610756916107b3565b92919091610c42565b9091565b50507f6b17d1f2e12c4247f8bce6e563a440f277037d812deb33a0f4a13945d898c296907f4fe342e2fe1a7f9b8ee7eb4a7c0f9e162bce33576b315ececbb6406837bf51f590565b508115610745565b919082158061094a575b1561080f57507f6b17d1f2e12c4247f8bce6e563a440f277037d812deb33a0f4a13945d898c29691507f4fe342e2fe1a7f9b8ee7eb4a7c0f9e162bce33576b315ececbb6406837bf51f5906001908190565b7fb01cbd1c01e58065711814b583f061e9d431cca994cea1313449bf97c840ae0a917fffffffff00000001000000000000000000000000ffffffffffffffffffffffff808481600186090894817f94e82e0c1ed3bdb90743191a9c5bbf0d88fc827fd214cc5f0b5ec6ba27673d6981600184090893841561091b575050808084800993840994818460010994828088600109957f6b17d1f2e12c4247f8bce6e563a440f277037d812deb33a0f4a13945d898c29609918784038481116104bc5784908180867fffffffff00000001000000000000000000000000fffffffffffffffffffffffd0991818580090808978885038581116104bc578580949281930994080908935b93929190565b9350935050921560001461093b5761093291610b6d565b91939092610915565b50506000806000926000610915565b5080156107bd565b91949592939095811580610a90575b15610991575050831580610989575b61097a5793929190565b50600093508392508291508190565b508215610970565b85919294951580610a88575b610a78577fffffffff00000001000000000000000000000000ffffffffffffffffffffffff968703918783116104bc5787838189850908938689038981116104bc5789908184840908928315610a5d575050818880959493928180848196099b8c9485099b8c920999099609918784038481116104bc5784908180867fffffffff00000001000000000000000000000000fffffffffffffffffffffffd0991818580090808978885038581116104bc578580949281930994080908929190565b965096505050509093501560001461093b5761093291610b6d565b9550509150915091906001908190565b50851561099d565b508015610961565b939092821580610b65575b61097a577fffffffff00000001000000000000000000000000ffffffffffffffffffffffff908185600209948280878009809709948380888a0998818080808680097fffffffff00000001000000000000000000000000fffffffffffffffffffffffc099280096003090884808a7fffffffff00000001000000000000000000000000fffffffffffffffffffffffd09818380090898898603918683116104bc57888703908782116104bc578780969481809681950994089009089609930990565b508015610aa3565b919091801580610c3a575b610c2d577fffffffff00000001000000000000000000000000ffffffffffffffffffffffff90818460020991808084800980940991817fffffffff00000001000000000000000000000000fffffffffffffffffffffffc81808088860994800960030908958280837fffffffff00000001000000000000000000000000fffffffffffffffffffffffd09818980090896878403918483116104bc57858503928584116104bc5785809492819309940890090892565b5060009150819081908190565b508215610b78565b909392821580610c9a575b610c8d57610c5a90610ca2565b9182917fffffffff00000001000000000000000000000000ffffffffffffffffffffffff80809581940980099009930990565b5050509050600090600090565b508015610c4d565b604051906020918281019183835283604083015283606083015260808201527fffffffff00000001000000000000000000000000fffffffffffffffffffffffd60a08201527fffffffff00000001000000000000000000000000ffffffffffffffffffffffff60c082015260c08152610d1a8161006a565b600080928192519060055afa903d15610d93573d9167ffffffffffffffff83116103185760405192610d73857fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffe0601f8401160185610086565b83523d828585013e5b156102eb57828280518101031261018c5750015190565b606091610d7c56fea2646970667358221220fa55558b04ced380e93d0a46be01bb895ff30f015c50c516e898c341cd0a230264736f6c63430008150033",
+	"runtimeCodeHash": "0x3cd725b6ba67b40b7979190c41a015e82cf21e098eb61832ba623f8538bab7fc"
+};
 var callPolicy = {
 	"repository": "https://github.com/cartesi/erc-4337-devnet",
 	"commit": "2d86aeea200a52919304b535454850182b80e563",
@@ -841,6 +875,7 @@ function runtimeModule(chainId, id, module, passkey = false) {
 		chainId,
 		module
 	});
+	if (prepared === null) throw new Error(`External runtime module: ${module}`);
 	return [
 		id,
 		{
@@ -852,6 +887,17 @@ function runtimeModule(chainId, id, module, passkey = false) {
 		passkey
 	];
 }
+/** Externally owned module deployments are prerequisites, never CLI transactions. */
+function externalComponent(id, artifact, passkey = false) {
+	return {
+		id,
+		address: artifact.expectedAddress,
+		runtimeCodeHash: artifact.runtimeCodeHash,
+		required: !passkey,
+		passkeySession: passkey,
+		deploymentInput: null
+	};
+}
 function components(chainId) {
 	const deployment$1 = kernelDeployment({ chainId });
 	const implementationHash = deployment$1.implementationDeployment?.runtimeCodeHash;
@@ -883,13 +929,13 @@ function components(chainId) {
 			runtimeCodeHash: deployment$1.factoryRuntimeCodeHash
 		}, deployment$1.factory),
 		deployable(...runtimeModule(chainId, "validityPolicy", "validity_policy")),
-		deployable("callPolicy", callPolicy, pinnedPolicyModule("call")),
-		deployable("rateLimitPolicy", rateLimitPolicy, pinnedPolicyModule("operation-limit")),
+		externalComponent("callPolicy", callPolicy),
+		externalComponent("rateLimitPolicy", rateLimitPolicy),
 		deployable(...runtimeModule(chainId, "resettingRateLimitPolicy", "rate_limit_policy")),
-		deployable("ecdsaSigner", ecdsaSigner, pinnedSignerModule("ecdsa")),
+		externalComponent("ecdsaSigner", ecdsaSigner),
 		deployable("p256Validator", p256Validator, p256Validator.expectedAddress, false),
 		deployable(...runtimeModule(chainId, "webAuthnSigner", "webauthn_signer", true)),
-		deployable(...runtimeModule(chainId, "p256Verifier", "p256_verifier", true))
+		externalComponent("p256Verifier", p256Verifier, true)
 	];
 }
 //#endregion
@@ -1115,7 +1161,7 @@ async function main() {
 	}
 	if (deploying) {
 		const [{ deployRuntime, DeploymentError }, { DeploymentJournal }, { privateKeyToAccount }, { homedir }, { join, resolve }] = await Promise.all([
-			import("./deploy-BtvOPlub.mjs"),
+			import("./deploy-HTOl_P0V.mjs"),
 			import("./journal-DkNIXY4X.mjs"),
 			import("viem/accounts"),
 			import("node:os"),

package/dist/{deploy-BtvOPlub.mjs → deploy-HTOl_P0V.mjs}

@@ -12,9 +12,9 @@ var DeploymentError = class extends Error {
 function deploys(row) {
 	return row.required || row.passkeySession;
 }
-function validateReadiness(report) {
+function validateReadiness(report, manifest) {
 	if (report.error || report.components.some((row) => deploys(row) && (row.status === "mismatch" || row.status === "unreadable"))) throw new DeploymentError("deployment_evidence_invalid");
-	for (const id of ["entryPoint", "create2Deployer"]) if (report.components.find((row) => row.id === id)?.status !== "verified") throw new DeploymentError("deployment_prerequisite_missing");
+	for (const { id } of manifest.filter((row) => deploys(row) && row.deploymentInput === null)) if (report.components.find((row) => row.id === id)?.status !== "verified") throw new DeploymentError("deployment_prerequisite_missing");
 	if (report.components.find((row) => row.id === "kernelFactory")?.status === "verified" && report.factoryBinding !== "verified") throw new DeploymentError("deployment_evidence_invalid");
 }
 function recordObject(value) {
@@ -74,7 +74,7 @@ async function deployRuntime(input) {
 	const manifest = components(chainId);
 	const deployer = kernelDeployment({ chainId }).create2Deployer;
 	let report = await doctor(chainId, rpc);
-	validateReadiness(report);
+	validateReadiness(report, manifest);
 	const result = (status, transactionHash = null) => ({
 		version: "oaath.runtime-deployment/v1",
 		chainId,
@@ -153,7 +153,7 @@ async function deployRuntime(input) {
 		}
 	}
 	report = await doctor(chainId, rpc);
-	validateReadiness(report);
+	validateReadiness(report, manifest);
 	if (!report.ready || !report.passkeySessionsReady) throw new DeploymentError("deployment_evidence_invalid");
 	return result("ready");
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oaath/cli",
-  "version": "0.3.1",
+  "version": "0.3.3",
   "description": "OAAth runtime deployment and readiness commands.",
   "type": "module",
   "license": "Apache-2.0",
@@ -33,7 +33,7 @@
     "release:check": "bun pm pack --dry-run"
   },
   "dependencies": {
-    "@oaath/sdk": "0.3.1",
+    "@oaath/sdk": "0.3.3",
     "viem": "2.55.8"
   },
   "devDependencies": {