@seams/wallet 0.6.2 → 0.7.3

package/dist/public/sdk/workers/ecdsa-online-client.worker.js

@@ -258,11 +258,10 @@ var DELEGATED_WALLET_PERMISSION_VALUES = [
 ];
 var DELEGATED_WALLET_PERMISSION_VALUE_SET = new Set(DELEGATED_WALLET_PERMISSION_VALUES);
 var canonicalPermissionSetBrand = Symbol("canonicalPermissionSetBrand");
+// ../shared-ts/src/utils/routerAbEcdsaDerivation.ts
+var ROUTER_AB_ECDSA_PRESIGN_CEREMONY_MAX_LIFETIME_MS = 5 * 60000;
 
-// ../shared-ts/src/authorization/walletAuthority.ts
-var TEXT_ENCODER = new TextEncoder;
-
-// ../shared-ts/src/utils/registrationIntent.ts
+// ../shared-ts/src/utils/registrationIds.ts
 var SERVER_ALLOCATED_WALLET_ADJECTIVES = [
   "alpine",
   "amber",
@@ -398,121 +397,14 @@ var SERVER_ALLOCATED_WALLET_NOUNS = [
 var SERVER_ALLOCATED_WALLET_ADJECTIVE_SET = new Set(SERVER_ALLOCATED_WALLET_ADJECTIVES);
 var SERVER_ALLOCATED_WALLET_NOUN_SET = new Set(SERVER_ALLOCATED_WALLET_NOUNS);
 
-// ../shared-ts/src/utils/routerAbEd25519Yao.ts
-var ED25519_YAO_CONTROL_CIPHERTEXT_MAX_BYTES_V1 = 64 * 1024;
+// ../shared-ts/src/utils/digestEncoding.ts
+var TEXT_ENCODER = new TextEncoder;
+
+// ../shared-ts/src/utils/routerAbEd25519YaoDigests.ts
 var UTF8 = new TextEncoder;
 
-// ../shared-ts/src/device-linking/parsers.ts
-var QR_FIELDS = [
-  "version",
-  "purpose",
-  "linkSessionId",
-  "linkPublicKeyB64u",
-  "devicePublicKeyB64u",
-  "requestedPermission",
-  "targetFactor",
-  "issuedAtMs",
-  "expiresAtMs"
-];
-var QR_EMAIL_FIELDS = [...QR_FIELDS, "targetEmail"];
-var COMPACT_QR_FIELDS = ["v", "s", "l", "d", "a", "f", "i", "e"];
-var COMPACT_QR_EMAIL_FIELDS = [...COMPACT_QR_FIELDS, "t"];
-var ENROLLMENT_FIELDS = [
-  "kind",
-  "linkSessionId",
-  "walletId",
-  "enrollmentId",
-  "deviceId",
-  "linkPublicKeyB64u",
-  "devicePublicKeyB64u",
-  "permission",
-  "targetFactor",
-  "ownerAuthorization",
-  "approvedAtMs",
-  "expiresAtMs"
-];
-var ENROLLMENT_FIELDS_WITH_SOURCE_CONTRIBUTION = [
-  ...ENROLLMENT_FIELDS,
-  "sourceContribution"
-];
-var CREDENTIAL_BASE_FIELDS = [
-  "kind",
-  "linkSessionId",
-  "walletId",
-  "enrollmentId",
-  "deviceId",
-  "walletAuthMethodId",
-  "targetFactor",
-  "targetPreparationDigestB64u",
-  "ordinarySignerMaterialRecipientRequests",
-  "registeredAtMs"
-];
-var PASSKEY_CREDENTIAL_FIELDS = [...CREDENTIAL_BASE_FIELDS, "webauthnRegistration"];
-var EMAIL_OTP_CREDENTIAL_FIELDS = [
-  ...CREDENTIAL_BASE_FIELDS,
-  "targetEmail",
-  "emailOtpVerificationGrant"
-];
-var EMAIL_OTP_CREDENTIAL_NEW_FIELDS = [
-  ...EMAIL_OTP_CREDENTIAL_FIELDS,
-  "emailOtpEnrollment"
-];
-var TARGET_PREPARATION_BASE_FIELDS = [
-  "kind",
-  "linkSessionId",
-  "walletId",
-  "enrollmentId",
-  "deviceId",
-  "deliveryRecipientPublicKey65B64u",
-  "walletAuthMethodId",
-  "ed25519ExportRoot",
-  "targetFactor",
-  "ordinarySignerMaterialRecipientRequirements",
-  "issuedAtMs",
-  "expiresAtMs"
-];
-var TARGET_PREPARATION_PASSKEY_FIELDS = [
-  ...TARGET_PREPARATION_BASE_FIELDS,
-  "passkeyCreationOptions",
-  "passkeyConfigurationDigestB64u"
-];
-var TARGET_PREPARATION_EMAIL_FIELDS = [
-  ...TARGET_PREPARATION_BASE_FIELDS,
-  "targetEmail",
-  "enrollment",
-  "baseWalletAuthMethodId"
-];
-var TARGET_PREPARATION_EMAIL_NEW_FIELDS = [
-  ...TARGET_PREPARATION_BASE_FIELDS,
-  "targetEmail",
-  "enrollment"
-];
-var EMAIL_OTP_VERIFICATION_GRANT_BASE_FIELDS = [
-  "kind",
-  "grantId",
-  "grantToken",
-  "challengeId",
-  "linkSessionId",
-  "walletId",
-  "enrollmentId",
-  "deviceId",
-  "targetPreparationDigestB64u",
-  "targetEmail",
-  "enrollment",
-  "emailHashHex",
-  "registrationAuthorityId",
-  "providerUserId",
-  "authorityDigestB64u",
-  "issuedAtMs",
-  "expiresAtMs"
-];
-var EMAIL_OTP_VERIFICATION_GRANT_FIELDS = [
-  ...EMAIL_OTP_VERIFICATION_GRANT_BASE_FIELDS,
-  "baseWalletAuthMethodId"
-];
-var P256_FIELD_PRIME = BigInt("0xffffffff00000001000000000000000000000000ffffffffffffffffffffffff");
-var P256_CURVE_A = P256_FIELD_PRIME - 3n;
-var P256_CURVE_B = BigInt("0x5ac635d8aa3a93e7b3ebbd55769886bc651d06b0cc53b0f63bce3c3e27d2604b");
+// ../shared-ts/src/utils/routerAbEd25519Yao.ts
+var ED25519_YAO_CONTROL_CIPHERTEXT_MAX_BYTES_V1 = 64 * 1024;
 
 // src/core/signingEngine/workerManager/ecdsaClientWorkerChannels.ts
 var EcdsaClientWorkerControlKind = {

package/dist/public/sdk/workers/ecdsa-presign-client.worker.js

@@ -224,6 +224,21 @@ function base64UrlDecode(base64Url) {
   return base64Decode(normalized + padding);
 }
 
+// ../shared-ts/src/utils/normalize.ts
+function normalizeTrimmedString(value) {
+  return String(value ?? "").trim();
+}
+// ../shared-ts/src/utils/validation.ts
+function coerceNonNullishString(value, label) {
+  const normalized = normalizeTrimmedString(value);
+  if (!normalized)
+    throw new Error(`${label} is required`);
+  return normalized;
+}
+function isObject(x) {
+  return x !== null && typeof x === "object";
+}
+
 // src/core/signingEngine/workerManager/workerDeferred.ts
 class WorkerDeferred {
   constructor() {
@@ -315,10 +330,6 @@ function parseDomainId(raw, fieldName) {
 function parseRootShareEpoch(raw) {
   return parseDomainId(raw, "rootShareEpoch");
 }
-// ../shared-ts/src/utils/validation.ts
-function isObject(x) {
-  return x !== null && typeof x === "object";
-}
 // ../shared-ts/src/authorization/capabilityKinds.ts
 var CAPABILITY_KINDS = {
   vaultAccess: "vault_access",
@@ -368,11 +379,10 @@ var DELEGATED_WALLET_PERMISSION_VALUES = [
 ];
 var DELEGATED_WALLET_PERMISSION_VALUE_SET = new Set(DELEGATED_WALLET_PERMISSION_VALUES);
 var canonicalPermissionSetBrand = Symbol("canonicalPermissionSetBrand");
+// ../shared-ts/src/utils/routerAbEcdsaDerivation.ts
+var ROUTER_AB_ECDSA_PRESIGN_CEREMONY_MAX_LIFETIME_MS = 5 * 60000;
 
-// ../shared-ts/src/authorization/walletAuthority.ts
-var TEXT_ENCODER = new TextEncoder;
-
-// ../shared-ts/src/utils/registrationIntent.ts
+// ../shared-ts/src/utils/registrationIds.ts
 var SERVER_ALLOCATED_WALLET_ADJECTIVES = [
   "alpine",
   "amber",
@@ -508,121 +518,14 @@ var SERVER_ALLOCATED_WALLET_NOUNS = [
 var SERVER_ALLOCATED_WALLET_ADJECTIVE_SET = new Set(SERVER_ALLOCATED_WALLET_ADJECTIVES);
 var SERVER_ALLOCATED_WALLET_NOUN_SET = new Set(SERVER_ALLOCATED_WALLET_NOUNS);
 
-// ../shared-ts/src/utils/routerAbEd25519Yao.ts
-var ED25519_YAO_CONTROL_CIPHERTEXT_MAX_BYTES_V1 = 64 * 1024;
+// ../shared-ts/src/utils/digestEncoding.ts
+var TEXT_ENCODER = new TextEncoder;
+
+// ../shared-ts/src/utils/routerAbEd25519YaoDigests.ts
 var UTF8 = new TextEncoder;
 
-// ../shared-ts/src/device-linking/parsers.ts
-var QR_FIELDS = [
-  "version",
-  "purpose",
-  "linkSessionId",
-  "linkPublicKeyB64u",
-  "devicePublicKeyB64u",
-  "requestedPermission",
-  "targetFactor",
-  "issuedAtMs",
-  "expiresAtMs"
-];
-var QR_EMAIL_FIELDS = [...QR_FIELDS, "targetEmail"];
-var COMPACT_QR_FIELDS = ["v", "s", "l", "d", "a", "f", "i", "e"];
-var COMPACT_QR_EMAIL_FIELDS = [...COMPACT_QR_FIELDS, "t"];
-var ENROLLMENT_FIELDS = [
-  "kind",
-  "linkSessionId",
-  "walletId",
-  "enrollmentId",
-  "deviceId",
-  "linkPublicKeyB64u",
-  "devicePublicKeyB64u",
-  "permission",
-  "targetFactor",
-  "ownerAuthorization",
-  "approvedAtMs",
-  "expiresAtMs"
-];
-var ENROLLMENT_FIELDS_WITH_SOURCE_CONTRIBUTION = [
-  ...ENROLLMENT_FIELDS,
-  "sourceContribution"
-];
-var CREDENTIAL_BASE_FIELDS = [
-  "kind",
-  "linkSessionId",
-  "walletId",
-  "enrollmentId",
-  "deviceId",
-  "walletAuthMethodId",
-  "targetFactor",
-  "targetPreparationDigestB64u",
-  "ordinarySignerMaterialRecipientRequests",
-  "registeredAtMs"
-];
-var PASSKEY_CREDENTIAL_FIELDS = [...CREDENTIAL_BASE_FIELDS, "webauthnRegistration"];
-var EMAIL_OTP_CREDENTIAL_FIELDS = [
-  ...CREDENTIAL_BASE_FIELDS,
-  "targetEmail",
-  "emailOtpVerificationGrant"
-];
-var EMAIL_OTP_CREDENTIAL_NEW_FIELDS = [
-  ...EMAIL_OTP_CREDENTIAL_FIELDS,
-  "emailOtpEnrollment"
-];
-var TARGET_PREPARATION_BASE_FIELDS = [
-  "kind",
-  "linkSessionId",
-  "walletId",
-  "enrollmentId",
-  "deviceId",
-  "deliveryRecipientPublicKey65B64u",
-  "walletAuthMethodId",
-  "ed25519ExportRoot",
-  "targetFactor",
-  "ordinarySignerMaterialRecipientRequirements",
-  "issuedAtMs",
-  "expiresAtMs"
-];
-var TARGET_PREPARATION_PASSKEY_FIELDS = [
-  ...TARGET_PREPARATION_BASE_FIELDS,
-  "passkeyCreationOptions",
-  "passkeyConfigurationDigestB64u"
-];
-var TARGET_PREPARATION_EMAIL_FIELDS = [
-  ...TARGET_PREPARATION_BASE_FIELDS,
-  "targetEmail",
-  "enrollment",
-  "baseWalletAuthMethodId"
-];
-var TARGET_PREPARATION_EMAIL_NEW_FIELDS = [
-  ...TARGET_PREPARATION_BASE_FIELDS,
-  "targetEmail",
-  "enrollment"
-];
-var EMAIL_OTP_VERIFICATION_GRANT_BASE_FIELDS = [
-  "kind",
-  "grantId",
-  "grantToken",
-  "challengeId",
-  "linkSessionId",
-  "walletId",
-  "enrollmentId",
-  "deviceId",
-  "targetPreparationDigestB64u",
-  "targetEmail",
-  "enrollment",
-  "emailHashHex",
-  "registrationAuthorityId",
-  "providerUserId",
-  "authorityDigestB64u",
-  "issuedAtMs",
-  "expiresAtMs"
-];
-var EMAIL_OTP_VERIFICATION_GRANT_FIELDS = [
-  ...EMAIL_OTP_VERIFICATION_GRANT_BASE_FIELDS,
-  "baseWalletAuthMethodId"
-];
-var P256_FIELD_PRIME = BigInt("0xffffffff00000001000000000000000000000000ffffffffffffffffffffffff");
-var P256_CURVE_A = P256_FIELD_PRIME - 3n;
-var P256_CURVE_B = BigInt("0x5ac635d8aa3a93e7b3ebbd55769886bc651d06b0cc53b0f63bce3c3e27d2604b");
+// ../shared-ts/src/utils/routerAbEd25519Yao.ts
+var ED25519_YAO_CONTROL_CIPHERTEXT_MAX_BYTES_V1 = 64 * 1024;
 
 // src/core/signingEngine/workerManager/ecdsaClientWorkerChannels.ts
 var EcdsaClientWorkerControlKind = {
@@ -701,8 +604,7 @@ var opaqueMaterials = new Map;
 var pendingOpaqueAuthorities = new Map;
 var opaqueSessionPorts = new Map;
 var opaqueSessionBindings = new Map;
-var derivationPort = null;
-var linkedHolderPort = null;
+var authorityChannel = null;
 var onlinePort = null;
 var messageQueue = Promise.resolve();
 function randomHandle(prefix) {
@@ -723,12 +625,6 @@ function toBytes(value, label) {
   }
   throw new Error(`${label} must be bytes`);
 }
-function requireString(value, label) {
-  const normalized = String(value ?? "").trim();
-  if (!normalized)
-    throw new Error(`${label} is required`);
-  return normalized;
-}
 function requireFutureTimestamp(value, label) {
   const timestamp = Number(value);
   if (!Number.isSafeInteger(timestamp) || timestamp <= Date.now()) {
@@ -783,7 +679,7 @@ function requestOpaqueAuthority(port, request, transfer = []) {
   return deferred.promise;
 }
 async function initializeSession(payload) {
-  const sessionId = requireString(payload.sessionId, "sessionId");
+  const sessionId = coerceNonNullishString(payload.sessionId, "sessionId");
   if (opaqueSessionPorts.has(sessionId))
     await abortSession({ sessionId });
   const poolIdentity = parseEcdsaClientPresignPoolIdentity(payload.poolIdentity);
@@ -795,91 +691,82 @@ async function initializeSession(payload) {
   if (materialExpiresAtMs < ceremonyExpiresAtMs) {
     throw new Error("ECDSA presign material expiry must cover the ceremony");
   }
+  const channel = authorityChannel;
+  const requestId = randomHandle("ecdsa-presign-init");
+  const groupPublicKeyBuffer = groupPublicKey33.slice().buffer;
+  let request;
   switch (payload.authority.kind) {
-    case "role_local_derivation_handle": {
-      if (!derivationPort) {
+    case "role_local_derivation_handle":
+      if (channel?.kind !== "role_local_derivation_handle") {
         throw new Error("ECDSA presign client has no derivation material channel");
       }
-      const requestId = randomHandle("ecdsa-role-local-presign");
-      const groupPublicKeyBuffer = groupPublicKey33.slice().buffer;
-      const result = await requestOpaqueAuthority(derivationPort, {
+      request = {
         kind: "opaque_ecdsa_presign_session_init_v1",
         requestId,
         sessionId,
         authority: {
           kind: "role_local_derivation_handle",
-          materialHandle: requireString(payload.authority.materialHandle, "materialHandle"),
+          materialHandle: coerceNonNullishString(payload.authority.materialHandle, "materialHandle"),
           material: payload.authority.material
         },
         poolIdentity,
         groupPublicKey33: groupPublicKeyBuffer,
         ceremonyExpiresAtMs,
         materialExpiresAtMs
-      }, [groupPublicKeyBuffer]);
-      const progress = requireOpaqueProgress(result);
-      retainCompletedMaterial({
-        progress,
-        authorityPort: derivationPort,
-        poolIdentity,
-        groupPublicKey33,
-        expiresAtMs: materialExpiresAtMs
-      });
-      if (progress.event !== "presign_done") {
-        opaqueSessionPorts.set(sessionId, derivationPort);
-        opaqueSessionBindings.set(sessionId, {
-          poolIdentity,
-          groupPublicKey33: groupPublicKey33.slice(),
-          ceremonyExpiresAtMs,
-          materialExpiresAtMs
-        });
-      }
-      return { authority: { kind: "role_local_derivation_handle" }, progress };
-    }
-    case "linked_holder_signing_material": {
-      if (!linkedHolderPort) {
+      };
+      break;
+    case "linked_holder_signing_material":
+      if (channel?.kind !== "linked_holder_signing_material") {
         throw new Error("ECDSA presign client has no linked holder material channel");
       }
-      const requestId = randomHandle("linked-holder-ecdsa-presign");
-      const groupPublicKeyBuffer = groupPublicKey33.slice().buffer;
-      const result = await requestOpaqueAuthority(linkedHolderPort, {
+      request = {
         kind: "opaque_ecdsa_presign_session_init_v1",
         requestId,
         sessionId,
         authority: {
           kind: "linked_holder_signing_material",
-          holderHandleId: requireString(payload.authority.holderHandleId, "holderHandleId")
+          holderHandleId: coerceNonNullishString(payload.authority.holderHandleId, "holderHandleId")
         },
         poolIdentity,
         groupPublicKey33: groupPublicKeyBuffer,
         ceremonyExpiresAtMs,
         materialExpiresAtMs
-      }, [groupPublicKeyBuffer]);
-      const progress = requireOpaqueProgress(result);
-      retainCompletedMaterial({
-        progress,
-        authorityPort: linkedHolderPort,
-        poolIdentity,
-        groupPublicKey33,
-        expiresAtMs: materialExpiresAtMs
-      });
-      if (progress.event !== "presign_done") {
-        opaqueSessionPorts.set(sessionId, linkedHolderPort);
-        opaqueSessionBindings.set(sessionId, {
-          poolIdentity,
-          groupPublicKey33: groupPublicKey33.slice(),
-          ceremonyExpiresAtMs,
-          materialExpiresAtMs
-        });
-      }
-      return { authority: { kind: "linked_holder_signing_material" }, progress };
-    }
+      };
+      break;
     default:
       payload.authority;
       throw new Error("Unsupported ECDSA presign authority");
   }
+  const result = await requestOpaqueAuthority(channel.port, request, [groupPublicKeyBuffer]);
+  const progress = requireOpaqueProgress(result);
+  retainCompletedMaterial({
+    progress,
+    authorityPort: channel.port,
+    poolIdentity,
+    groupPublicKey33,
+    expiresAtMs: materialExpiresAtMs
+  });
+  if (progress.event !== "presign_done") {
+    opaqueSessionPorts.set(sessionId, channel.port);
+    opaqueSessionBindings.set(sessionId, {
+      poolIdentity,
+      groupPublicKey33: groupPublicKey33.slice(),
+      ceremonyExpiresAtMs,
+      materialExpiresAtMs
+    });
+  }
+  switch (request.authority.kind) {
+    case "role_local_derivation_handle":
+      return { authority: { kind: "role_local_derivation_handle" }, progress };
+    case "linked_holder_signing_material":
+      return { authority: { kind: "linked_holder_signing_material" }, progress };
+    default:
+      request.authority;
+      throw new Error("Unsupported ECDSA presign authority");
+  }
 }
 async function stepSession(payload) {
-  const sessionId = requireString(payload.sessionId, "sessionId");
+  const sessionId = coerceNonNullishString(payload.sessionId, "sessionId");
   const opaquePort = opaqueSessionPorts.get(sessionId);
   if (opaquePort) {
     const activeBinding = opaqueSessionBindings.get(sessionId);
@@ -922,7 +809,7 @@ async function stepSession(payload) {
   throw new Error("Unknown ECDSA Client presign session");
 }
 async function abortSession(payload) {
-  const sessionId = requireString(payload.sessionId, "sessionId");
+  const sessionId = coerceNonNullishString(payload.sessionId, "sessionId");
   const opaquePort = opaqueSessionPorts.get(sessionId);
   if (opaquePort) {
     opaqueSessionPorts.delete(sessionId);
@@ -958,7 +845,7 @@ async function presignatureId(bigR33) {
 function retainCompletedMaterial(args) {
   if (args.progress.event !== "presign_done")
     return;
-  const materialHandle = requireString(args.progress.presignatureHandle, "presignatureHandle");
+  const materialHandle = coerceNonNullishString(args.progress.presignatureHandle, "presignatureHandle");
   const bigR33 = toBytes(args.progress.presignatureBigR33, "presignatureBigR33");
   if (bigR33.length !== 33)
     throw new Error("presignatureBigR33 must be 33 bytes");
@@ -1022,8 +909,8 @@ function residentAuthorityMaterialHandle(state) {
   }
 }
 async function admitPresignature(payload) {
-  const materialHandle = requireString(payload.materialHandle, "materialHandle");
-  const expectedPresignatureId = requireString(payload.expectedPresignatureId, "expectedPresignatureId");
+  const materialHandle = coerceNonNullishString(payload.materialHandle, "materialHandle");
+  const expectedPresignatureId = coerceNonNullishString(payload.expectedPresignatureId, "expectedPresignatureId");
   const entry = requireOpaqueMaterial(materialHandle, parseEcdsaClientPresignPoolIdentity(payload.poolIdentity));
   const actualPresignatureId = await presignatureId(entry.bigR33);
   if (actualPresignatureId !== expectedPresignatureId) {
@@ -1069,14 +956,14 @@ async function admitPresignature(payload) {
   };
 }
 async function destroyPresignature(payload) {
-  const materialHandle = requireString(payload.materialHandle, "materialHandle");
+  const materialHandle = coerceNonNullishString(payload.materialHandle, "materialHandle");
   const entry = requireOpaqueMaterial(materialHandle, parseEcdsaClientPresignPoolIdentity(payload.poolIdentity));
   opaqueMaterials.delete(materialHandle);
   await destroyOpaqueMaterial(entry);
   return { kind: "ecdsa_client_presignature_destroyed_v1", materialHandle };
 }
 async function clearWalletPresignatureWorkerState(payload) {
-  const walletId = requireString(payload.walletId, "walletId");
+  const walletId = coerceNonNullishString(payload.walletId, "walletId");
   let clearedCount = 0;
   for (const [sessionId, binding] of [...opaqueSessionBindings]) {
     if (binding.poolIdentity.walletId !== walletId)
@@ -1104,11 +991,11 @@ async function clearWalletPresignatureWorkerState(payload) {
   };
 }
 async function reservePresignature(payload) {
-  const materialHandle = requireString(payload.materialHandle, "materialHandle");
+  const materialHandle = coerceNonNullishString(payload.materialHandle, "materialHandle");
   const poolIdentity = parseEcdsaClientPresignPoolIdentity(payload.poolIdentity);
-  const expectedPresignatureId = requireString(payload.expectedPresignatureId, "expectedPresignatureId");
-  const requestBinding = requireString(payload.requestBinding, "requestBinding");
-  const reservationId = requireString(payload.reservationId, "reservationId");
+  const expectedPresignatureId = coerceNonNullishString(payload.expectedPresignatureId, "expectedPresignatureId");
+  const requestBinding = coerceNonNullishString(payload.requestBinding, "requestBinding");
+  const reservationId = coerceNonNullishString(payload.reservationId, "reservationId");
   const leaseExpiresAtMs = requireFutureTimestamp(payload.leaseExpiresAtMs, "leaseExpiresAtMs");
   const entry = opaqueMaterials.get(materialHandle);
   if (!entry)
@@ -1190,10 +1077,10 @@ async function reservePresignature(payload) {
   return { kind: "reserved" };
 }
 async function commitPresignature(payload) {
-  const materialHandle = requireString(payload.materialHandle, "materialHandle");
+  const materialHandle = coerceNonNullishString(payload.materialHandle, "materialHandle");
   const entry = requireOpaqueMaterial(materialHandle, parseEcdsaClientPresignPoolIdentity(payload.poolIdentity));
-  const requestBinding = requireString(payload.requestBinding, "requestBinding");
-  const reservationId = requireString(payload.reservationId, "reservationId");
+  const requestBinding = coerceNonNullishString(payload.requestBinding, "requestBinding");
+  const reservationId = coerceNonNullishString(payload.reservationId, "reservationId");
   if (entry.state.kind !== "reserved" || entry.state.requestBinding !== requestBinding || entry.state.reservationId !== reservationId || Date.now() >= entry.state.leaseExpiresAtMs) {
     throw new Error("ECDSA Client presign commit failed: binding_rejected");
   }
@@ -1235,8 +1122,9 @@ async function listAvailablePresignatures(payload) {
       expiresAtMs: entry.expiresAtMs
     });
   }
-  if (derivationPort) {
-    const result = await requestOpaqueAuthority(derivationPort, {
+  const channel = authorityChannel;
+  if (channel?.kind === "role_local_derivation_handle") {
+    const result = await requestOpaqueAuthority(channel.port, {
       kind: "opaque_ecdsa_presign_material_list_v1",
       requestId: randomHandle("opaque-ecdsa-presign-list"),
       poolIdentity
@@ -1258,7 +1146,7 @@ async function listAvailablePresignatures(payload) {
         continue;
       }
       opaqueMaterials.set(materialHandle, {
-        authorityPort: derivationPort,
+        authorityPort: channel.port,
         poolIdentity,
         groupPublicKey33,
         bigR33: bigR33.buffer,
@@ -1280,29 +1168,23 @@ async function listAvailablePresignatures(payload) {
   }
   return refs.sort((left, right) => left.createdAtMs - right.createdAtMs);
 }
+function replaceAuthorityChannel(channel) {
+  if (authorityChannel) {
+    purgeAuthorityPort(authorityChannel.port, "ECDSA presign authority channel was replaced");
+    authorityChannel.port.close();
+  }
+  authorityChannel = channel;
+  channel.port.onmessage = handleOpaqueAuthorityResponse.bind(null, channel.port);
+  channel.port.onmessageerror = purgeAuthorityPort.bind(null, channel.port, "ECDSA presign authority channel failed");
+  channel.port.start();
+}
 function attachControlChannel(value) {
   if (isAttachEcdsaDerivationToPresignPort(value)) {
-    if (derivationPort) {
-      purgeAuthorityPort(derivationPort, "ECDSA derivation presign authority channel was replaced");
-    }
-    derivationPort?.close();
-    derivationPort = value.port;
-    derivationPort.onmessage = (event) => handleOpaqueAuthorityResponse(value.port, event);
-    derivationPort.onmessageerror = () => purgeAuthorityPort(value.port, "ECDSA derivation presign authority channel failed");
-    derivationPort.start();
+    replaceAuthorityChannel({ kind: "role_local_derivation_handle", port: value.port });
     return true;
   }
   if (isAttachLinkedHolderToPresignPort(value)) {
-    if (linkedHolderPort) {
-      purgeAuthorityPort(linkedHolderPort, "Linked holder ECDSA presign authority channel was replaced");
-    }
-    linkedHolderPort?.close();
-    linkedHolderPort = value.port;
-    linkedHolderPort.onmessage = (event) => handleOpaqueAuthorityResponse(value.port, event);
-    linkedHolderPort.onmessageerror = () => {
-      purgeAuthorityPort(value.port, "Linked holder ECDSA presign authority channel failed");
-    };
-    linkedHolderPort.start();
+    replaceAuthorityChannel({ kind: "linked_holder_signing_material", port: value.port });
     return true;
   }
   if (isAttachPresignToOnlinePort(value)) {
@@ -1315,10 +1197,10 @@ function attachControlChannel(value) {
   return false;
 }
 async function computeOnlineShare(payload) {
-  const materialHandle = requireString(payload.materialHandle, "materialHandle");
+  const materialHandle = coerceNonNullishString(payload.materialHandle, "materialHandle");
   const entry = requireOpaqueMaterial(materialHandle, parseEcdsaClientPresignPoolIdentity(payload.poolIdentity));
-  const requestBinding = requireString(payload.requestBinding, "requestBinding");
-  const reservationId = requireString(payload.reservationId, "reservationId");
+  const requestBinding = coerceNonNullishString(payload.requestBinding, "requestBinding");
+  const reservationId = coerceNonNullishString(payload.reservationId, "reservationId");
   if (entry.state.kind !== "committed" || entry.state.requestBinding !== requestBinding || entry.state.reservationId !== reservationId || Date.now() >= entry.state.leaseExpiresAtMs) {
     throw new Error("ECDSA Client presign material unavailable: binding_rejected");
   }