@seams/wallet-server 0.28.0 → 0.29.0

package/dist/esm/router/domains/ed25519Yao/export/routerAbEd25519YaoExport.js

@@ -12,12 +12,12 @@ import { ROUTER_AB_ED25519_YAO_EXPORT_ADMISSION_PATH_V1, ROUTER_AB_ED25519_YAO_E
 import { walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { parseSessionOrigin, parseVerifiedOwnerProofId } from "../../../../authorization/domain.js";
 import { buildVerifiedWalletOperationEmailOtpFactorResult, buildVerifiedWalletOperationPasskeyFactorResult } from "../../../../authorization/factorEvidence.js";
+import { WALLET_EMAIL_OTP_EXPORT_OPERATION } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
+import { parseWebAuthnAuthenticationCredential, webAuthnCredentialIdB64uFromCredential } from "../../../auth/webAuthnCredentialCodecs.js";
 import { normalizeCorsOrigin } from "../../../../core/SessionService.js";
 import { ROUTER_AB_TRACE_ID_HEADER_V1, createRouterAbTraceContextV1, parseRouterAbTraceContextV1 } from "../../../../shared-ts/src/utils/routerAbTraceContext.js";
 import { json, readJson } from "../../../framework/http.js";
 import { defineRoute } from "../../../framework/routeDefinitions.js";
-import { parseWebAuthnAuthenticationCredential, webAuthnCredentialIdB64uFromCredential } from "../../../auth/webAuthnCredentialCodecs.js";
-import { WALLET_EMAIL_OTP_EXPORT_OPERATION } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
 import { createRouterApiModule } from "../../../framework/modules.js";
 //#region src/router/domains/ed25519Yao/export/routerAbEd25519YaoExport.ts
 const EXPORT_AUTH_MAX_TTL_MS = 6e4;

package/dist/esm/router/domains/emailOtp/emailOtpRouteHandlers.js

@@ -3,8 +3,8 @@ import { isPlainObject } from "../../../shared-ts/src/utils/validation.js";
 import { base64UrlDecode, base64UrlEncode } from "../../../shared-ts/src/utils/base64.js";
 import { failure } from "../../../shared-ts/src/utils/failure.js";
 import "../../../shared-ts/src/utils/encoders.js";
-import { emailOtpStatusCode } from "./emailOtpSessionRouteHelpers.js";
 import { EMAIL_OTP_FACTOR_RELEASE_AAD_DOMAIN_V1 } from "../../../shared-ts/src/utils/emailOtpDomain.js";
+import { emailOtpStatusCode } from "./emailOtpSessionRouteHelpers.js";
 //#region src/router/domains/emailOtp/emailOtpRouteHandlers.ts
 function decodeEmailOtpFactorSecret32(value) {
 	const magnitude = base64UrlDecode(value);

package/dist/esm/router/domains/passkeyCustody/walletCustodyRegistrationCommit.js

@@ -4,11 +4,11 @@ import { parseDigestField, parseEnvelopeCiphertextB64u, parseEnvelopeNonceB64u,
 import { parsePasskeyCustodySecretBinding } from "../../../shared-ts/src/passkey-custody/custodySecretBinding.js";
 import { buildActiveEnvelopeLifecycle, buildPasskeyCustodyEnvelopeRecord, parseWalletCustodyEnvelopeFactor, parseWalletCustodyEnvelopeOwnershipWireV1 } from "../../../shared-ts/src/passkey-custody/custodyEnvelope.js";
 import "../../../shared-ts/src/passkey-custody/index.js";
+import { parseRecoveryCodeLocatorV1 } from "../../../shared-ts/src/wallet-recovery/recoveryCodeLocator.js";
 import { parseDerivedWalletRecoveryKeyId } from "../../../shared-ts/src/wallet-recovery/recoveryKeyId.js";
 import { buildWalletRecoveryBackupAcknowledgementV1 } from "../../../shared-ts/src/wallet-recovery/backupAcknowledgement.js";
 import "../../../shared-ts/src/wallet-recovery/recoveryCodes.js";
 import { buildWalletCustodySeedRecoveryEntry, buildWalletRecoveryEnvelopeSetRecord, buildWalletRecoveryManifestKekWrap } from "../../../shared-ts/src/wallet-recovery/walletRecoveryEnvelopeSet.js";
-import { parseRecoveryCodeLocatorV1 } from "../../../shared-ts/src/wallet-recovery/recoveryCodeLocator.js";
 import "../../../shared-ts/src/wallet-recovery/index.js";
 //#region src/router/domains/passkeyCustody/walletCustodyRegistrationCommit.ts
 function requireNonEmpty(value, label) {

package/dist/esm/router/domains/signingOperations/routerAbEd25519NormalSigningRoute.js

@@ -1,4 +1,4 @@
-import { mpcMaterialActivationRefsEqual } from "../../../shared-ts/src/utils/domainIds.js";
+import { mpcMaterialActivationRefsEqual, parseWalletId } from "../../../shared-ts/src/utils/domainIds.js";
 import { isPlainObject } from "../../../shared-ts/src/utils/validation.js";
 import { base64UrlEncode } from "../../../shared-ts/src/utils/base64.js";
 import { parseDigestB64u } from "../../../shared-ts/src/utils/canonicalPrimitives.js";
@@ -263,6 +263,40 @@ function isWalletSessionUnavailableStepUpError(result) {
 	return isPlainObject(result.body) && result.body.code === "wallet_session_unavailable";
 }
 async function authenticateRouterAbWalletOperationStepUp(input) {
+	if (!extractBearerCredential(input.headers) && input.authorizedOperations) {
+		const origin = parseStepUpRequestOrigin(input.headers);
+		if (!origin.ok) return origin;
+		const operationId = requireAuthorizationValue(parseAuthorizedOperationId(`normal-signing-operation:${input.scope.request_id}`));
+		const parsedWalletId = parseWalletId(input.scope.account_id);
+		if (!parsedWalletId.ok) return walletSessionScopeInvalidFailure();
+		const walletId = parsedWalletId.value;
+		const recorded = await input.authorizedOperations.resolveRecordedPasskeyOwnerOperation({
+			authorizedOperationId: operationId,
+			walletId,
+			requestOrigin: origin.requestOrigin,
+			nowMs: Date.now()
+		});
+		if (!recorded || input.requestExpiresAtMs > recorded.expiresAtMs) return {
+			ok: false,
+			error: routerAbStepUpError(403, "unauthorized", "Recorded owner approval is unavailable")
+		};
+		const activeMaterial = await input.resolveEd25519MaterialActivation({
+			walletId,
+			materialActivation: input.scope.material_activation
+		});
+		if (!activeMaterial.ok) return walletSessionScopeInvalidFailure();
+		return authenticateRouterAbWalletOperationStepUpIdentity({
+			kind: "verified_owner_proof",
+			headers: input.headers,
+			walletId,
+			materialOwner: input.scope.material_activation.material_owner,
+			operationId: recorded.operation.operation.operationId,
+			authority: recorded.authority,
+			runtimePolicyScope: activeMaterial.runtimePolicyScope,
+			expiresAtMs: recorded.expiresAtMs,
+			authorizedOperations: input.authorizedOperations
+		});
+	}
 	return authenticateRouterAbWalletOperationStepUpIdentity({
 		kind: "wallet_session_operation_credential_v1",
 		headers: input.headers,

package/dist/esm/router/domains/walletRegistration/walletRegistrationReservation.js

@@ -1,6 +1,7 @@
 import { parseWalletAuthMethodId, parseWalletAuthorityId, parseWalletId } from "../../../shared-ts/src/utils/domainIds.js";
-import { isPlainObject, requireCanonicalString } from "../../../shared-ts/src/utils/validation.js";
+import { isPlainObject, requireCanonicalString, requireRecord } from "../../../shared-ts/src/utils/validation.js";
 import { alphabetizeStringify, sha256HexUtf8 } from "../../../shared-ts/src/utils/digests.js";
+import { parseDigestB64u } from "../../../shared-ts/src/utils/canonicalPrimitives.js";
 import { parseDeviceId } from "../../../shared-ts/src/authorization/capabilityKinds.js";
 import { secureRandomBase64Url } from "../../../shared-ts/src/utils/secureRandomId.js";
 import { createServerAllocatedWalletId } from "../../../shared-ts/src/utils/registrationIds.js";
@@ -44,6 +45,7 @@ async function walletRegistrationSetupRequestDigest(namespace, input) {
 		runtimePolicyScope: input.runtimePolicyScope,
 		expectedOrigin: input.expectedOrigin,
 		wallet: input.request.wallet ?? { kind: "server_allocated" },
+		completion: input.request.completion,
 		authMethod: input.request.authMethod,
 		signerSelection: input.request.signerSelection
 	}));
@@ -64,7 +66,20 @@ async function admitRegistrationReservationHome(authority, input) {
 	};
 	return authority.admitHome(input);
 }
+function parseRegistrationSessionPublication(raw, walletId) {
+	const value = requireRecord(raw, "registration session publication");
+	if (value.kind === "none") return { kind: "none" };
+	if (value.kind !== "credential" || value.walletId !== String(walletId)) throw new Error("Invalid registration session publication");
+	const expiresAtMs = value.expiresAtMs;
+	if (typeof expiresAtMs !== "number" || !Number.isSafeInteger(expiresAtMs) || expiresAtMs <= 0) throw new Error("Invalid registration session publication expiry");
+	return {
+		kind: "credential",
+		walletId,
+		digest: parseDigestB64u(value.digest),
+		expiresAtMs
+	};
+}
 //#endregion
-export { admitRegistrationReservationHome, cancelRegistrationHome, parseWalletRegistrationSetupReservation, proposeWalletRegistrationSetup, walletRegistrationSetupRequestDigest };
+export { admitRegistrationReservationHome, cancelRegistrationHome, parseRegistrationSessionPublication, parseWalletRegistrationSetupReservation, proposeWalletRegistrationSetup, walletRegistrationSetupRequestDigest };
 
 //# sourceMappingURL=walletRegistrationReservation.js.map

package/dist/esm/router/domains/walletRegistration/walletRegistrationRoutes.js

@@ -11,6 +11,7 @@ import { normalizeRuntimePolicyScope } from "../../../shared-ts/src/threshold/si
 import { parseRouterAbEcdsaRegistrationActivationRequestV1, parseRouterAbEcdsaRegistrationRequestV1 } from "../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
 import { normalizeAddAuthMethodInput, normalizeEmailOtpRegistrationProof, normalizeRegistrationAuthMethodInput } from "../../../shared-ts/src/utils/registrationAuthMethodInput.js";
 import { parseHostedWalletSessionOperationCredentialToken, parsePrimaryWalletSessionOperationCredentialToken, parseSessionOrigin } from "../../../authorization/domain.js";
+import { routeError, routeJson } from "../../framework/routeResponses.js";
 import { extractBearerCredential, extractRouterApiEnvironmentId } from "../../auth/routerApiKeyAuth.js";
 import { normalizeCorsOrigin } from "../../../core/SessionService.js";
 import { parseRouterAbTraceContextV1 } from "../../../shared-ts/src/utils/routerAbTraceContext.js";
@@ -22,7 +23,6 @@ import { publishableKeyRoutePrincipal, resolvePublishableKeyApiCredentialAuth, r
 import { resolveActiveRuntimePolicyScopeForEnvironment, resolveWalletSessionAdministrationAdmission, resolveWalletSessionOperationCredentialAdmission, resolveWalletSessionOperationCredentialAdmissionFromContext } from "../../auth/commonRouterUtils.js";
 import { enforceRoutePolicy } from "../../framework/enforceRoutePolicy.js";
 import { parseRegistrationPreparedSessionSeal } from "./registrationSessionSeal.js";
-import { routeError, routeJson } from "../../framework/routeResponses.js";
 import { parsePasskeyCustodyEnvelopeRecord } from "../../../shared-ts/src/passkey-custody/custodyEnvelope.js";
 import "../../../shared-ts/src/passkey-custody/index.js";
 import { computeWalletEcdsaKeyFactsInventoryChallengeDigestB64u } from "../../../shared-ts/src/utils/ecdsaKeyFactsInventory.js";
@@ -343,12 +343,19 @@ function parseWalletRegistrationSetupRequest(body) {
 		code: "invalid_body",
 		message: "authMethod is required"
 	};
+	const completion = body.completion ?? "wallet_session";
+	if (completion !== "wallet_session" && completion !== "owner_operations") return {
+		ok: false,
+		code: "invalid_body",
+		message: "Invalid registration completion"
+	};
 	const wallet = parseWalletRegistrationSetupWallet(body.wallet);
 	if (!wallet.ok) return wallet;
 	return {
 		ok: true,
 		value: {
 			registrationOperationId,
+			completion,
 			...wallet.value ? { wallet: wallet.value } : {},
 			signerSelection: signerSelection.value.selection,
 			authMethod
@@ -1928,6 +1935,7 @@ async function handleRouterApiWalletRegistrationNearProvisioning(input) {
 	if (sessionSeal.value) {
 		if (!isPasskeyWalletRegistrationNearProvisioningSuccessV2(result)) return routeError(400, "invalid_body", "Registration session sealing requires a passkey authority");
 		const sealStartedAt = Date.now();
+		if (result.registrationEstablishedSession.kind === "owner_operations") return routeError(400, "invalid_body", "Owner registration has no session seal");
 		const sealed = await sessionSeal.value.finish(result.registrationEstablishedSession.session);
 		serverTiming.push(["near_finalize_session_seal", Math.max(0, Date.now() - sealStartedAt)]);
 		if (!sealed.ok) return routeJson(503, {

package/dist/esm/router/domains/walletUnlock/walletUnlockRouteHandlers.js

@@ -7,8 +7,8 @@ import { ROUTER_AB_ED25519_YAO_EMAIL_OTP_RECOVERY_BOOTSTRAP_KIND_V1 } from "../.
 import { walletAuthAuthorityRef } from "../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { parseSessionOrigin, parseVerifiedOwnerProofId, projectActiveWalletSession } from "../../../authorization/domain.js";
 import { buildVerifiedWalletSessionEmailOtpFactorResult, buildVerifiedWalletSessionPasskeyFactorResult } from "../../../authorization/factorEvidence.js";
-import { emailOtpFailureWebhookEventDescriptors, emailOtpLoggedInWebhookEventDescriptor } from "../emailOtp/emailOtpSessionRouteHelpers.js";
 import { EMAIL_OTP_CHANNEL } from "../../../shared-ts/src/utils/emailOtpDomain.js";
+import { emailOtpFailureWebhookEventDescriptors, emailOtpLoggedInWebhookEventDescriptor } from "../emailOtp/emailOtpSessionRouteHelpers.js";
 import { thresholdEd25519StatusCode } from "../../../threshold/statusCodes.js";
 import { parseWalletUnlockBackend } from "../emailOtp/emailOtpRequestValidation.js";
 //#region src/router/domains/walletUnlock/walletUnlockRouteHandlers.ts

package/dist/esm/router/transport/fetch/routes/ecdsaOperationStepUpFactor.js

@@ -5,9 +5,9 @@ import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimit
 import "../../../../shared-ts/src/utils/encoders.js";
 import { parseAuthFactorId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
 import { buildVerifiedWalletOperationEmailOtpFactorResult, buildVerifiedWalletOperationPasskeyFactorResult } from "../../../../authorization/factorEvidence.js";
-import { json } from "../../../framework/http.js";
-import { hashEmailOtpOperationBinding } from "../../../domains/emailOtp/emailOtpSessionRouteHelpers.js";
 import { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_EXPORT_OPERATION, WALLET_EMAIL_OTP_TRANSACTION_SIGN_OPERATION } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
+import { hashEmailOtpOperationBinding } from "../../../domains/emailOtp/emailOtpSessionRouteHelpers.js";
+import { json } from "../../../framework/http.js";
 //#region src/router/transport/fetch/routes/ecdsaOperationStepUpFactor.ts
 async function verifyEcdsaOperationStepUpFactor(input) {
 	const proof = input.proof;

package/dist/esm/router/transport/fetch/routes/externalAuth.js

@@ -2,7 +2,8 @@ import { parseWalletId } from "../../../../shared-ts/src/utils/domainIds.js";
 import { requireCanonicalString, requireRecord } from "../../../../shared-ts/src/utils/validation.js";
 import { sha256HexUtf8 } from "../../../../shared-ts/src/utils/digests.js";
 import { EXTERNAL_AUTH_PATH, externalAuthFailure, parseExternalAuthConfiguration } from "../../../../shared-ts/src/auth/externalAuth.js";
-import { buildDelegatedWalletAuthorityV1, buildFullOwnerPermissionsV1, sameDelegatedWalletAuthorityV1 } from "../../../../shared-ts/src/authorization/delegatedAuthority.js";
+import { externalOwnerChallenge, readExternalOwnerOperation } from "../../../../auth/externalOwnerOperations.js";
+import { authorizeWalletOwnerOperation, completeWalletOwnerOperation, walletOwnerOperationAuthorizationId } from "../walletOwnerOperationAuthorization.js";
 import { extractBearerCredential, resolveSourceIpFromFetchHeaders } from "../../../auth/routerApiKeyAuth.js";
 import { json, readJson } from "../../../framework/http.js";
 //#region src/router/transport/fetch/routes/externalAuth.ts
@@ -10,12 +11,29 @@ const ACTIONS = [
 	"associate",
 	"unlink",
 	"prepare",
+	"prepare-association",
+	"prepare-unlink",
+	"owner-challenge",
 	"exchange",
 	"backend-exchange",
 	"redeem",
 	"settings",
 	"logout"
 ];
+function parseIdentityProof(value) {
+	const proof = requireRecord(value, "external identity proof");
+	switch (proof.kind) {
+		case "google": return {
+			kind: "google",
+			idToken: requireCanonicalString(proof.idToken, "idToken")
+		};
+		case "application": return {
+			kind: "application",
+			assertion: requireCanonicalString(proof.assertion, "assertion")
+		};
+		default: throw new Error("Unsupported external identity proof");
+	}
+}
 function parseCommand(action, body) {
 	const wallet = parseWalletId(body.walletId);
 	if (!wallet.ok) throw new Error("Wallet ID is invalid");
@@ -24,26 +42,41 @@ function parseCommand(action, body) {
 		action,
 		walletId,
 		attemptId: requireCanonicalString(body.attemptId, "attemptId"),
-		idToken: requireCanonicalString(body.idToken, "idToken")
+		proof: parseIdentityProof(body.proof)
 	};
 	const appOrigin = requireCanonicalString(body.appOrigin, "appOrigin");
 	if (new URL(appOrigin).origin !== appOrigin) throw new Error("Application origin is invalid");
 	switch (action) {
-		case "associate": return {
+		case "associate":
+		case "unlink": return {
 			action,
 			walletId,
 			appOrigin,
-			ownerCredential: requireCanonicalString(body.ownerCredential, "ownerCredential"),
-			idToken: requireCanonicalString(body.idToken, "idToken")
+			attemptId: requireCanonicalString(body.attemptId, "attemptId"),
+			binding: secret(body.binding, "binding"),
+			sessionToken: secret(body.sessionToken, "sessionToken"),
+			code: secret(body.code, "code"),
+			factorProof: body.factorProof
 		};
-		case "unlink": return {
+		case "owner-challenge": return {
 			action,
 			walletId,
 			appOrigin,
-			ownerCredential: requireCanonicalString(body.ownerCredential, "ownerCredential"),
-			associationId: requireCanonicalString(body.associationId, "associationId")
+			attemptId: requireCanonicalString(body.attemptId, "attemptId"),
+			binding: secret(body.binding, "binding"),
+			sessionToken: secret(body.sessionToken, "sessionToken"),
+			code: secret(body.code, "code")
+		};
+		case "prepare-unlink": return {
+			action,
+			walletId,
+			appOrigin,
+			associationId: requireCanonicalString(body.associationId, "associationId"),
+			binding: secret(body.binding, "binding"),
+			sessionToken: secret(body.sessionToken, "sessionToken")
 		};
-		case "prepare": return {
+		case "prepare":
+		case "prepare-association": return {
 			action,
 			walletId,
 			appOrigin,
@@ -143,11 +176,10 @@ async function resolveApplicationTrust(ctx, service, command) {
 		actorUserId: result.principal.apiKeyId,
 		roles: []
 	}, { status: "ACTIVE" }))?.find(matchesEnvironment.bind(null, scope.envId));
-	const configuration = parseExternalAuthConfiguration(environment?.externalAuth ?? {
+	return parseExternalAuthConfiguration(environment?.externalAuth ?? {
 		kind: "disabled",
 		revision: 0
 	});
-	return configuration.kind === "google" ? configuration : null;
 }
 function matchesEnvironment(environmentId, environment) {
 	return environment.id === environmentId;
@@ -174,43 +206,118 @@ async function handleExternalAuth(ctx) {
 }
 async function dispatch(ctx, service, trust, command) {
 	const walletId = command.walletId;
-	const originBinding = JSON.stringify([ctx.request.headers.get("origin") || "", command.appOrigin]);
-	if (command.action === "prepare" || command.action === "exchange" || command.action === "backend-exchange" || command.action === "associate") {
+	if (command.action === "prepare" || command.action === "prepare-association" || command.action === "prepare-unlink" || command.action === "exchange" || command.action === "backend-exchange" || command.action === "associate") {
 		const rateKey = await sha256HexUtf8(resolveSourceIpFromFetchHeaders(ctx.request.headers) || "unknown");
 		if (!await service.store.consumeAuthenticationAllowance(rateKey, Date.now())) return failure(429, "rate_limited");
 	}
-	if (command.action === "associate" || command.action === "unlink") {
-		const token = command.ownerCredential;
-		const owner = await ctx.service.authorizationSessions.readWalletSessionAuthorizationV2ByOperationCredential({
-			tenantId: ctx.service.authorizationSessions.tenantId,
-			token,
+	if (command.action === "backend-exchange") {
+		if (trust.kind === "disabled") return failure(403, "access_denied");
+		return json(await service.exchange({
+			walletId,
+			attemptId: command.attemptId,
+			proof: command.proof,
+			trust
+		}));
+	}
+	const originBinding = JSON.stringify([ctx.request.headers.get("origin") || "", command.appOrigin]);
+	if (command.action === "prepare-unlink") return json(await service.prepareUnlink({
+		walletId,
+		associationId: command.associationId,
+		originBinding,
+		binding: command.binding,
+		sessionToken: command.sessionToken,
+		trustRevision: trust.revision
+	}));
+	if (command.action === "owner-challenge" || command.action === "associate" || command.action === "unlink") {
+		const binding = {
+			walletId,
+			attemptId: command.attemptId,
+			originBinding,
+			bindingHash: await sha256HexUtf8(command.binding),
+			sessionTokenHash: await sha256HexUtf8(command.sessionToken),
+			codeHash: await sha256HexUtf8(command.code),
+			trustRevision: trust.revision,
 			nowMs: Date.now()
+		};
+		const result = await readExternalOwnerOperation({
+			store: service.store,
+			binding,
+			requestOrigin: ctx.request.headers.get("origin") || "",
+			phase: command.action === "owner-challenge" ? "prepare" : "complete"
+		});
+		if (!result.ok) return json(result, { status: 403 });
+		const ownerOperation = result.value;
+		if (command.action === "owner-challenge") return json({
+			ok: true,
+			value: externalOwnerChallenge(ownerOperation)
 		});
-		if (!owner || owner.authorization.session.walletId !== walletId || !sameDelegatedWalletAuthorityV1(buildDelegatedWalletAuthorityV1({ permissions: owner.authority.permissions }), buildDelegatedWalletAuthorityV1({ permissions: buildFullOwnerPermissionsV1() }))) return failure(403, "access_denied");
-		if (command.action === "unlink") {
-			await service.store.revokeAssociation(walletId, command.associationId);
-			return json({ ok: true });
+		if (command.action !== ownerOperation.attempt.purpose) return failure(403, "access_denied");
+		if (ownerOperation.attempt.status === "consumed") {
+			const stored = await ctx.service.authorizedOperations.readAuthorizedOperationById({
+				tenantId: ctx.service.authorizedOperations.tenantId,
+				authorizedOperationId: walletOwnerOperationAuthorizationId(ownerOperation.operation, ownerOperation.challengeB64u)
+			});
+			if (!stored || stored.authorization.kind !== "verified_step_up" || stored.quota.kind !== "quota_neutral" || stored.lifecycle !== "completed") return failure(503, "unavailable");
+			return new Response(stored.response.bodyText, {
+				status: stored.response.status,
+				headers: {
+					"Content-Type": stored.response.contentType,
+					"Cache-Control": "no-store"
+				}
+			});
 		}
-		const proof = await service.verifyGoogle(trust, command.idToken);
-		if (!proof.ok) return json(proof, { status: 403 });
-		return await service.store.associate({
+		const authorized = await authorizeWalletOwnerOperation({
+			ctx,
 			walletId,
-			subject: proof.value.subject,
-			authorityId: owner.authority.authorityId,
-			authorityEpoch: owner.authority.revocationEpoch
-		}) ? json({ ok: true }) : failure(409, "access_denied");
+			operation: ownerOperation.operation,
+			payload: ownerOperation.payload,
+			factorProof: command.factorProof
+		});
+		if (!authorized.ok) return authorized.response;
+		if (!await service.store.consumeOwnerAttempt({
+			walletId,
+			attemptId: binding.attemptId,
+			originBinding,
+			bindingHash: binding.bindingHash,
+			sessionTokenHash: binding.sessionTokenHash,
+			codeHash: binding.codeHash,
+			trustRevision: binding.trustRevision,
+			nowMs: Date.now()
+		}, authorized.ownerAuthority)) return completeWalletOwnerOperation(ctx, authorized.operation, 403, externalAuthFailure("access_denied"), "failed_before_side_effect");
+		const attempt = ownerOperation.attempt;
+		if (attempt.purpose === "associate") {
+			if (!await service.store.associate({
+				walletId,
+				identity: attempt.identity,
+				authorityId: authorized.ownerAuthority.authorityId,
+				authorityEpoch: authorized.ownerAuthority.revocationEpoch
+			})) return completeWalletOwnerOperation(ctx, authorized.operation, 403, externalAuthFailure("access_denied"), "failed_before_side_effect");
+		} else await service.store.revokeAssociation({
+			walletId,
+			associationId: attempt.associationId,
+			owner: authorized.ownerAuthority
+		});
+		return completeWalletOwnerOperation(ctx, authorized.operation, 200, {
+			ok: true,
+			value: null
+		});
 	}
-	if (command.action === "prepare") return json(await service.prepare({
+	if (trust.kind === "disabled") return failure(403, "access_denied");
+	if (command.action === "prepare" || command.action === "prepare-association") return json(await service.prepare({
+		purpose: command.action === "prepare" ? "authenticate" : "associate",
 		walletId,
 		originBinding,
 		binding: command.binding,
 		sessionToken: command.sessionToken
 	}));
-	if (command.action === "exchange" || command.action === "backend-exchange") return json(await service.exchange({
+	if (command.action === "exchange") return json(await service.exchange({
 		trust,
 		walletId,
 		attemptId: command.attemptId,
-		idToken: command.idToken
+		proof: {
+			kind: "google",
+			idToken: command.idToken
+		}
 	}));
 	const tokenHash = await sha256HexUtf8(command.sessionToken);
 	if (command.action === "logout") {