@seams/wallet-server 0.28.0 → 0.30.0

package/dist/esm/router/cloudflare.js

@@ -226,7 +226,7 @@ var DefaultRouterAbNormalSigningAdmissionAdapter = class {
 			case "project_policy_rejected": return admissionFailure(403, "project_policy_rejected", "Router A/B normal-signing project policy rejected the request");
 			case "rate_limited": return admissionFailure(429, "rate_limited", "Router A/B normal-signing request is rate limited");
 			case "abuse_rejected": return admissionFailure(403, "abuse_rejected", "Router A/B normal-signing abuse policy rejected the request");
-			default: return assertNever$14(policy);
+			default: return assertNever$16(policy);
 		}
 	}
 };
@@ -283,7 +283,7 @@ function abusePrincipalKey(input) {
 		input.curve
 	].join("");
 }
-function assertNever$14(value) {
+function assertNever$16(value) {
 	throw new Error(`Unexpected Router A/B normal-signing admission branch: ${String(value)}`);
 }
 //#endregion
@@ -4957,7 +4957,7 @@ function normalizeProjectPolicyDecision(decision) {
 			kind: "rejected",
 			retryAfterMs: requirePositiveInteger$2("retryAfterMs", decision.retryAfterMs)
 		};
-		default: return assertNever$13(decision);
+		default: return assertNever$15(decision);
 	}
 }
 function normalizeAbuseDecision(decision) {
@@ -4971,7 +4971,7 @@ function normalizeAbuseDecision(decision) {
 			kind: "rejected",
 			retryAfterMs: requirePositiveInteger$2("retryAfterMs", decision.retryAfterMs)
 		};
-		default: return assertNever$13(decision);
+		default: return assertNever$15(decision);
 	}
 }
 function parseProjectPolicyDecision(row) {
@@ -5015,7 +5015,7 @@ function requirePositiveInteger$2(label, value) {
 	}
 	throw new Error(`${label} must be a positive integer`);
 }
-function assertNever$13(value) {
+function assertNever$15(value) {
 	throw new Error(`Unexpected Router A/B normal-signing admission branch: ${String(value)}`);
 }
 function parsePolicyRow(row) {
@@ -5190,19 +5190,61 @@ const ED25519_CREDENTIAL_POLICY_PROJECTION = credentialPolicyProjection({
 //#endregion
 //#region ../shared-ts/src/auth/externalAuth.ts
 const EXTERNAL_AUTH_PATH = "/wallet/external-auth";
+function parseExternalAuthProvider(raw) {
+	const value = requireRecord$1(raw, "external authentication provider");
+	switch (value.kind) {
+		case "disabled": return { kind: "disabled" };
+		case "google": return {
+			kind: "google",
+			clientId: requireCanonicalString(value.clientId, "clientId")
+		};
+		case "application": {
+			const issuer = requireCanonicalString(value.issuer, "issuer");
+			const url = new URL(issuer);
+			if (url.protocol !== "https:" || url.origin !== issuer) throw new Error("Application issuer must be a canonical HTTPS origin");
+			return {
+				kind: "application",
+				issuer,
+				publicKeyB64u: parseEd25519PublicKeyB64u(value.publicKeyB64u, "publicKeyB64u")
+			};
+		}
+		default: throw new Error("Unsupported external authentication provider");
+	}
+}
+function externalAuthConfiguration(provider, revision) {
+	switch (provider.kind) {
+		case "disabled": return {
+			kind: "disabled",
+			revision
+		};
+		case "google": return {
+			kind: "google",
+			revision,
+			clientId: provider.clientId
+		};
+		case "application": return {
+			kind: "application",
+			revision,
+			issuer: provider.issuer,
+			publicKeyB64u: provider.publicKeyB64u
+		};
+		default: return assertNever$14(provider);
+	}
+}
 function parseExternalAuthConfiguration(raw) {
 	const value = requireRecord$1(raw, "external authentication configuration");
 	if (typeof value.revision !== "number" || !Number.isSafeInteger(value.revision) || value.revision < 0) throw new Error("Invalid external authentication revision");
-	if (value.kind === "disabled") return {
-		kind: "disabled",
-		revision: value.revision
-	};
-	if (value.kind === "google") return {
-		kind: "google",
-		revision: value.revision,
-		clientId: requireCanonicalString(value.clientId, "clientId")
-	};
-	throw new Error("Unsupported external authentication configuration");
+	return externalAuthConfiguration(parseExternalAuthProvider(value), value.revision);
+}
+function serializeExternalIdentity(identity) {
+	return JSON.stringify([
+		identity.provider,
+		identity.issuer,
+		identity.subject
+	]);
+}
+function assertNever$14(value) {
+	throw new Error(`Unsupported external authentication provider: ${String(value)}`);
 }
 function externalAuthFailure(code) {
 	return {
@@ -5212,105 +5254,194 @@ function externalAuthFailure(code) {
 	};
 }
 //#endregion
-//#region src/router/auth/routerApiKeyAuth.ts
-function readHeader(headers, name) {
-	if (headers instanceof Headers) return String(headers.get(name) || "").trim();
-	const direct = headers[name];
-	const lower = headers[name.toLowerCase()];
-	const upper = headers[name.toUpperCase()];
-	const value = direct ?? lower ?? upper;
-	if (typeof value === "string") return value.trim();
-	if (Array.isArray(value)) return String(value[0] || "").trim();
-	return "";
+//#region ../shared-ts/src/authorization/walletOwnerOperation.ts
+/** Public challenge digest for a single wallet-administration factor proof. */
+async function computeWalletOwnerAdminChallengeDigest(input) {
+	return sha256Utf8DigestB64u(`seams:wallet-custody:challenge:v1|${alphabetizeStringify({
+		walletId: input.walletId,
+		operation: input.operation,
+		payload: input.payload,
+		requestOrigin: input.requestOrigin
+	})}`);
 }
-function extractBearerCredential(headers) {
-	const authHeader = readHeader(headers, "authorization");
-	if (authHeader) {
-		if (authHeader.toLowerCase().startsWith("bearer ")) {
-			const bearerValue = authHeader.slice(7).trim();
-			if (bearerValue) return bearerValue;
+//#endregion
+//#region src/auth/externalOwnerOperations.ts
+async function readExternalOwnerOperation(input) {
+	const attempt = input.phase === "prepare" ? await input.store.prepareOwnerChallenge(input.binding) : await input.store.readOwnerAttempt(input.binding);
+	if (!attempt) return externalAuthFailure("access_denied");
+	if (attempt.challenge.kind !== "ready") return externalAuthFailure("access_denied");
+	if (attempt.status === "verified" && attempt.challenge.expiresAtMs <= input.binding.nowMs) return externalAuthFailure("expired");
+	const identity = serializeExternalIdentity(attempt.identity);
+	let operation;
+	let payload;
+	switch (attempt.purpose) {
+		case "associate":
+			operation = "external_identity_associate";
+			payload = {
+				attemptId: attempt.attemptId,
+				identity,
+				originBinding: attempt.originBinding,
+				revision: attempt.trustRevision,
+				expiresAtMs: attempt.challenge.expiresAtMs
+			};
+			break;
+		case "unlink":
+			operation = "external_identity_unlink";
+			payload = {
+				attemptId: attempt.attemptId,
+				associationId: attempt.associationId,
+				identity,
+				originBinding: attempt.originBinding,
+				revision: attempt.trustRevision,
+				expiresAtMs: attempt.challenge.expiresAtMs
+			};
+			break;
+		default: return assertNever$13(attempt);
+	}
+	const challengeB64u = await computeWalletOwnerAdminChallengeDigest({
+		walletId: attempt.walletId,
+		operation,
+		payload,
+		requestOrigin: input.requestOrigin
+	});
+	return {
+		ok: true,
+		value: {
+			attempt,
+			operation,
+			payload,
+			challengeB64u
 		}
+	};
+}
+function externalOwnerChallenge(operation) {
+	const attempt = operation.attempt;
+	if (attempt.challenge.kind !== "ready") throw new Error("Owner challenge is not prepared");
+	switch (attempt.purpose) {
+		case "associate": return {
+			kind: "associate",
+			walletId: attempt.walletId,
+			attemptId: attempt.attemptId,
+			identity: attempt.identity,
+			challengeB64u: operation.challengeB64u,
+			expiresAtMs: attempt.challenge.expiresAtMs
+		};
+		case "unlink": return {
+			kind: "unlink",
+			walletId: attempt.walletId,
+			attemptId: attempt.attemptId,
+			associationId: attempt.associationId,
+			identity: attempt.identity,
+			challengeB64u: operation.challengeB64u,
+			expiresAtMs: attempt.challenge.expiresAtMs
+		};
+		default: return assertNever$13(attempt);
 	}
-	return null;
 }
-function normalizeSourceIp(raw) {
-	const value = String(raw || "").trim();
-	if (!value) return null;
-	const maybeForwarded = value.includes(",") ? value.split(",")[0] : value;
-	return String(maybeForwarded || "").trim() || null;
+function assertNever$13(value) {
+	throw new Error(`Unsupported external owner operation: ${String(value)}`);
 }
-function extractRouterApiEnvironmentId(headers) {
-	const preferred = readHeader(headers, "x-seams-environment-id");
-	if (preferred) return preferred;
-	const fallback = readHeader(headers, "x-environment-id");
-	if (fallback) return fallback;
-	return null;
+//#endregion
+//#region ../shared-ts/src/authorization/operationFingerprint.ts
+const CAPABILITY_OPERATION_FINGERPRINT_DOMAIN_V1 = "seams:authorization:capability-operation-fingerprint:v1";
+var CapabilityOperationEnvelopeProof = class {
+	tenantId;
+	principalId;
+	capabilityId;
+	operationId;
+	operation;
+	digests;
+	retainProof() {
+		return true;
+	}
+	constructor(fields) {
+		this.retainProof();
+		this.tenantId = fields.tenantId;
+		this.principalId = fields.principalId;
+		this.capabilityId = fields.capabilityId;
+		this.operationId = fields.operationId;
+		this.operation = fields.operation;
+		this.digests = fields.digests;
+	}
+};
+function buildCapabilityOperationEnvelope(fields) {
+	return new CapabilityOperationEnvelopeProof({
+		tenantId: fields.tenantId,
+		principalId: fields.principalId,
+		capabilityId: fields.capabilityId,
+		operationId: fields.operationId,
+		operation: fields.operation,
+		digests: {
+			laneDigest: fields.digests.laneDigest,
+			intentDigest: fields.digests.intentDigest,
+			displayDigest: fields.digests.displayDigest
+		}
+	});
 }
-function resolveSourceIpFromFetchHeaders(headers) {
-	const cfConnecting = readHeader(headers, "cf-connecting-ip");
-	const forwarded = readHeader(headers, "x-forwarded-for");
-	const realIp = readHeader(headers, "x-real-ip");
-	return normalizeSourceIp(cfConnecting || forwarded || realIp);
+function canonicalCapabilityOperationFingerprintPreimageV1(envelope) {
+	return `${CAPABILITY_OPERATION_FINGERPRINT_DOMAIN_V1}|${alphabetizeStringify({
+		tenantId: envelope.tenantId,
+		principalId: envelope.principalId,
+		capabilityId: envelope.capabilityId,
+		operationId: envelope.operationId,
+		operation: envelope.operation,
+		digests: envelope.digests
+	})}`;
 }
-//#endregion
-//#region ../shared-ts/src/utils/failure.ts
-function failure$6(code, message) {
-	return {
-		ok: false,
-		code,
-		message
-	};
+async function computeCapabilityOperationFingerprintDigest(envelope) {
+	return parseCapabilityOperationFingerprintDigest(base64UrlEncode(await sha256BytesUtf8(canonicalCapabilityOperationFingerprintPreimageV1(envelope))));
 }
-function failedVerification(code, message) {
-	return {
-		ok: false,
-		verified: false,
-		code,
-		message
-	};
+function parseCapabilityOperationFingerprintDigest(value) {
+	return parseDigestB64u(value);
+}
+function parseSigningOperationFingerprintDigest(value) {
+	if (typeof value !== "string" || !value.startsWith("sha256:")) throw new Error("signing operation fingerprint must use the sha256: prefix");
+	return parseDigestB64u(value.slice(7));
 }
 //#endregion
-//#region src/core/SessionService.ts
-function normalizeParsedCorsOrigin(url) {
-	const host = url.hostname.toLowerCase();
-	const proto = url.protocol === "http:" || url.protocol === "https:" ? url.protocol : "https:";
-	const rawPort = String(url.port || "").trim();
-	return `${proto}//${host}${rawPort && !(proto === "https:" && rawPort === "443") && !(proto === "http:" && rawPort === "80") ? `:${rawPort}` : ""}`;
+//#region ../shared-ts/src/utils/emailOtpDomain.ts
+const EMAIL_OTP_CHANNEL = "email_otp";
+/** Domain label that opens the AAD binding a released Email OTP factor to its challenge. */
+const EMAIL_OTP_FACTOR_RELEASE_AAD_DOMAIN_V1 = "seams/email-otp/factor-release/v1";
+const WALLET_UNLOCK_BACKENDS = ["passkey", EMAIL_OTP_CHANNEL];
+const WALLET_EMAIL_OTP_LOGIN_OPERATIONS = [
+	"wallet_unlock",
+	"transaction_sign",
+	"export_key"
+];
+const WALLET_EMAIL_OTP_EXPORT_OPERATION = "export_key";
+const WALLET_EMAIL_OTP_UNLOCK_OPERATION = "wallet_unlock";
+const WALLET_EMAIL_OTP_TRANSACTION_SIGN_OPERATION = "transaction_sign";
+function isWalletUnlockBackend(value) {
+	return WALLET_UNLOCK_BACKENDS.includes(value);
 }
-function parseCsvList(input) {
-	const out = /* @__PURE__ */ new Set();
-	for (const raw of String(input || "").split(",")) {
-		const s = raw.trim();
-		if (!s) continue;
-		try {
-			const u = new URL(s);
-			out.add(normalizeParsedCorsOrigin(u));
-		} catch {
-			const stripped = s.replace(/\/$/, "");
-			if (stripped) out.add(stripped);
-		}
-	}
-	return Array.from(out);
+function isWalletEmailOtpLoginOperation(value) {
+	return WALLET_EMAIL_OTP_LOGIN_OPERATIONS.includes(value);
 }
+//#endregion
+//#region ../shared-ts/src/utils/base58.ts
 /**
-* Normalize a single origin for CORS comparisons.
-* Returns null when the input is empty or not URL-like.
+* Encodes binary data to base58 string using Bitcoin's base58 alphabet.
+*
+* @param data - Binary data to encode (Uint8Array, ArrayBuffer, or number[])
+* @returns Base58-encoded string
 */
-function normalizeCorsOrigin(input) {
-	const raw = String(input || "").trim();
-	if (!raw) return null;
-	try {
-		return normalizeParsedCorsOrigin(new URL(raw));
-	} catch {
-		return null;
-	}
-}
-function buildCorsOrigins(...inputs) {
-	const merged = /* @__PURE__ */ new Set();
-	for (const input of inputs) for (const origin of parseCsvList(input)) merged.add(origin);
-	const list = Array.from(merged);
-	return list.length > 0 ? list : "*";
-}
+const base58Encode = (data) => {
+	if (data instanceof ArrayBuffer) return bs58.encode(new Uint8Array(data));
+	if (Array.isArray(data)) return bs58.encode(new Uint8Array(data));
+	return bs58.encode(data);
+};
+/**
+* Decodes a base58 string to binary data using Bitcoin's base58 alphabet.
+* Returns a Uint8Array containing the decoded bytes.
+*
+* @param base58String - Base58-encoded string to decode
+* @returns Uint8Array containing the decoded bytes
+* @throws Error if input contains invalid base58 characters
+*/
+const base58Decode = (base58String) => {
+	return bs58.decode(base58String);
+};
 //#endregion
 //#region ../shared-ts/src/device-linking/contracts.ts
 function isLinkSessionTerminalFailureV1(state) {
@@ -8419,170 +8550,1318 @@ function parseFixedB64u$1(value, expectedBytes, label) {
 	return bytes;
 }
 //#endregion
-//#region ../shared-ts/src/utils/routerAbTraceContext.ts
-const ROUTER_AB_TRACE_ID_HEADER_V1 = "x-seams-trace-id";
-const TRACE_ID_PATTERN = /^[0-9a-f]{32}$/;
-function parseRouterAbTraceContextV1(raw) {
-	if (raw === null || raw === void 0 || raw === "") return {
-		ok: false,
-		reason: "missing",
-		message: "Router trace ID is missing"
-	};
-	if (typeof raw !== "string" || !TRACE_ID_PATTERN.test(raw)) return {
-		ok: false,
-		reason: "invalid",
-		message: "Router trace ID must be 32 lowercase hexadecimal characters"
-	};
+//#region src/authorization/domain.ts
+function buildExactWalletSessionQuotaProjectionV1(fields) {
+	requireNonnegativeInteger(fields.remainingUses, "Wallet Session quota remaining uses");
+	requirePositiveTime(fields.expiresAtMs, "Wallet Session quota expiry");
+	if (fields.lifecycle === "exhausted" !== (fields.remainingUses === 0)) throw new Error("Wallet Session quota lifecycle disagrees with its remaining uses");
 	return {
-		ok: true,
-		value: {
-			kind: "router_ab_trace_context_v1",
-			value: raw
-		}
+		kind: "exact_wallet_session_quota_projection_v1",
+		lifecycle: fields.lifecycle,
+		tenantId: fields.tenantId,
+		principalId: fields.principalId,
+		walletSessionId: fields.walletSessionId,
+		quotaId: fields.quotaId,
+		remainingUses: fields.remainingUses,
+		expiresAtMs: fields.expiresAtMs
 	};
 }
-function createRouterAbTraceContextV1() {
-	const bytes = new Uint8Array(16);
-	globalThis.crypto.getRandomValues(bytes);
-	let value = "";
-	for (const byte of bytes) value += byte.toString(16).padStart(2, "0");
-	return {
-		kind: "router_ab_trace_context_v1",
-		value
-	};
+/**
+* Every capability subject must resolve through the authoritative active
+* authority that the authorization names. A signing or export subject resolves
+* only when its key family is activated and names the same material the
+* authority currently holds; an administration subject resolves only when it
+* names that same authority. Anything else is a capability the caller can no
+* longer exercise, not a corrupt row.
+*/
+function exactWalletSessionCapabilitySubjectsResolveAuthority(input) {
+	return input.session.capabilitySubjects.every((subject) => {
+		switch (subject.kind) {
+			case "sign":
+			case "export_keys": {
+				const activation = subject.keyFamily === "ed25519" ? input.signerActivations.ed25519 : input.signerActivations.ecdsa;
+				return activation !== void 0 && mpcMaterialActivationRefsEqual(activation.materialActivation, subject.materialActivation);
+			}
+			case "link_devices":
+			case "revoke_devices": return subject.authorityId === input.session.authorityId;
+			default: return false;
+		}
+	});
 }
-//#endregion
-//#region ../shared-ts/src/utils/walletManagementProtocol.ts
-const WALLET_MANAGEMENT_PROTOCOL_HEADER = "X-Seams-Wallet-Protocol";
-//#endregion
-//#region src/router/framework/http.ts
-const CORS_ALLOW_METHODS = "GET,POST,PUT,PATCH,DELETE,OPTIONS";
-const CORS_PREFLIGHT_MAX_AGE_SECONDS = 7200;
-const CORS_ALLOW_HEADERS = [
-	"Content-Type",
-	WALLET_MANAGEMENT_PROTOCOL_HEADER,
-	"Authorization",
-	"X-Seams-Wallet-Region",
-	"X-Seams-Benchmark-Diagnostics",
-	LINKED_DEVICE_REQUEST_PROOF_HEADER_V1,
-	ROUTER_AB_ED25519_YAO_RECOVERY_CHALLENGE_ID_HEADER_V1,
-	ROUTER_AB_TRACE_ID_HEADER_V1,
-	"X-Seams-Environment-Id",
-	"X-Environment-Id"
-].join(",");
-function json$3(body, init, extraHeaders) {
-	const headers = new Headers({ "Content-Type": "application/json; charset=utf-8" });
-	const initHeaders = init?.headers;
-	if (initHeaders) try {
-		new Headers(initHeaders).forEach((v, k) => headers.set(k, v));
-	} catch {}
-	if (extraHeaders) for (const [k, v] of Object.entries(extraHeaders)) headers.set(k, v);
-	const { headers: _omit, ...rest } = init || {};
-	return new Response(JSON.stringify(body), {
-		status: 200,
-		...rest,
-		headers
+/**
+* The digest-free authorization projection published to the browser. It carries
+* the exact wallet, authority, method, capability, and lifetime identity a
+* reader needs to reconcile its own record, and never the credential digest.
+*/
+function projectExactWalletSessionAuthorizationV1(session) {
+	const capabilitySubjects = session.capabilitySubjects.map((subject) => {
+		switch (subject.kind) {
+			case "sign":
+			case "export_keys": return {
+				kind: subject.kind,
+				keyFamily: subject.keyFamily,
+				materialActivation: subject.materialActivation
+			};
+			case "link_devices":
+			case "revoke_devices": return { kind: subject.kind };
+			default: throw new Error("Issued linked-device Wallet Session subject is invalid");
+		}
+	});
+	const first = capabilitySubjects[0];
+	if (!first) throw new Error("Issued linked-device Wallet Session has no subjects");
+	return parseActiveWalletSessionV1({
+		kind: "active_wallet_session_v1",
+		walletId: session.walletId,
+		authorityId: session.authorityId,
+		authMethodId: session.walletAuthMethodId,
+		authorizationId: session.authorizationId,
+		quotaId: session.quotaId,
+		authorityDigestB64u: session.authorityDigestB64u,
+		authorityRevocationEpoch: session.authorityRevocationEpoch,
+		capabilitySubjects: [first, ...capabilitySubjects.slice(1)],
+		issuedAtMs: session.createdAtMs,
+		expiresAtMs: session.expiresAtMs
 	});
 }
-function jsonFailure(status, code, message) {
-	return json$3(failure$6(code, message), { status });
+function projectActiveWalletSession(issued) {
+	if (issued.quota.quotaId !== issued.session.quotaId) throw new Error("Issued Wallet Session quota does not belong to its authorization");
+	return projectExactWalletSessionAuthorizationV1(issued.session);
 }
-function withCors(headers, opts, request) {
-	const pathname = request ? new URL(request.url).pathname : "";
-	if (pathname === "/healthz" || pathname === "/readyz") {
-		headers.set("Access-Control-Allow-Origin", "*");
-		headers.delete("Access-Control-Allow-Credentials");
-		headers.set("Access-Control-Allow-Methods", CORS_ALLOW_METHODS);
-		headers.set("Access-Control-Allow-Headers", CORS_ALLOW_HEADERS);
-		if (request?.method === "OPTIONS") headers.set("Access-Control-Max-Age", String(CORS_PREFLIGHT_MAX_AGE_SECONDS));
+function appendWalletSessionSignerSubjects(subjects, kind, signerActivations) {
+	if (signerActivations.keyFamilies.length === 1 && signerActivations.keyFamilies[0] === "ed25519") {
+		if (!signerActivations.ed25519) throw new Error("Ed25519 signer activation is missing");
+		subjects.push({
+			kind,
+			keyFamily: "ed25519",
+			materialActivation: signerActivations.ed25519.materialActivation
+		});
 		return;
 	}
-	if (!opts?.corsOrigins) return;
-	let allowedOrigin;
-	const normalized = buildCorsOrigins(...opts.corsOrigins || []);
-	if (normalized === "*") {
-		allowedOrigin = "*";
-		headers.set("Access-Control-Allow-Origin", "*");
-	} else if (Array.isArray(normalized)) {
-		const originRaw = String(request?.headers.get("Origin") || "").trim();
-		const originNormalized = normalizeCorsOrigin(originRaw);
-		if (originRaw && originNormalized && normalized.includes(originNormalized)) {
-			allowedOrigin = originRaw;
-			headers.set("Access-Control-Allow-Origin", originRaw);
-			headers.append("Vary", "Origin");
-		}
-	}
-	headers.set("Access-Control-Allow-Methods", CORS_ALLOW_METHODS);
-	headers.set("Access-Control-Allow-Headers", CORS_ALLOW_HEADERS);
-	if (allowedOrigin && request?.method === "OPTIONS") headers.set("Access-Control-Max-Age", String(CORS_PREFLIGHT_MAX_AGE_SECONDS));
-	headers.set("Access-Control-Expose-Headers", "Server-Timing, X-Seams-Wallet-Region");
-	if (allowedOrigin && allowedOrigin !== "*") headers.set("Access-Control-Allow-Credentials", "true");
-}
-async function readJson(request) {
-	try {
-		return await request.json();
-	} catch {
-		return null;
+	if (signerActivations.keyFamilies.length === 1 && signerActivations.keyFamilies[0] === "ecdsa_secp256k1") {
+		if (!signerActivations.ecdsa) throw new Error("ECDSA signer activation is missing");
+		subjects.push({
+			kind,
+			keyFamily: "ecdsa_secp256k1",
+			materialActivation: signerActivations.ecdsa.materialActivation
+		});
+		return;
 	}
+	if (!signerActivations.ed25519 || !signerActivations.ecdsa) throw new Error("both-family signer activations are incomplete");
+	subjects.push({
+		kind,
+		keyFamily: "ed25519",
+		materialActivation: signerActivations.ed25519.materialActivation
+	}, {
+		kind,
+		keyFamily: "ecdsa_secp256k1",
+		materialActivation: signerActivations.ecdsa.materialActivation
+	});
 }
-function headersToRecord(headers) {
-	const out = {};
-	headers.forEach((v, k) => {
-		out[k] = v;
+function buildWalletSessionCapabilitySubjectsV1(authority) {
+	const subjects = [];
+	if (authority.permissions.includes("sign")) appendWalletSessionSignerSubjects(subjects, "sign", authority.signerActivations);
+	if (authority.permissions.includes("export_keys")) appendWalletSessionSignerSubjects(subjects, "export_keys", authority.signerActivations);
+	if (authority.permissions.includes("link_devices")) subjects.push({
+		kind: "link_devices",
+		authorityId: authority.authorityId
 	});
-	return out;
+	if (authority.permissions.includes("revoke_devices")) subjects.push({
+		kind: "revoke_devices",
+		authorityId: authority.authorityId
+	});
+	const [firstSubject, ...remainingSubjects] = subjects;
+	if (!firstSubject) throw new Error("active wallet authority must produce capability subjects");
+	return [firstSubject, ...remainingSubjects];
 }
-//#endregion
-//#region src/router/transport/fetch/routes/externalAuth.ts
-const ACTIONS = [
-	"associate",
-	"unlink",
-	"prepare",
-	"exchange",
-	"backend-exchange",
-	"redeem",
-	"settings",
-	"logout"
-];
-function parseCommand(action, body) {
-	const wallet = parseWalletId(body.walletId);
-	if (!wallet.ok) throw new Error("Wallet ID is invalid");
-	const walletId = wallet.value;
-	if (action === "backend-exchange") return {
-		action,
-		walletId,
-		attemptId: requireCanonicalString(body.attemptId, "attemptId"),
-		idToken: requireCanonicalString(body.idToken, "idToken")
+function buildWalletSessionAuthorizationV2(fields) {
+	requireNonnegativeInteger(fields.authorityRevocationEpoch, "Wallet Session authority revocation epoch");
+	parseDigestB64u(fields.authorityDigestB64u);
+	if (fields.capabilitySubjects.length === 0) throw new Error("Wallet Session capability subjects are required");
+	requireOrderedTimes(fields.createdAtMs, fields.expiresAtMs, "Wallet Session authorization");
+	const identityValues = [
+		String(fields.authorizationId),
+		String(fields.walletSessionId),
+		String(fields.quotaId)
+	];
+	if (new Set(identityValues).size !== identityValues.length) throw new Error("Wallet Session authorization identities must be pairwise distinct");
+	return {
+		kind: "wallet_session_authorization_v2",
+		tenantId: fields.tenantId,
+		principalId: fields.principalId,
+		walletId: fields.walletId,
+		authorityId: fields.authorityId,
+		walletAuthMethodId: fields.walletAuthMethodId,
+		authorityDigestB64u: fields.authorityDigestB64u,
+		authorityRevocationEpoch: fields.authorityRevocationEpoch,
+		mintId: fields.mintId,
+		authorizationId: fields.authorizationId,
+		walletSessionId: fields.walletSessionId,
+		quotaId: fields.quotaId,
+		capabilitySubjects: fields.capabilitySubjects,
+		createdAtMs: fields.createdAtMs,
+		expiresAtMs: fields.expiresAtMs
 	};
-	const appOrigin = requireCanonicalString(body.appOrigin, "appOrigin");
-	if (new URL(appOrigin).origin !== appOrigin) throw new Error("Application origin is invalid");
-	switch (action) {
-		case "associate": return {
-			action,
-			walletId,
-			appOrigin,
-			ownerCredential: requireCanonicalString(body.ownerCredential, "ownerCredential"),
-			idToken: requireCanonicalString(body.idToken, "idToken")
-		};
-		case "unlink": return {
-			action,
-			walletId,
-			appOrigin,
-			ownerCredential: requireCanonicalString(body.ownerCredential, "ownerCredential"),
-			associationId: requireCanonicalString(body.associationId, "associationId")
-		};
-		case "prepare": return {
-			action,
-			walletId,
-			appOrigin,
-			binding: secret(body.binding, "binding"),
-			sessionToken: secret(body.sessionToken, "sessionToken")
-		};
-		case "exchange": return {
-			action,
-			walletId,
-			appOrigin,
-			attemptId: requireCanonicalString(body.attemptId, "attemptId"),
+}
+function walletSessionCapabilitySubjectsV1Equal(left, right) {
+	if (left.length !== right.length) return false;
+	for (let index = 0; index < left.length; index += 1) {
+		const leftSubject = left[index];
+		const rightSubject = right[index];
+		if (!leftSubject || !rightSubject || leftSubject.kind !== rightSubject.kind) return false;
+		switch (leftSubject.kind) {
+			case "sign":
+			case "export_keys": break;
+			case "link_devices":
+			case "revoke_devices":
+				if (rightSubject.kind !== leftSubject.kind || leftSubject.authorityId !== rightSubject.authorityId) return false;
+				break;
+		}
+		if (leftSubject.kind === "sign" || leftSubject.kind === "export_keys") {
+			if (rightSubject.kind !== leftSubject.kind || leftSubject.keyFamily !== rightSubject.keyFamily || !mpcMaterialActivationRefsEqual(leftSubject.materialActivation, rightSubject.materialActivation)) return false;
+		}
+	}
+	return true;
+}
+function walletSessionAuthorizationV2RecordsEqual(left, right) {
+	return left.kind === right.kind && left.tenantId === right.tenantId && left.principalId === right.principalId && left.walletId === right.walletId && left.authorityId === right.authorityId && left.walletAuthMethodId === right.walletAuthMethodId && left.authorityDigestB64u === right.authorityDigestB64u && left.authorityRevocationEpoch === right.authorityRevocationEpoch && left.mintId === right.mintId && left.authorizationId === right.authorizationId && left.walletSessionId === right.walletSessionId && left.quotaId === right.quotaId && walletSessionCapabilitySubjectsV1Equal(left.capabilitySubjects, right.capabilitySubjects) && left.createdAtMs === right.createdAtMs && left.expiresAtMs === right.expiresAtMs;
+}
+function parseMpcMaterialActivationRefRequired(value) {
+	const parsed = parseMpcMaterialActivationRef(value);
+	if (!parsed.ok) throw new Error(parsed.error.message);
+	return parsed.value;
+}
+function parseWalletAuthorityIdRequired(value) {
+	const parsed = parseWalletAuthorityId(value);
+	if (!parsed.ok) throw new Error(parsed.error.message);
+	return parsed.value;
+}
+function parseWalletAuthMethodIdRequired(value) {
+	const parsed = parseWalletAuthMethodId(value);
+	if (!parsed.ok) throw new Error(parsed.error.message);
+	return parsed.value;
+}
+function parseWalletSessionCapabilitySubject(value) {
+	if (!isWalletSessionCapabilitySubjectRecordV1(value) || typeof value.kind !== "string") throw new Error("Wallet Session capability subject must be an object");
+	switch (value.kind) {
+		case "sign":
+		case "export_keys":
+			if (Object.keys(value).sort().join("|") !== "keyFamily|kind|materialActivation") throw new Error("Wallet Session signer capability subject contains unexpected fields");
+			if (value.keyFamily !== "ed25519" && value.keyFamily !== "ecdsa_secp256k1") throw new Error("Wallet Session signer capability subject key family is invalid");
+			return {
+				kind: value.kind,
+				keyFamily: value.keyFamily,
+				materialActivation: parseMpcMaterialActivationRefRequired(value.materialActivation)
+			};
+		case "link_devices":
+		case "revoke_devices":
+			if (Object.keys(value).sort().join("|") !== "authorityId|kind") throw new Error("Wallet Session administration capability subject contains unexpected fields");
+			return {
+				kind: value.kind,
+				authorityId: parseWalletAuthorityIdRequired(value.authorityId)
+			};
+		default: throw new Error("Wallet Session capability subject kind is unsupported");
+	}
+}
+function isWalletSessionCapabilitySubjectRecordV1(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function parseWalletSessionCapabilitySubjects(value) {
+	if (!Array.isArray(value) || value.length === 0) throw new Error("Wallet Session capability subjects must be non-empty");
+	const subjects = [];
+	for (const subject of value) subjects.push(parseWalletSessionCapabilitySubject(subject));
+	const [firstSubject, ...remainingSubjects] = subjects;
+	if (!firstSubject) throw new Error("Wallet Session capability subjects must be non-empty");
+	return [firstSubject, ...remainingSubjects];
+}
+function parseWalletSessionAuthorizationV2(value) {
+	if (!isWalletSessionAuthorizationRecordV2(value)) throw new Error("Wallet Session authorization V2 contains unexpected fields");
+	if (value.kind !== "wallet_session_authorization_v2") throw new Error("Wallet Session authorization V2 kind is invalid");
+	const tenantId = parseTenantIdRequired(value.tenantId);
+	const principalId = parsePrincipalIdRequired(value.principalId);
+	const walletId = parseWalletIdRequired(value.walletId);
+	const authorityId = parseWalletAuthorityIdRequired(value.authorityId);
+	const walletAuthMethodId = parseWalletAuthMethodIdRequired(value.walletAuthMethodId);
+	const authorityDigestB64u = parseDigestB64u(value.authorityDigestB64u);
+	const mintIdResult = parseWalletSessionMintId(value.mintId);
+	if (!mintIdResult.ok) throw new Error(mintIdResult.error.message);
+	const authorizationIdResult = parseWalletSessionAuthorizationId(value.authorizationId);
+	if (!authorizationIdResult.ok) throw new Error(authorizationIdResult.error.message);
+	const walletSessionId = parseWalletSessionIdRequired(value.walletSessionId);
+	const quotaId = parseMpcWalletSigningQuotaIdRequired(value.quotaId);
+	return buildWalletSessionAuthorizationV2({
+		tenantId,
+		principalId,
+		walletId,
+		authorityId,
+		walletAuthMethodId,
+		authorityDigestB64u,
+		authorityRevocationEpoch: requireNonnegativeInteger(value.authorityRevocationEpoch, "Wallet Session authority revocation epoch"),
+		mintId: mintIdResult.value,
+		authorizationId: authorizationIdResult.value,
+		walletSessionId,
+		quotaId,
+		capabilitySubjects: parseWalletSessionCapabilitySubjects(value.capabilitySubjects),
+		createdAtMs: requirePositiveTimestamp(value.createdAtMs, "Wallet Session createdAtMs"),
+		expiresAtMs: requirePositiveTimestamp(value.expiresAtMs, "Wallet Session expiresAtMs")
+	});
+}
+function isWalletSessionAuthorizationRecordV2(value) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
+	return Object.keys(value).sort().join("|") === "authorityDigestB64u|authorityId|authorityRevocationEpoch|authorizationId|capabilitySubjects|createdAtMs|expiresAtMs|kind|mintId|principalId|quotaId|tenantId|walletAuthMethodId|walletId|walletSessionId";
+}
+async function buildAuthorizedOperation(input) {
+	if (input.tenantId !== input.operation.tenantId) throw new Error("authorized operation tenant must match its operation envelope");
+	const operationFingerprintDigest = await computeCapabilityOperationFingerprintDigest(input.operation);
+	return {
+		...input,
+		kind: "authorized_operation",
+		operationFingerprintDigest,
+		lifecycle: "claimed"
+	};
+}
+const AUTHORIZED_OPERATION_RESULT_DIGEST_DOMAIN_V1 = "seams:authorization:authorized-operation-result:v1";
+function parseAuthorizedOperationReplayResponse(value) {
+	if (!isAuthorizedOperationReplayResponseRecordV1(value)) throw new Error("authorized operation replay response must be an object");
+	const keys = Object.keys(value).sort();
+	if (keys.length !== 3 || keys.join("|") !== "bodyText|contentType|status") throw new Error("authorized operation replay response must contain only status, contentType, and bodyText");
+	const status = value.status;
+	if (typeof status !== "number" || !Number.isSafeInteger(status) || status < 200 || status > 599) throw new Error("authorized operation replay response status must be an HTTP status");
+	const contentType = value.contentType;
+	if (typeof contentType !== "string" || contentType.length === 0 || contentType.trim() !== contentType || contentType.length > 255 || /[\u0000-\u001f\u007f]/.test(contentType)) throw new Error("authorized operation replay response contentType is invalid");
+	const bodyText = value.bodyText;
+	if (typeof bodyText !== "string") throw new Error("authorized operation replay response bodyText must be text");
+	if (new TextEncoder().encode(bodyText).byteLength > 65536) throw new Error("authorized operation replay response bodyText is too large");
+	if (responseStatusHasNoBody(status) && bodyText.length !== 0) throw new Error("authorized operation replay response status cannot carry a body");
+	return {
+		status,
+		contentType,
+		bodyText
+	};
+}
+function authorizedOperationReplayBodyInit(response) {
+	const parsed = parseAuthorizedOperationReplayResponse(response);
+	return responseStatusHasNoBody(parsed.status) ? null : parsed.bodyText;
+}
+function responseStatusHasNoBody(status) {
+	return status === 204 || status === 205 || status === 304;
+}
+function isAuthorizedOperationReplayResponseRecordV1(value) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
+	return Object.keys(value).sort().join("|") === "bodyText|contentType|status";
+}
+async function computeAuthorizedOperationResultDigest(response) {
+	return parseDigestB64u(base64UrlEncode(await sha256BytesUtf8(`${AUTHORIZED_OPERATION_RESULT_DIGEST_DOMAIN_V1}|${alphabetizeStringify(parseAuthorizedOperationReplayResponse(response))}`)));
+}
+function parseHostedWalletSeamsSessionExchangeCode(value) {
+	return parseAuthorizationDomainId(value, "hostedWalletSessionExchangeCode");
+}
+function parseVerifiedOwnerProofId(value) {
+	return parseAuthorizationDomainId(value, "verifiedOwnerProofId");
+}
+function parseHostedWalletSeamsSessionExchangeNonce(value) {
+	return parseAuthorizationDomainId(value, "hostedWalletSessionExchangeNonce");
+}
+function parseHostedWalletSessionCredentialId(value) {
+	return parseAuthorizationDomainId(value, "hostedWalletSessionCredentialId");
+}
+function parsePrimaryWalletSessionOperationCredentialToken(value) {
+	if (typeof value !== "string" || !/^wst_[A-Za-z0-9_-]{43}$/.test(value)) throw new Error("primary Wallet Session credential is invalid");
+	return parseAuthorizationDomainId(value, "primaryWalletSessionOperationCredentialToken");
+}
+function parseHostedWalletSessionOperationCredentialToken(value) {
+	if (typeof value !== "string" || !/^wsh_[A-Za-z0-9_-]{43}$/.test(value)) throw new Error("HostedWalletSessionOperationCredentialV1.token is invalid");
+	return parseAuthorizationDomainId(value, "hostedWalletSessionOperationCredentialToken");
+}
+function parseSessionOrigin(value) {
+	if (typeof value !== "string" || value.trim() !== value) throw new Error("session origin must be a canonical HTTP origin");
+	let url;
+	try {
+		url = new URL(value);
+	} catch {
+		throw new Error("session origin must be a canonical HTTP origin");
+	}
+	if (url.protocol !== "https:" && url.protocol !== "http:" || url.origin !== value || url.pathname !== "/" || url.search || url.hash) throw new Error("session origin must be a canonical HTTP origin");
+	return value;
+}
+function buildActiveWalletSessionQuota(fields) {
+	requirePositiveCount(fields.remainingUses, "Wallet Session quota remaining uses");
+	requirePositiveTime(fields.expiresAtMs, "Wallet Session quota expiry");
+	return {
+		kind: "active_wallet_session_quota",
+		tenantId: fields.tenantId,
+		principalId: fields.principalId,
+		walletSessionId: fields.walletSessionId,
+		quotaId: fields.quotaId,
+		remainingUses: fields.remainingUses,
+		expiresAtMs: fields.expiresAtMs
+	};
+}
+function parseAuthorizationDomainId(value, fieldName) {
+	if (typeof value !== "string" || value.trim() !== value || value.length === 0 || value.length > 512 || /[\s\u0000-\u001f\u007f]/.test(value)) throw new Error(`${fieldName} must be a compact opaque identifier`);
+	return value;
+}
+function parseTenantIdRequired(value) {
+	const parsed = parseTenantId(value);
+	if (!parsed.ok) throw new Error(`linked-device authorization tenantId: ${parsed.error.message}`);
+	return parsed.value;
+}
+function parsePrincipalIdRequired(value) {
+	const parsed = parsePrincipalId(value);
+	if (!parsed.ok) throw new Error(`linked-device authorization principalId: ${parsed.error.message}`);
+	return parsed.value;
+}
+function parseWalletIdRequired(value) {
+	const parsed = parseWalletId(value);
+	if (!parsed.ok) throw new Error(`linked-device authorization walletId: ${parsed.error.message}`);
+	return parsed.value;
+}
+function parseWalletSessionIdRequired(value) {
+	const parsed = parseWalletSessionId(value);
+	if (!parsed.ok) throw new Error(`linked-device authorization walletSessionId: ${parsed.error.message}`);
+	return parsed.value;
+}
+function parseMpcWalletSigningQuotaIdRequired(value) {
+	const parsed = parseMpcWalletSigningQuotaId(value);
+	if (!parsed.ok) throw new Error(`linked-device authorization quotaId: ${parsed.error.message}`);
+	return parsed.value;
+}
+function requirePositiveCount(value, label) {
+	if (!Number.isSafeInteger(value) || value <= 0) throw new Error(`${label} must be a positive safe integer`);
+}
+function requireNonnegativeInteger(value, label) {
+	if (typeof value !== "number" || !Number.isSafeInteger(value) || value < 0) throw new Error(`${label} must be a nonnegative safe integer`);
+	return value;
+}
+function requirePositiveTimestamp(value, label) {
+	if (typeof value !== "number" || !Number.isSafeInteger(value) || value <= 0) throw new Error(`${label} must be a positive safe integer`);
+	return value;
+}
+function requirePositiveTime(value, label) {
+	if (!Number.isSafeInteger(value) || value <= 0) throw new Error(`${label} must be a positive timestamp`);
+}
+function requireOrderedTimes(createdAtMs, expiresAtMs, label) {
+	requirePositiveTime(createdAtMs, `${label} creation`);
+	requirePositiveTime(expiresAtMs, `${label} expiry`);
+	if (expiresAtMs <= createdAtMs) throw new Error(`${label} expiry must follow creation`);
+}
+//#endregion
+//#region src/authorization/factorEvidence.ts
+function buildVerifiedWalletOperationPasskeyFactorResult(fields) {
+	requireVerificationWindow(fields.verifiedAtMs, fields.expiresAtMs);
+	return {
+		kind: "verified_wallet_operation_passkey_factor",
+		...fields
+	};
+}
+function buildVerifiedWalletOperationEmailOtpFactorResult(fields) {
+	requireVerificationWindow(fields.verifiedAtMs, fields.expiresAtMs);
+	return {
+		kind: "verified_wallet_operation_email_otp_factor",
+		...fields
+	};
+}
+function buildVerifiedWalletSessionPasskeyFactorResult(fields) {
+	requireVerificationWindow(fields.verifiedAtMs, fields.expiresAtMs);
+	return {
+		kind: "verified_wallet_session_passkey_factor",
+		tenantId: fields.tenantId,
+		principalId: fields.principalId,
+		walletId: fields.walletId,
+		authorityRef: fields.authorityRef,
+		requestOrigin: fields.requestOrigin,
+		audience: fields.audience,
+		factorId: fields.factorId,
+		credentialIdB64u: fields.credentialIdB64u,
+		assertionDigest: fields.assertionDigest,
+		verifiedAtMs: fields.verifiedAtMs,
+		expiresAtMs: fields.expiresAtMs
+	};
+}
+function buildVerifiedWalletSessionEmailOtpFactorResult(fields) {
+	requireVerificationWindow(fields.verifiedAtMs, fields.expiresAtMs);
+	return {
+		kind: "verified_wallet_session_email_otp_factor",
+		tenantId: fields.tenantId,
+		principalId: fields.principalId,
+		walletId: fields.walletId,
+		authorityRef: fields.authorityRef,
+		requestOrigin: fields.requestOrigin,
+		audience: fields.audience,
+		factorId: fields.factorId,
+		challengeId: fields.challengeId,
+		verificationReceiptDigest: fields.verificationReceiptDigest,
+		verifiedAtMs: fields.verifiedAtMs,
+		expiresAtMs: fields.expiresAtMs
+	};
+}
+function requireVerificationWindow(verifiedAtMs, expiresAtMs) {
+	if (!Number.isSafeInteger(verifiedAtMs) || !Number.isSafeInteger(expiresAtMs) || verifiedAtMs <= 0 || expiresAtMs <= verifiedAtMs) throw new Error("verified factor expiry must follow verification");
+}
+//#endregion
+//#region ../shared-ts/src/utils/errors.ts
+/**
+* Best-effort error message extractor without relying on `any`.
+* Always returns a string (may be empty when nothing usable can be derived).
+*/
+function errorMessage$3(err) {
+	try {
+		if (typeof err === "string") return err;
+		if (err && typeof err.message === "string") return err.message;
+		return String(err ?? "");
+	} catch {
+		return "";
+	}
+}
+function b64uField(prefix) {
+	return `${prefix}B64u`;
+}
+b64uField("seed"), b64uField("canonicalSeed"), b64uField("xClientBase"), b64uField("clientOutputMask"), b64uField("clientRecoverableSecret"), b64uField("prfFirst"), b64uField("prfSecond"), b64uField("signingShare32"), b64uField("clientNonceHandle");
+//#endregion
+//#region ../shared-ts/src/utils/failure.ts
+function failure$6(code, message) {
+	return {
+		ok: false,
+		code,
+		message
+	};
+}
+function failedVerification(code, message) {
+	return {
+		ok: false,
+		verified: false,
+		code,
+		message
+	};
+}
+//#endregion
+//#region src/router/auth/webAuthnCredentialCodecs.ts
+function containsWebAuthnExtensionOutput(value) {
+	if (value == null) return false;
+	if (!isPlainObject(value)) return true;
+	for (const nested of Object.values(value)) if (containsWebAuthnExtensionOutput(nested)) return true;
+	return false;
+}
+function unredactedWebAuthnExtensionField(input) {
+	if (!isPlainObject(input)) return null;
+	if (containsWebAuthnExtensionOutput(input.clientExtensionResults)) return "clientExtensionResults";
+	const response = input.response;
+	if (!isPlainObject(response)) return null;
+	if (containsWebAuthnExtensionOutput(response.clientExtensionResults)) return "response.clientExtensionResults";
+	return null;
+}
+function decodeWebAuthnBase64UrlOrBase64(input, fieldName) {
+	try {
+		return base64UrlDecode(input);
+	} catch {
+		try {
+			return base64Decode(input);
+		} catch (error) {
+			throw new Error(`Invalid ${fieldName}: expected base64url/base64 string (${errorMessage$3(error) || "decode failed"})`);
+		}
+	}
+}
+function parseWebAuthnClientDataJsonBase64url(clientDataJSONB64u) {
+	const bytes = decodeWebAuthnBase64UrlOrBase64(clientDataJSONB64u, "webauthn_authentication.response.clientDataJSON");
+	const json = new TextDecoder().decode(bytes);
+	let parsed;
+	try {
+		parsed = JSON.parse(json);
+	} catch {
+		throw new Error("Invalid clientDataJSON: expected object");
+	}
+	if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) throw new Error("Invalid clientDataJSON: expected object");
+	const challenge = normalizeOptionalTrimmedString(Reflect.get(parsed, "challenge"));
+	const origin = normalizeOptionalTrimmedString(Reflect.get(parsed, "origin"));
+	const type = normalizeOptionalTrimmedString(Reflect.get(parsed, "type"));
+	if (!challenge) throw new Error("Invalid clientDataJSON.challenge");
+	if (!origin) throw new Error("Invalid clientDataJSON.origin");
+	if (!type) throw new Error("Invalid clientDataJSON.type");
+	return {
+		challenge,
+		origin,
+		type
+	};
+}
+function webAuthnOriginHostnameOrEmpty(origin) {
+	try {
+		return new URL(origin).hostname.toLowerCase();
+	} catch {
+		return "";
+	}
+}
+function webAuthnCredentialIdB64uFromCredential(input) {
+	if (input === null || typeof input !== "object" || Array.isArray(input)) return failure$6("invalid_body", "Missing webauthn_authentication.id/rawId");
+	const rawId = normalizeOptionalTrimmedString(Reflect.get(input, "rawId"));
+	const id = normalizeOptionalTrimmedString(Reflect.get(input, "id"));
+	const selected = rawId || id;
+	if (!selected) return failure$6("invalid_body", "Missing webauthn_authentication.id/rawId");
+	try {
+		return {
+			ok: true,
+			credentialIdB64u: base64UrlEncode(decodeWebAuthnBase64UrlOrBase64(selected, "webauthn_authentication.rawId"))
+		};
+	} catch (error) {
+		return failure$6("invalid_body", errorMessage$3(error) || "Invalid credential rawId");
+	}
+}
+function parseWebAuthnAuthenticationCredential$2(input) {
+	if (input === null || typeof input !== "object" || Array.isArray(input)) return null;
+	const responseValue = Reflect.get(input, "response");
+	if (responseValue === null || typeof responseValue !== "object" || Array.isArray(responseValue)) return null;
+	const id = normalizeOptionalTrimmedString(Reflect.get(input, "id"));
+	const rawId = normalizeOptionalTrimmedString(Reflect.get(input, "rawId"));
+	const type = normalizeOptionalTrimmedString(Reflect.get(input, "type"));
+	const clientDataJSON = normalizeOptionalTrimmedString(Reflect.get(responseValue, "clientDataJSON"));
+	const authenticatorData = normalizeOptionalTrimmedString(Reflect.get(responseValue, "authenticatorData"));
+	const signature = normalizeOptionalTrimmedString(Reflect.get(responseValue, "signature"));
+	const rawUserHandle = Reflect.get(responseValue, "userHandle");
+	const userHandle = rawUserHandle === null ? null : normalizeOptionalTrimmedString(rawUserHandle) || null;
+	const rawAuthenticatorAttachment = Reflect.get(input, "authenticatorAttachment");
+	const authenticatorAttachment = rawAuthenticatorAttachment === null ? null : normalizeOptionalTrimmedString(rawAuthenticatorAttachment) || null;
+	if (!id || !rawId || type !== "public-key") return null;
+	if (!clientDataJSON || !authenticatorData || !signature) return null;
+	return {
+		id,
+		rawId,
+		type,
+		authenticatorAttachment,
+		response: {
+			clientDataJSON,
+			authenticatorData,
+			signature,
+			userHandle
+		},
+		clientExtensionResults: Reflect.get(input, "clientExtensionResults") ?? null
+	};
+}
+//#endregion
+//#region src/router/domains/emailOtp/emailOtpSessionRouteHelpers.ts
+function emailOtpStatusCode(code) {
+	if (code === "internal") return 500;
+	if (code === "not_configured") return 503;
+	if (code === "not_found") return 404;
+	if (code === "rate_limited") return 429;
+	if (code === "stronger_auth_required") return 403;
+	if (code === "reenrollment_required" || code === "registration_attempt_missing" || code === "registration_attempt_expired") return 409;
+	if (code === "challenge_id_mismatch" || code === "challenge_purpose_mismatch" || code === "challenge_subject_mismatch" || code === "challenge_email_mismatch" || code === "challenge_wallet_mismatch" || code === "challenge_session_mismatch" || code === "challenge_org_mismatch" || code === "challenge_channel_mismatch" || code === "registration_reroll_disallowed" || code === "challenge_expired_or_invalid" || code === "invalid_otp") return 401;
+	return 400;
+}
+function emailOtpFailureAuditPayload(input) {
+	return {
+		source: input.source,
+		code: input.code,
+		message: input.message,
+		...input.challengeId ? { challengeId: input.challengeId } : {},
+		...input.otpChannel ? { otpChannel: input.otpChannel } : {},
+		...input.operation ? { operation: input.operation } : {},
+		...typeof input.lockedUntilMs === "number" ? { lockedUntilMs: input.lockedUntilMs } : {}
+	};
+}
+function shouldEmitEmailOtpLockedWebhook(code) {
+	return code === "otp_locked_out" || code === "otp_attempts_exhausted";
+}
+function emailOtpFailureWebhookEventDescriptors(input) {
+	const payload = emailOtpFailureAuditPayload(input);
+	const event = {
+		eventType: "wallet.email_otp.failed",
+		...input.challengeId ? { eventId: input.challengeId } : {},
+		payload
+	};
+	if (!shouldEmitEmailOtpLockedWebhook(input.code)) return [event];
+	return [event, {
+		eventType: "wallet.email_otp.locked",
+		...input.challengeId ? { eventId: input.challengeId } : {},
+		payload
+	}];
+}
+function emailOtpLoggedInWebhookEventDescriptor(input) {
+	return {
+		eventType: "wallet.email_otp.logged_in",
+		eventId: input.challengeId,
+		payload: {
+			otpChannel: input.otpChannel,
+			unlockBackend: input.unlockBackend,
+			challengeId: input.challengeId
+		}
+	};
+}
+async function hashEmailOtpOperationBinding(input) {
+	return base64UrlEncode(await sha256BytesUtf8(alphabetizeStringify({
+		walletId: input.walletId,
+		providerUserId: input.providerUserId,
+		orgId: input.orgId,
+		operation: input.operation,
+		requestOrigin: input.requestOrigin || "",
+		audience: input.audience || "",
+		...input.authorityRef !== void 0 ? { authorityRef: input.authorityRef } : {},
+		...input.operationFingerprintDigest ? { operationFingerprintDigest: input.operationFingerprintDigest } : {}
+	})));
+}
+//#endregion
+//#region src/router/framework/routeResponses.ts
+function routeJson(status, body, options) {
+	return {
+		status,
+		body,
+		...options?.headers ? { headers: options.headers } : {},
+		...options?.usage ? { usage: options.usage } : {}
+	};
+}
+function routeError(status, code, message) {
+	return routeJson(status, {
+		ok: false,
+		code,
+		message
+	});
+}
+function toFetchRouteResponse(response) {
+	return new Response(JSON.stringify(response.body), {
+		status: response.status,
+		headers: {
+			"Content-Type": "application/json; charset=utf-8",
+			...response.headers || {}
+		}
+	});
+}
+//#endregion
+//#region src/router/transport/fetch/routes/walletCustodyRequestBoundary.ts
+function requireExactObjectFields(value, fields, label) {
+	const keys = Object.keys(value).sort();
+	const expected = [...fields].sort();
+	if (keys.length !== expected.length || keys.some((key, index) => key !== expected[index])) throw new Error(`${label} contains unsupported fields`);
+}
+function parseCustodyOwnerProof(value) {
+	if (!isPlainObject(value)) throw new Error("factorProof is required");
+	const kind = normalizeOptionalTrimmedString(value.kind);
+	if (kind === "passkey") {
+		requireExactObjectFields(value, [
+			"kind",
+			"walletId",
+			"rpId",
+			"credentialIdB64u",
+			"challenge_digest",
+			"webauthn_authentication"
+		], "factorProof");
+		const extensionField = unredactedWebAuthnExtensionField(value.webauthn_authentication);
+		if (extensionField) throw new Error(`factorProof.webauthn_authentication.${extensionField} must be redacted`);
+		const webauthnAuthentication = parseWebAuthnAuthenticationCredential$2(value.webauthn_authentication);
+		if (!webauthnAuthentication) throw new Error("factorProof.webauthn_authentication is invalid");
+		return {
+			kind,
+			walletId: requireTrimmedString(value.walletId, "factorProof.walletId"),
+			rpId: requireTrimmedString(value.rpId, "factorProof.rpId"),
+			credentialIdB64u: requireTrimmedString(value.credentialIdB64u, "factorProof.credentialIdB64u"),
+			challenge_digest: requireTrimmedString(value.challenge_digest, "factorProof.challenge_digest"),
+			webauthn_authentication: webauthnAuthentication
+		};
+	}
+	if (kind === "email_otp") {
+		requireExactObjectFields(value, [
+			"kind",
+			"provider_subject_id",
+			"challenge_id",
+			"otp_code",
+			"challenge_digest"
+		], "factorProof");
+		return {
+			kind,
+			provider_subject_id: requireTrimmedString(value.provider_subject_id, "factorProof.provider_subject_id"),
+			challenge_id: requireTrimmedString(value.challenge_id, "factorProof.challenge_id"),
+			otp_code: requireTrimmedString(value.otp_code, "factorProof.otp_code"),
+			challenge_digest: requireTrimmedString(value.challenge_digest, "factorProof.challenge_digest")
+		};
+	}
+	throw new Error("factorProof.kind must be passkey or email_otp");
+}
+function parseRecoveryBackupAcknowledgementRequest(body) {
+	if (!isPlainObject(body)) throw new Error("acknowledgement body is required");
+	requireExactObjectFields(body, [
+		"expectedIssuedAtMs",
+		"factorProof",
+		"requestId",
+		"walletId"
+	], "recovery backup acknowledgement");
+	return {
+		walletId: requireTrimmedString(body.walletId, "walletId"),
+		requestId: requireTrimmedString(body.requestId, "requestId"),
+		expectedIssuedAtMs: parseUnixMs$1(body.expectedIssuedAtMs, "expectedIssuedAtMs"),
+		factorProof: body.factorProof
+	};
+}
+function parseRecoveryStatusRequest(body) {
+	if (!isPlainObject(body)) throw new Error("status body is required");
+	requireExactObjectFields(body, ["factorProof", "requestId"], "recovery status");
+	return {
+		requestId: requireTrimmedString(body.requestId, "requestId"),
+		factorProof: body.factorProof
+	};
+}
+//#endregion
+//#region src/router/transport/fetch/walletOwnerOperationAuthorization.ts
+const CUSTODY_OPERATION_CAPABILITY_ID = "wallet-custody-admin";
+const CUSTODY_PROOF_TTL_MS = 6e4;
+function walletOwnerOperationAuthorizationId(operation, challenge) {
+	return requireParsed$4(parseAuthorizedOperationId(`wallet-custody:authorized:wallet-custody:${operation}:${challenge}`), "owner operation");
+}
+function hasFullOwnerAuthority$1(authority) {
+	return sameDelegatedWalletAuthorityV1(buildDelegatedWalletAuthorityV1({ permissions: authority.permissions }), buildDelegatedWalletAuthorityV1({ permissions: buildFullOwnerPermissionsV1() }));
+}
+async function custodyDigest(domain, value) {
+	return sha256Utf8DigestB64u(`${domain}|${alphabetizeStringify(value)}`);
+}
+async function buildWalletCustodyOperation(input) {
+	const tenantId = requireParsed$4(parseTenantId(input.tenantId), "authorization");
+	const principalId = requireParsed$4(parsePrincipalId(input.principalId), "authorization");
+	const capabilityId = requireParsed$4(parseCapabilityId(CUSTODY_OPERATION_CAPABILITY_ID), "authorization");
+	const operationRef = buildVaultOperationRef("vault.reveal");
+	const laneDigest = await custodyDigest("seams:wallet-custody:lane:v1", {
+		capabilityId,
+		operation: input.operation,
+		operationRef
+	});
+	const challengeDigest = await computeWalletOwnerAdminChallengeDigest({
+		walletId: input.walletId,
+		operation: input.operation,
+		payload: input.payload,
+		requestOrigin: input.requestOrigin
+	});
+	const intentDigest = challengeDigest;
+	const displayDigest = await custodyDigest("seams:wallet-custody:display:v1", {
+		walletId: input.walletId,
+		operation: input.operation
+	});
+	return {
+		operation: buildCapabilityOperationEnvelope({
+			tenantId,
+			principalId,
+			capabilityId,
+			operationId: requireParsed$4(parseCapabilityOperationId(`wallet-custody:${input.operation}:${intentDigest}`), "authorization"),
+			operation: operationRef,
+			digests: {
+				laneDigest,
+				intentDigest,
+				displayDigest
+			}
+		}),
+		challengeDigest
+	};
+}
+async function authorizeWalletOwnerOperation(input) {
+	const requestOrigin = normalizeOptionalTrimmedString(input.ctx.request.headers.get("origin"));
+	if (!requestOrigin) return toCustodyAuthorizationFailure(400, "invalid_origin", "request Origin is required");
+	let origin;
+	let proof;
+	let walletId;
+	try {
+		origin = parseSessionOrigin(requestOrigin);
+		walletId = requireParsed$4(parseWalletId(input.walletId), "authorization");
+		proof = parseCustodyOwnerProof(input.factorProof);
+	} catch (error) {
+		return toCustodyAuthorizationFailure(400, "invalid_owner_proof", error instanceof Error ? error.message : "owner proof is invalid");
+	}
+	if (proof.kind === "passkey" && proof.walletId !== input.walletId) return toCustodyAuthorizationFailure(403, "scope_mismatch", "owner proof wallet differs");
+	let principalId;
+	let factor;
+	let ownerAuthorityRef;
+	let ownerAuthority;
+	let operation;
+	let challengeDigest;
+	try {
+		principalId = proof.kind === "passkey" ? input.walletId : proof.provider_subject_id;
+		const built = await buildWalletCustodyOperation({
+			tenantId: input.ctx.service.authorizedOperations.tenantId,
+			principalId,
+			walletId: input.walletId,
+			operation: input.operation,
+			payload: input.payload,
+			requestOrigin
+		});
+		operation = built.operation;
+		challengeDigest = built.challengeDigest;
+	} catch (error) {
+		return toCustodyAuthorizationFailure(400, "invalid_owner_proof", error instanceof Error ? error.message : "owner proof binding is invalid");
+	}
+	const operationFingerprintDigest = await computeCapabilityOperationFingerprintDigest(operation);
+	const nowMs = Date.now();
+	if (proof.challenge_digest !== String(challengeDigest)) return toCustodyAuthorizationFailure(403, "scope_mismatch", "factor proof challenge does not match the requested operation");
+	if (proof.kind === "passkey") {
+		let authority;
+		try {
+			authority = buildPasskeyWalletAuthAuthority({
+				walletId,
+				rpId: proof.rpId,
+				credentialIdB64u: proof.credentialIdB64u
+			});
+		} catch (error) {
+			return toCustodyAuthorizationFailure(400, "invalid_owner_proof", error instanceof Error ? error.message : "passkey authority is invalid");
+		}
+		const active = await input.ctx.service.walletAuthMethods.resolveActivePasskeyAuthorityForVerifiedCredential({
+			walletId,
+			rpId: authority.verifier.rpId,
+			credentialIdB64u: authority.factor.credentialIdB64u
+		});
+		if (!active.ok) return toCustodyAuthorizationFailure(403, active.code, active.message);
+		if (!hasFullOwnerAuthority$1(active.walletAuthority)) return toCustodyAuthorizationFailure(403, "forbidden", "Full owner authority is required");
+		ownerAuthority = active.walletAuthority;
+		const credential = parseWebAuthnAuthenticationCredential$2(proof.webauthn_authentication);
+		if (!credential) return toCustodyAuthorizationFailure(400, "invalid_owner_proof", "passkey assertion is invalid");
+		if (String(credential.rawId || credential.id).trim() !== authority.factor.credentialIdB64u) return toCustodyAuthorizationFailure(401, "unauthorized", "passkey credential changed");
+		const verified = await input.ctx.service.webAuthn.verifyWebAuthnAuthenticationLite({
+			userId: input.walletId,
+			rpId: authority.verifier.rpId,
+			expectedChallenge: challengeDigest,
+			expected_origin: requestOrigin,
+			webauthn_authentication: credential
+		});
+		if (!verified.success || !verified.verified) return toCustodyAuthorizationFailure(401, verified.code || "not_verified", verified.message || "WebAuthn authentication verification failed");
+		ownerAuthorityRef = await walletAuthAuthorityRef({ authority: active.authority });
+		factor = buildVerifiedWalletOperationPasskeyFactorResult({
+			tenantId: operation.tenantId,
+			principalId: operation.principalId,
+			walletId,
+			authorityRef: ownerAuthorityRef,
+			requestOrigin: origin,
+			audience: origin,
+			factorId: requireParsed$4(parseAuthFactorId(`passkey:${authority.factor.credentialIdB64u}`), "authorization"),
+			credentialIdB64u: requireParsed$4(parseWebAuthnCredentialIdB64u(authority.factor.credentialIdB64u), "authorization"),
+			assertionDigest: await custodyDigest("seams:wallet-custody:assertion:v1", { credential }),
+			operation,
+			verifiedAtMs: nowMs,
+			expiresAtMs: nowMs + CUSTODY_PROOF_TTL_MS
+		});
+	} else {
+		const providerSubject = requireParsed$4(parseProviderSubject(proof.provider_subject_id), "authorization");
+		const orgId = requireParsed$4(parseOrgId(input.ctx.service.authorizedOperations.tenantId), "authorization");
+		const active = await input.ctx.service.walletAuthMethods.resolveActiveEmailOtpAuthorityForVerifiedSubject({
+			walletId: input.walletId,
+			providerUserId: proof.provider_subject_id
+		});
+		if (!active.ok) return toCustodyAuthorizationFailure(403, active.code, active.message);
+		const activeAuthorityRef = await walletAuthAuthorityRef({ authority: active.authority });
+		ownerAuthorityRef = activeAuthorityRef;
+		ownerAuthority = active.walletAuthority;
+		const ownerProofBindingDigest = await hashEmailOtpOperationBinding({
+			walletId: input.walletId,
+			providerUserId: proof.provider_subject_id,
+			orgId,
+			operation: `wallet_custody:${input.operation}`,
+			requestOrigin,
+			audience: requestOrigin,
+			authorityRef: activeAuthorityRef,
+			operationFingerprintDigest: challengeDigest
+		});
+		const verified = await input.ctx.service.emailOtp.verifyEmailOtpChallenge({
+			userId: proof.provider_subject_id,
+			walletId: input.walletId,
+			orgId,
+			challengeId: proof.challenge_id,
+			otpCode: proof.otp_code,
+			otpChannel: EMAIL_OTP_CHANNEL,
+			ownerProofBindingDigest,
+			operation: WALLET_EMAIL_OTP_UNLOCK_OPERATION
+		});
+		if (!verified.ok) return toCustodyAuthorizationFailure(verified.code === "invalid_body" ? 400 : 401, verified.code, verified.message);
+		const consumed = await input.ctx.service.emailOtp.consumeEmailOtpGrant({
+			subject: {
+				kind: "provider_identity",
+				orgId,
+				providerSubject,
+				walletId
+			},
+			loginGrant: verified.loginGrant,
+			otpChannel: EMAIL_OTP_CHANNEL
+		});
+		if (!consumed.ok) return toCustodyAuthorizationFailure(emailOtpStatusCode(consumed.code), consumed.code, consumed.message);
+		factor = buildVerifiedWalletOperationEmailOtpFactorResult({
+			tenantId: operation.tenantId,
+			principalId: operation.principalId,
+			walletId,
+			authorityRef: activeAuthorityRef,
+			requestOrigin: origin,
+			audience: origin,
+			factorId: requireParsed$4(parseAuthFactorId(`email_otp:${active.authority.factor.provider}:${proof.provider_subject_id}`), "authorization"),
+			operation,
+			challengeId: requireParsed$4(parseEmailOtpChallengeId(consumed.challengeId), "authorization"),
+			verificationReceiptDigest: await custodyDigest("seams:wallet-custody:otp-receipt:v1", {
+				challengeId: consumed.challengeId,
+				operationFingerprintDigest
+			}),
+			verifiedAtMs: nowMs,
+			expiresAtMs: Math.min(nowMs + CUSTODY_PROOF_TTL_MS, verified.grantExpiresAtMs)
+		});
+	}
+	const ownerProof = await input.ctx.service.authorizedOperations.buildVerifiedOwnerProof({
+		purpose: "operation",
+		proofId: parseVerifiedOwnerProofId(`wallet-custody:${operation.operationId}`),
+		factor
+	});
+	if (ownerProof.purpose !== "operation" || ownerProof.operation.operationFingerprintDigest !== operationFingerprintDigest) return toCustodyAuthorizationFailure(403, "owner_proof_rejected", "owner proof binding is invalid");
+	const existing = await input.ctx.service.authorizedOperations.readAuthorizedOperation({
+		tenantId: operation.tenantId,
+		operationFingerprintDigest
+	});
+	if (existing) {
+		if (existing.authorization.kind !== "verified_step_up" || existing.quota.kind !== "quota_neutral") return toCustodyAuthorizationFailure(403, "owner_proof_rejected", "Owner operation authorization differs");
+		return {
+			ok: false,
+			response: authorizedOperationReplay(existing)
+		};
+	}
+	const evidenceSet = await input.ctx.service.authorizedOperations.recordVerifiedWalletOperationFactorEvidenceSet({
+		operation,
+		evidenceId: requireParsed$4(parseAuthorizationEvidenceId(`wallet-custody:evidence:${operation.operationId}`), "authorization"),
+		evidenceSetId: requireParsed$4(parseAuthorizationEvidenceSetId(`wallet-custody:evidence-set:${operation.operationId}`), "authorization"),
+		factor
+	});
+	const admission = await input.ctx.service.authorizedOperations.admitAuthorizedOperation({ operation: {
+		tenantId: operation.tenantId,
+		authorizedOperationId: walletOwnerOperationAuthorizationId(input.operation, challengeDigest),
+		auditEventId: requireParsed$4(parseAuthorizationAuditEventId(`wallet-custody:audit:${operation.operationId}`), "authorization"),
+		operation,
+		authorization: {
+			kind: "verified_step_up",
+			evidenceSetDigest: evidenceSet.evidenceSetDigest
+		},
+		quota: { kind: "quota_neutral" },
+		claimedAtMs: nowMs
+	} });
+	switch (admission.kind) {
+		case "claimed": return {
+			ok: true,
+			operation: admission.operation,
+			ownerAuthority
+		};
+		case "replayed":
+		case "operation_in_progress": return {
+			ok: false,
+			response: authorizedOperationReplay(admission.operation)
+		};
+		case "authorization_grant_rejected":
+		case "verified_step_up_rejected":
+		case "wallet_session_quota_exhausted":
+		case "material_mismatch": return toCustodyAuthorizationFailure(403, "owner_proof_rejected", "owner proof was rejected");
+	}
+}
+function toCustodyAuthorizationFailure(status, code, message) {
+	return {
+		ok: false,
+		response: routeErrorResponse$1(status, code, message)
+	};
+}
+function routeErrorResponse$1(status, code, message) {
+	return toFetchRouteResponse({
+		status,
+		body: {
+			ok: false,
+			code,
+			message
+		}
+	});
+}
+function authorizedOperationReplay(operation) {
+	if (operation.lifecycle !== "completed") return routeErrorResponse$1(409, "recovery_in_progress", "wallet recovery is still in progress");
+	return new Response(operation.response.bodyText, {
+		status: operation.response.status,
+		headers: { "content-type": operation.response.contentType }
+	});
+}
+async function completeWalletOwnerOperation(ctx, operation, status, body, result = "succeeded") {
+	const bodyText = JSON.stringify(body);
+	await ctx.service.authorizedOperations.completeAuthorizedOperation({
+		operation,
+		result,
+		response: {
+			status,
+			contentType: "application/json",
+			bodyText
+		},
+		completedAtMs: Date.now()
+	});
+	return toFetchRouteResponse({
+		status,
+		body
+	});
+}
+//#endregion
+//#region src/router/auth/routerApiKeyAuth.ts
+function readHeader(headers, name) {
+	if (headers instanceof Headers) return String(headers.get(name) || "").trim();
+	const direct = headers[name];
+	const lower = headers[name.toLowerCase()];
+	const upper = headers[name.toUpperCase()];
+	const value = direct ?? lower ?? upper;
+	if (typeof value === "string") return value.trim();
+	if (Array.isArray(value)) return String(value[0] || "").trim();
+	return "";
+}
+function extractBearerCredential(headers) {
+	const authHeader = readHeader(headers, "authorization");
+	if (authHeader) {
+		if (authHeader.toLowerCase().startsWith("bearer ")) {
+			const bearerValue = authHeader.slice(7).trim();
+			if (bearerValue) return bearerValue;
+		}
+	}
+	return null;
+}
+function normalizeSourceIp(raw) {
+	const value = String(raw || "").trim();
+	if (!value) return null;
+	const maybeForwarded = value.includes(",") ? value.split(",")[0] : value;
+	return String(maybeForwarded || "").trim() || null;
+}
+function extractRouterApiEnvironmentId(headers) {
+	const preferred = readHeader(headers, "x-seams-environment-id");
+	if (preferred) return preferred;
+	const fallback = readHeader(headers, "x-environment-id");
+	if (fallback) return fallback;
+	return null;
+}
+function resolveSourceIpFromFetchHeaders(headers) {
+	const cfConnecting = readHeader(headers, "cf-connecting-ip");
+	const forwarded = readHeader(headers, "x-forwarded-for");
+	const realIp = readHeader(headers, "x-real-ip");
+	return normalizeSourceIp(cfConnecting || forwarded || realIp);
+}
+//#endregion
+//#region src/core/SessionService.ts
+function normalizeParsedCorsOrigin(url) {
+	const host = url.hostname.toLowerCase();
+	const proto = url.protocol === "http:" || url.protocol === "https:" ? url.protocol : "https:";
+	const rawPort = String(url.port || "").trim();
+	return `${proto}//${host}${rawPort && !(proto === "https:" && rawPort === "443") && !(proto === "http:" && rawPort === "80") ? `:${rawPort}` : ""}`;
+}
+function parseCsvList(input) {
+	const out = /* @__PURE__ */ new Set();
+	for (const raw of String(input || "").split(",")) {
+		const s = raw.trim();
+		if (!s) continue;
+		try {
+			const u = new URL(s);
+			out.add(normalizeParsedCorsOrigin(u));
+		} catch {
+			const stripped = s.replace(/\/$/, "");
+			if (stripped) out.add(stripped);
+		}
+	}
+	return Array.from(out);
+}
+/**
+* Normalize a single origin for CORS comparisons.
+* Returns null when the input is empty or not URL-like.
+*/
+function normalizeCorsOrigin(input) {
+	const raw = String(input || "").trim();
+	if (!raw) return null;
+	try {
+		return normalizeParsedCorsOrigin(new URL(raw));
+	} catch {
+		return null;
+	}
+}
+function buildCorsOrigins(...inputs) {
+	const merged = /* @__PURE__ */ new Set();
+	for (const input of inputs) for (const origin of parseCsvList(input)) merged.add(origin);
+	const list = Array.from(merged);
+	return list.length > 0 ? list : "*";
+}
+//#endregion
+//#region ../shared-ts/src/utils/routerAbTraceContext.ts
+const ROUTER_AB_TRACE_ID_HEADER_V1 = "x-seams-trace-id";
+const TRACE_ID_PATTERN = /^[0-9a-f]{32}$/;
+function parseRouterAbTraceContextV1(raw) {
+	if (raw === null || raw === void 0 || raw === "") return {
+		ok: false,
+		reason: "missing",
+		message: "Router trace ID is missing"
+	};
+	if (typeof raw !== "string" || !TRACE_ID_PATTERN.test(raw)) return {
+		ok: false,
+		reason: "invalid",
+		message: "Router trace ID must be 32 lowercase hexadecimal characters"
+	};
+	return {
+		ok: true,
+		value: {
+			kind: "router_ab_trace_context_v1",
+			value: raw
+		}
+	};
+}
+function createRouterAbTraceContextV1() {
+	const bytes = new Uint8Array(16);
+	globalThis.crypto.getRandomValues(bytes);
+	let value = "";
+	for (const byte of bytes) value += byte.toString(16).padStart(2, "0");
+	return {
+		kind: "router_ab_trace_context_v1",
+		value
+	};
+}
+//#endregion
+//#region ../shared-ts/src/utils/walletManagementProtocol.ts
+const WALLET_MANAGEMENT_PROTOCOL_HEADER = "X-Seams-Wallet-Protocol";
+//#endregion
+//#region src/router/framework/http.ts
+const CORS_ALLOW_METHODS = "GET,POST,PUT,PATCH,DELETE,OPTIONS";
+const CORS_PREFLIGHT_MAX_AGE_SECONDS = 7200;
+const CORS_ALLOW_HEADERS = [
+	"Content-Type",
+	WALLET_MANAGEMENT_PROTOCOL_HEADER,
+	"Authorization",
+	"X-Seams-Wallet-Region",
+	"X-Seams-Benchmark-Diagnostics",
+	LINKED_DEVICE_REQUEST_PROOF_HEADER_V1,
+	ROUTER_AB_ED25519_YAO_RECOVERY_CHALLENGE_ID_HEADER_V1,
+	ROUTER_AB_TRACE_ID_HEADER_V1,
+	"X-Seams-Environment-Id",
+	"X-Environment-Id"
+].join(",");
+function json$3(body, init, extraHeaders) {
+	const headers = new Headers({ "Content-Type": "application/json; charset=utf-8" });
+	const initHeaders = init?.headers;
+	if (initHeaders) try {
+		new Headers(initHeaders).forEach((v, k) => headers.set(k, v));
+	} catch {}
+	if (extraHeaders) for (const [k, v] of Object.entries(extraHeaders)) headers.set(k, v);
+	const { headers: _omit, ...rest } = init || {};
+	return new Response(JSON.stringify(body), {
+		status: 200,
+		...rest,
+		headers
+	});
+}
+function jsonFailure(status, code, message) {
+	return json$3(failure$6(code, message), { status });
+}
+function withCors(headers, opts, request) {
+	const pathname = request ? new URL(request.url).pathname : "";
+	if (pathname === "/healthz" || pathname === "/readyz") {
+		headers.set("Access-Control-Allow-Origin", "*");
+		headers.delete("Access-Control-Allow-Credentials");
+		headers.set("Access-Control-Allow-Methods", CORS_ALLOW_METHODS);
+		headers.set("Access-Control-Allow-Headers", CORS_ALLOW_HEADERS);
+		if (request?.method === "OPTIONS") headers.set("Access-Control-Max-Age", String(CORS_PREFLIGHT_MAX_AGE_SECONDS));
+		return;
+	}
+	if (!opts?.corsOrigins) return;
+	let allowedOrigin;
+	const normalized = buildCorsOrigins(...opts.corsOrigins || []);
+	if (normalized === "*") {
+		allowedOrigin = "*";
+		headers.set("Access-Control-Allow-Origin", "*");
+	} else if (Array.isArray(normalized)) {
+		const originRaw = String(request?.headers.get("Origin") || "").trim();
+		const originNormalized = normalizeCorsOrigin(originRaw);
+		if (originRaw && originNormalized && normalized.includes(originNormalized)) {
+			allowedOrigin = originRaw;
+			headers.set("Access-Control-Allow-Origin", originRaw);
+			headers.append("Vary", "Origin");
+		}
+	}
+	headers.set("Access-Control-Allow-Methods", CORS_ALLOW_METHODS);
+	headers.set("Access-Control-Allow-Headers", CORS_ALLOW_HEADERS);
+	if (allowedOrigin && request?.method === "OPTIONS") headers.set("Access-Control-Max-Age", String(CORS_PREFLIGHT_MAX_AGE_SECONDS));
+	headers.set("Access-Control-Expose-Headers", "Server-Timing, X-Seams-Wallet-Region");
+	if (allowedOrigin && allowedOrigin !== "*") headers.set("Access-Control-Allow-Credentials", "true");
+}
+async function readJson(request) {
+	try {
+		return await request.json();
+	} catch {
+		return null;
+	}
+}
+function headersToRecord(headers) {
+	const out = {};
+	headers.forEach((v, k) => {
+		out[k] = v;
+	});
+	return out;
+}
+//#endregion
+//#region src/router/transport/fetch/routes/externalAuth.ts
+const ACTIONS = [
+	"associate",
+	"unlink",
+	"prepare",
+	"prepare-association",
+	"prepare-unlink",
+	"owner-challenge",
+	"exchange",
+	"backend-exchange",
+	"redeem",
+	"settings",
+	"logout"
+];
+function parseIdentityProof(value) {
+	const proof = requireRecord$1(value, "external identity proof");
+	switch (proof.kind) {
+		case "google": return {
+			kind: "google",
+			idToken: requireCanonicalString(proof.idToken, "idToken")
+		};
+		case "application": return {
+			kind: "application",
+			assertion: requireCanonicalString(proof.assertion, "assertion")
+		};
+		default: throw new Error("Unsupported external identity proof");
+	}
+}
+function parseCommand(action, body) {
+	const wallet = parseWalletId(body.walletId);
+	if (!wallet.ok) throw new Error("Wallet ID is invalid");
+	const walletId = wallet.value;
+	if (action === "backend-exchange") return {
+		action,
+		walletId,
+		attemptId: requireCanonicalString(body.attemptId, "attemptId"),
+		proof: parseIdentityProof(body.proof)
+	};
+	const appOrigin = requireCanonicalString(body.appOrigin, "appOrigin");
+	if (new URL(appOrigin).origin !== appOrigin) throw new Error("Application origin is invalid");
+	switch (action) {
+		case "associate":
+		case "unlink": return {
+			action,
+			walletId,
+			appOrigin,
+			attemptId: requireCanonicalString(body.attemptId, "attemptId"),
+			binding: secret(body.binding, "binding"),
+			sessionToken: secret(body.sessionToken, "sessionToken"),
+			code: secret(body.code, "code"),
+			factorProof: body.factorProof
+		};
+		case "owner-challenge": return {
+			action,
+			walletId,
+			appOrigin,
+			attemptId: requireCanonicalString(body.attemptId, "attemptId"),
+			binding: secret(body.binding, "binding"),
+			sessionToken: secret(body.sessionToken, "sessionToken"),
+			code: secret(body.code, "code")
+		};
+		case "prepare-unlink": return {
+			action,
+			walletId,
+			appOrigin,
+			associationId: requireCanonicalString(body.associationId, "associationId"),
+			binding: secret(body.binding, "binding"),
+			sessionToken: secret(body.sessionToken, "sessionToken")
+		};
+		case "prepare":
+		case "prepare-association": return {
+			action,
+			walletId,
+			appOrigin,
+			binding: secret(body.binding, "binding"),
+			sessionToken: secret(body.sessionToken, "sessionToken")
+		};
+		case "exchange": return {
+			action,
+			walletId,
+			appOrigin,
+			attemptId: requireCanonicalString(body.attemptId, "attemptId"),
 			idToken: requireCanonicalString(body.idToken, "idToken")
 		};
 		case "redeem": return {
@@ -8671,11 +9950,10 @@ async function resolveApplicationTrust(ctx, service, command) {
 		actorUserId: result.principal.apiKeyId,
 		roles: []
 	}, { status: "ACTIVE" }))?.find(matchesEnvironment.bind(null, scope.envId));
-	const configuration = parseExternalAuthConfiguration(environment?.externalAuth ?? {
+	return parseExternalAuthConfiguration(environment?.externalAuth ?? {
 		kind: "disabled",
 		revision: 0
 	});
-	return configuration.kind === "google" ? configuration : null;
 }
 function matchesEnvironment(environmentId, environment) {
 	return environment.id === environmentId;
@@ -8702,43 +9980,118 @@ async function handleExternalAuth(ctx) {
 }
 async function dispatch(ctx, service, trust, command) {
 	const walletId = command.walletId;
-	const originBinding = JSON.stringify([ctx.request.headers.get("origin") || "", command.appOrigin]);
-	if (command.action === "prepare" || command.action === "exchange" || command.action === "backend-exchange" || command.action === "associate") {
+	if (command.action === "prepare" || command.action === "prepare-association" || command.action === "prepare-unlink" || command.action === "exchange" || command.action === "backend-exchange" || command.action === "associate") {
 		const rateKey = await sha256HexUtf8(resolveSourceIpFromFetchHeaders(ctx.request.headers) || "unknown");
 		if (!await service.store.consumeAuthenticationAllowance(rateKey, Date.now())) return failure$5(429, "rate_limited");
 	}
-	if (command.action === "associate" || command.action === "unlink") {
-		const token = command.ownerCredential;
-		const owner = await ctx.service.authorizationSessions.readWalletSessionAuthorizationV2ByOperationCredential({
-			tenantId: ctx.service.authorizationSessions.tenantId,
-			token,
+	if (command.action === "backend-exchange") {
+		if (trust.kind === "disabled") return failure$5(403, "access_denied");
+		return json$3(await service.exchange({
+			walletId,
+			attemptId: command.attemptId,
+			proof: command.proof,
+			trust
+		}));
+	}
+	const originBinding = JSON.stringify([ctx.request.headers.get("origin") || "", command.appOrigin]);
+	if (command.action === "prepare-unlink") return json$3(await service.prepareUnlink({
+		walletId,
+		associationId: command.associationId,
+		originBinding,
+		binding: command.binding,
+		sessionToken: command.sessionToken,
+		trustRevision: trust.revision
+	}));
+	if (command.action === "owner-challenge" || command.action === "associate" || command.action === "unlink") {
+		const binding = {
+			walletId,
+			attemptId: command.attemptId,
+			originBinding,
+			bindingHash: await sha256HexUtf8(command.binding),
+			sessionTokenHash: await sha256HexUtf8(command.sessionToken),
+			codeHash: await sha256HexUtf8(command.code),
+			trustRevision: trust.revision,
 			nowMs: Date.now()
+		};
+		const result = await readExternalOwnerOperation({
+			store: service.store,
+			binding,
+			requestOrigin: ctx.request.headers.get("origin") || "",
+			phase: command.action === "owner-challenge" ? "prepare" : "complete"
 		});
-		if (!owner || owner.authorization.session.walletId !== walletId || !sameDelegatedWalletAuthorityV1(buildDelegatedWalletAuthorityV1({ permissions: owner.authority.permissions }), buildDelegatedWalletAuthorityV1({ permissions: buildFullOwnerPermissionsV1() }))) return failure$5(403, "access_denied");
-		if (command.action === "unlink") {
-			await service.store.revokeAssociation(walletId, command.associationId);
-			return json$3({ ok: true });
+		if (!result.ok) return json$3(result, { status: 403 });
+		const ownerOperation = result.value;
+		if (command.action === "owner-challenge") return json$3({
+			ok: true,
+			value: externalOwnerChallenge(ownerOperation)
+		});
+		if (command.action !== ownerOperation.attempt.purpose) return failure$5(403, "access_denied");
+		if (ownerOperation.attempt.status === "consumed") {
+			const stored = await ctx.service.authorizedOperations.readAuthorizedOperationById({
+				tenantId: ctx.service.authorizedOperations.tenantId,
+				authorizedOperationId: walletOwnerOperationAuthorizationId(ownerOperation.operation, ownerOperation.challengeB64u)
+			});
+			if (!stored || stored.authorization.kind !== "verified_step_up" || stored.quota.kind !== "quota_neutral" || stored.lifecycle !== "completed") return failure$5(503, "unavailable");
+			return new Response(stored.response.bodyText, {
+				status: stored.response.status,
+				headers: {
+					"Content-Type": stored.response.contentType,
+					"Cache-Control": "no-store"
+				}
+			});
 		}
-		const proof = await service.verifyGoogle(trust, command.idToken);
-		if (!proof.ok) return json$3(proof, { status: 403 });
-		return await service.store.associate({
+		const authorized = await authorizeWalletOwnerOperation({
+			ctx,
+			walletId,
+			operation: ownerOperation.operation,
+			payload: ownerOperation.payload,
+			factorProof: command.factorProof
+		});
+		if (!authorized.ok) return authorized.response;
+		if (!await service.store.consumeOwnerAttempt({
+			walletId,
+			attemptId: binding.attemptId,
+			originBinding,
+			bindingHash: binding.bindingHash,
+			sessionTokenHash: binding.sessionTokenHash,
+			codeHash: binding.codeHash,
+			trustRevision: binding.trustRevision,
+			nowMs: Date.now()
+		}, authorized.ownerAuthority)) return completeWalletOwnerOperation(ctx, authorized.operation, 403, externalAuthFailure("access_denied"), "failed_before_side_effect");
+		const attempt = ownerOperation.attempt;
+		if (attempt.purpose === "associate") {
+			if (!await service.store.associate({
+				walletId,
+				identity: attempt.identity,
+				authorityId: authorized.ownerAuthority.authorityId,
+				authorityEpoch: authorized.ownerAuthority.revocationEpoch
+			})) return completeWalletOwnerOperation(ctx, authorized.operation, 403, externalAuthFailure("access_denied"), "failed_before_side_effect");
+		} else await service.store.revokeAssociation({
 			walletId,
-			subject: proof.value.subject,
-			authorityId: owner.authority.authorityId,
-			authorityEpoch: owner.authority.revocationEpoch
-		}) ? json$3({ ok: true }) : failure$5(409, "access_denied");
+			associationId: attempt.associationId,
+			owner: authorized.ownerAuthority
+		});
+		return completeWalletOwnerOperation(ctx, authorized.operation, 200, {
+			ok: true,
+			value: null
+		});
 	}
-	if (command.action === "prepare") return json$3(await service.prepare({
+	if (trust.kind === "disabled") return failure$5(403, "access_denied");
+	if (command.action === "prepare" || command.action === "prepare-association") return json$3(await service.prepare({
+		purpose: command.action === "prepare" ? "authenticate" : "associate",
 		walletId,
 		originBinding,
 		binding: command.binding,
 		sessionToken: command.sessionToken
 	}));
-	if (command.action === "exchange" || command.action === "backend-exchange") return json$3(await service.exchange({
+	if (command.action === "exchange") return json$3(await service.exchange({
 		trust,
 		walletId,
 		attemptId: command.attemptId,
-		idToken: command.idToken
+		proof: {
+			kind: "google",
+			idToken: command.idToken
+		}
 	}));
 	const tokenHash = await sha256HexUtf8(command.sessionToken);
 	if (command.action === "logout") {
@@ -10517,482 +11870,6 @@ async function computeOwnerLaneParticipantBindingDigestV1(input) {
 	return requireParsed$4(parseLaneParticipantBindingDigestB64u(base64UrlEncode(await sha256Bytes(ownerLaneParticipantContinuityCanonicalBytesV1(input)))), "owner participant digest");
 }
 //#endregion
-//#region ../shared-ts/src/authorization/operationFingerprint.ts
-const CAPABILITY_OPERATION_FINGERPRINT_DOMAIN_V1 = "seams:authorization:capability-operation-fingerprint:v1";
-var CapabilityOperationEnvelopeProof = class {
-	tenantId;
-	principalId;
-	capabilityId;
-	operationId;
-	operation;
-	digests;
-	retainProof() {
-		return true;
-	}
-	constructor(fields) {
-		this.retainProof();
-		this.tenantId = fields.tenantId;
-		this.principalId = fields.principalId;
-		this.capabilityId = fields.capabilityId;
-		this.operationId = fields.operationId;
-		this.operation = fields.operation;
-		this.digests = fields.digests;
-	}
-};
-function buildCapabilityOperationEnvelope(fields) {
-	return new CapabilityOperationEnvelopeProof({
-		tenantId: fields.tenantId,
-		principalId: fields.principalId,
-		capabilityId: fields.capabilityId,
-		operationId: fields.operationId,
-		operation: fields.operation,
-		digests: {
-			laneDigest: fields.digests.laneDigest,
-			intentDigest: fields.digests.intentDigest,
-			displayDigest: fields.digests.displayDigest
-		}
-	});
-}
-function canonicalCapabilityOperationFingerprintPreimageV1(envelope) {
-	return `${CAPABILITY_OPERATION_FINGERPRINT_DOMAIN_V1}|${alphabetizeStringify({
-		tenantId: envelope.tenantId,
-		principalId: envelope.principalId,
-		capabilityId: envelope.capabilityId,
-		operationId: envelope.operationId,
-		operation: envelope.operation,
-		digests: envelope.digests
-	})}`;
-}
-async function computeCapabilityOperationFingerprintDigest(envelope) {
-	return parseCapabilityOperationFingerprintDigest(base64UrlEncode(await sha256BytesUtf8(canonicalCapabilityOperationFingerprintPreimageV1(envelope))));
-}
-function parseCapabilityOperationFingerprintDigest(value) {
-	return parseDigestB64u(value);
-}
-function parseSigningOperationFingerprintDigest(value) {
-	if (typeof value !== "string" || !value.startsWith("sha256:")) throw new Error("signing operation fingerprint must use the sha256: prefix");
-	return parseDigestB64u(value.slice(7));
-}
-//#endregion
-//#region ../shared-ts/src/utils/base58.ts
-/**
-* Encodes binary data to base58 string using Bitcoin's base58 alphabet.
-*
-* @param data - Binary data to encode (Uint8Array, ArrayBuffer, or number[])
-* @returns Base58-encoded string
-*/
-const base58Encode = (data) => {
-	if (data instanceof ArrayBuffer) return bs58.encode(new Uint8Array(data));
-	if (Array.isArray(data)) return bs58.encode(new Uint8Array(data));
-	return bs58.encode(data);
-};
-/**
-* Decodes a base58 string to binary data using Bitcoin's base58 alphabet.
-* Returns a Uint8Array containing the decoded bytes.
-*
-* @param base58String - Base58-encoded string to decode
-* @returns Uint8Array containing the decoded bytes
-* @throws Error if input contains invalid base58 characters
-*/
-const base58Decode = (base58String) => {
-	return bs58.decode(base58String);
-};
-//#endregion
-//#region src/authorization/domain.ts
-function buildExactWalletSessionQuotaProjectionV1(fields) {
-	requireNonnegativeInteger(fields.remainingUses, "Wallet Session quota remaining uses");
-	requirePositiveTime(fields.expiresAtMs, "Wallet Session quota expiry");
-	if (fields.lifecycle === "exhausted" !== (fields.remainingUses === 0)) throw new Error("Wallet Session quota lifecycle disagrees with its remaining uses");
-	return {
-		kind: "exact_wallet_session_quota_projection_v1",
-		lifecycle: fields.lifecycle,
-		tenantId: fields.tenantId,
-		principalId: fields.principalId,
-		walletSessionId: fields.walletSessionId,
-		quotaId: fields.quotaId,
-		remainingUses: fields.remainingUses,
-		expiresAtMs: fields.expiresAtMs
-	};
-}
-/**
-* Every capability subject must resolve through the authoritative active
-* authority that the authorization names. A signing or export subject resolves
-* only when its key family is activated and names the same material the
-* authority currently holds; an administration subject resolves only when it
-* names that same authority. Anything else is a capability the caller can no
-* longer exercise, not a corrupt row.
-*/
-function exactWalletSessionCapabilitySubjectsResolveAuthority(input) {
-	return input.session.capabilitySubjects.every((subject) => {
-		switch (subject.kind) {
-			case "sign":
-			case "export_keys": {
-				const activation = subject.keyFamily === "ed25519" ? input.signerActivations.ed25519 : input.signerActivations.ecdsa;
-				return activation !== void 0 && mpcMaterialActivationRefsEqual(activation.materialActivation, subject.materialActivation);
-			}
-			case "link_devices":
-			case "revoke_devices": return subject.authorityId === input.session.authorityId;
-			default: return false;
-		}
-	});
-}
-/**
-* The digest-free authorization projection published to the browser. It carries
-* the exact wallet, authority, method, capability, and lifetime identity a
-* reader needs to reconcile its own record, and never the credential digest.
-*/
-function projectExactWalletSessionAuthorizationV1(session) {
-	const capabilitySubjects = session.capabilitySubjects.map((subject) => {
-		switch (subject.kind) {
-			case "sign":
-			case "export_keys": return {
-				kind: subject.kind,
-				keyFamily: subject.keyFamily,
-				materialActivation: subject.materialActivation
-			};
-			case "link_devices":
-			case "revoke_devices": return { kind: subject.kind };
-			default: throw new Error("Issued linked-device Wallet Session subject is invalid");
-		}
-	});
-	const first = capabilitySubjects[0];
-	if (!first) throw new Error("Issued linked-device Wallet Session has no subjects");
-	return parseActiveWalletSessionV1({
-		kind: "active_wallet_session_v1",
-		walletId: session.walletId,
-		authorityId: session.authorityId,
-		authMethodId: session.walletAuthMethodId,
-		authorizationId: session.authorizationId,
-		quotaId: session.quotaId,
-		authorityDigestB64u: session.authorityDigestB64u,
-		authorityRevocationEpoch: session.authorityRevocationEpoch,
-		capabilitySubjects: [first, ...capabilitySubjects.slice(1)],
-		issuedAtMs: session.createdAtMs,
-		expiresAtMs: session.expiresAtMs
-	});
-}
-function projectActiveWalletSession(issued) {
-	if (issued.quota.quotaId !== issued.session.quotaId) throw new Error("Issued Wallet Session quota does not belong to its authorization");
-	return projectExactWalletSessionAuthorizationV1(issued.session);
-}
-function appendWalletSessionSignerSubjects(subjects, kind, signerActivations) {
-	if (signerActivations.keyFamilies.length === 1 && signerActivations.keyFamilies[0] === "ed25519") {
-		if (!signerActivations.ed25519) throw new Error("Ed25519 signer activation is missing");
-		subjects.push({
-			kind,
-			keyFamily: "ed25519",
-			materialActivation: signerActivations.ed25519.materialActivation
-		});
-		return;
-	}
-	if (signerActivations.keyFamilies.length === 1 && signerActivations.keyFamilies[0] === "ecdsa_secp256k1") {
-		if (!signerActivations.ecdsa) throw new Error("ECDSA signer activation is missing");
-		subjects.push({
-			kind,
-			keyFamily: "ecdsa_secp256k1",
-			materialActivation: signerActivations.ecdsa.materialActivation
-		});
-		return;
-	}
-	if (!signerActivations.ed25519 || !signerActivations.ecdsa) throw new Error("both-family signer activations are incomplete");
-	subjects.push({
-		kind,
-		keyFamily: "ed25519",
-		materialActivation: signerActivations.ed25519.materialActivation
-	}, {
-		kind,
-		keyFamily: "ecdsa_secp256k1",
-		materialActivation: signerActivations.ecdsa.materialActivation
-	});
-}
-function buildWalletSessionCapabilitySubjectsV1(authority) {
-	const subjects = [];
-	if (authority.permissions.includes("sign")) appendWalletSessionSignerSubjects(subjects, "sign", authority.signerActivations);
-	if (authority.permissions.includes("export_keys")) appendWalletSessionSignerSubjects(subjects, "export_keys", authority.signerActivations);
-	if (authority.permissions.includes("link_devices")) subjects.push({
-		kind: "link_devices",
-		authorityId: authority.authorityId
-	});
-	if (authority.permissions.includes("revoke_devices")) subjects.push({
-		kind: "revoke_devices",
-		authorityId: authority.authorityId
-	});
-	const [firstSubject, ...remainingSubjects] = subjects;
-	if (!firstSubject) throw new Error("active wallet authority must produce capability subjects");
-	return [firstSubject, ...remainingSubjects];
-}
-function buildWalletSessionAuthorizationV2(fields) {
-	requireNonnegativeInteger(fields.authorityRevocationEpoch, "Wallet Session authority revocation epoch");
-	parseDigestB64u(fields.authorityDigestB64u);
-	if (fields.capabilitySubjects.length === 0) throw new Error("Wallet Session capability subjects are required");
-	requireOrderedTimes(fields.createdAtMs, fields.expiresAtMs, "Wallet Session authorization");
-	const identityValues = [
-		String(fields.authorizationId),
-		String(fields.walletSessionId),
-		String(fields.quotaId)
-	];
-	if (new Set(identityValues).size !== identityValues.length) throw new Error("Wallet Session authorization identities must be pairwise distinct");
-	return {
-		kind: "wallet_session_authorization_v2",
-		tenantId: fields.tenantId,
-		principalId: fields.principalId,
-		walletId: fields.walletId,
-		authorityId: fields.authorityId,
-		walletAuthMethodId: fields.walletAuthMethodId,
-		authorityDigestB64u: fields.authorityDigestB64u,
-		authorityRevocationEpoch: fields.authorityRevocationEpoch,
-		mintId: fields.mintId,
-		authorizationId: fields.authorizationId,
-		walletSessionId: fields.walletSessionId,
-		quotaId: fields.quotaId,
-		capabilitySubjects: fields.capabilitySubjects,
-		createdAtMs: fields.createdAtMs,
-		expiresAtMs: fields.expiresAtMs
-	};
-}
-function walletSessionCapabilitySubjectsV1Equal(left, right) {
-	if (left.length !== right.length) return false;
-	for (let index = 0; index < left.length; index += 1) {
-		const leftSubject = left[index];
-		const rightSubject = right[index];
-		if (!leftSubject || !rightSubject || leftSubject.kind !== rightSubject.kind) return false;
-		switch (leftSubject.kind) {
-			case "sign":
-			case "export_keys": break;
-			case "link_devices":
-			case "revoke_devices":
-				if (rightSubject.kind !== leftSubject.kind || leftSubject.authorityId !== rightSubject.authorityId) return false;
-				break;
-		}
-		if (leftSubject.kind === "sign" || leftSubject.kind === "export_keys") {
-			if (rightSubject.kind !== leftSubject.kind || leftSubject.keyFamily !== rightSubject.keyFamily || !mpcMaterialActivationRefsEqual(leftSubject.materialActivation, rightSubject.materialActivation)) return false;
-		}
-	}
-	return true;
-}
-function walletSessionAuthorizationV2RecordsEqual(left, right) {
-	return left.kind === right.kind && left.tenantId === right.tenantId && left.principalId === right.principalId && left.walletId === right.walletId && left.authorityId === right.authorityId && left.walletAuthMethodId === right.walletAuthMethodId && left.authorityDigestB64u === right.authorityDigestB64u && left.authorityRevocationEpoch === right.authorityRevocationEpoch && left.mintId === right.mintId && left.authorizationId === right.authorizationId && left.walletSessionId === right.walletSessionId && left.quotaId === right.quotaId && walletSessionCapabilitySubjectsV1Equal(left.capabilitySubjects, right.capabilitySubjects) && left.createdAtMs === right.createdAtMs && left.expiresAtMs === right.expiresAtMs;
-}
-function parseMpcMaterialActivationRefRequired(value) {
-	const parsed = parseMpcMaterialActivationRef(value);
-	if (!parsed.ok) throw new Error(parsed.error.message);
-	return parsed.value;
-}
-function parseWalletAuthorityIdRequired(value) {
-	const parsed = parseWalletAuthorityId(value);
-	if (!parsed.ok) throw new Error(parsed.error.message);
-	return parsed.value;
-}
-function parseWalletAuthMethodIdRequired(value) {
-	const parsed = parseWalletAuthMethodId(value);
-	if (!parsed.ok) throw new Error(parsed.error.message);
-	return parsed.value;
-}
-function parseWalletSessionCapabilitySubject(value) {
-	if (!isWalletSessionCapabilitySubjectRecordV1(value) || typeof value.kind !== "string") throw new Error("Wallet Session capability subject must be an object");
-	switch (value.kind) {
-		case "sign":
-		case "export_keys":
-			if (Object.keys(value).sort().join("|") !== "keyFamily|kind|materialActivation") throw new Error("Wallet Session signer capability subject contains unexpected fields");
-			if (value.keyFamily !== "ed25519" && value.keyFamily !== "ecdsa_secp256k1") throw new Error("Wallet Session signer capability subject key family is invalid");
-			return {
-				kind: value.kind,
-				keyFamily: value.keyFamily,
-				materialActivation: parseMpcMaterialActivationRefRequired(value.materialActivation)
-			};
-		case "link_devices":
-		case "revoke_devices":
-			if (Object.keys(value).sort().join("|") !== "authorityId|kind") throw new Error("Wallet Session administration capability subject contains unexpected fields");
-			return {
-				kind: value.kind,
-				authorityId: parseWalletAuthorityIdRequired(value.authorityId)
-			};
-		default: throw new Error("Wallet Session capability subject kind is unsupported");
-	}
-}
-function isWalletSessionCapabilitySubjectRecordV1(value) {
-	return value !== null && typeof value === "object" && !Array.isArray(value);
-}
-function parseWalletSessionCapabilitySubjects(value) {
-	if (!Array.isArray(value) || value.length === 0) throw new Error("Wallet Session capability subjects must be non-empty");
-	const subjects = [];
-	for (const subject of value) subjects.push(parseWalletSessionCapabilitySubject(subject));
-	const [firstSubject, ...remainingSubjects] = subjects;
-	if (!firstSubject) throw new Error("Wallet Session capability subjects must be non-empty");
-	return [firstSubject, ...remainingSubjects];
-}
-function parseWalletSessionAuthorizationV2(value) {
-	if (!isWalletSessionAuthorizationRecordV2(value)) throw new Error("Wallet Session authorization V2 contains unexpected fields");
-	if (value.kind !== "wallet_session_authorization_v2") throw new Error("Wallet Session authorization V2 kind is invalid");
-	const tenantId = parseTenantIdRequired(value.tenantId);
-	const principalId = parsePrincipalIdRequired(value.principalId);
-	const walletId = parseWalletIdRequired(value.walletId);
-	const authorityId = parseWalletAuthorityIdRequired(value.authorityId);
-	const walletAuthMethodId = parseWalletAuthMethodIdRequired(value.walletAuthMethodId);
-	const authorityDigestB64u = parseDigestB64u(value.authorityDigestB64u);
-	const mintIdResult = parseWalletSessionMintId(value.mintId);
-	if (!mintIdResult.ok) throw new Error(mintIdResult.error.message);
-	const authorizationIdResult = parseWalletSessionAuthorizationId(value.authorizationId);
-	if (!authorizationIdResult.ok) throw new Error(authorizationIdResult.error.message);
-	const walletSessionId = parseWalletSessionIdRequired(value.walletSessionId);
-	const quotaId = parseMpcWalletSigningQuotaIdRequired(value.quotaId);
-	return buildWalletSessionAuthorizationV2({
-		tenantId,
-		principalId,
-		walletId,
-		authorityId,
-		walletAuthMethodId,
-		authorityDigestB64u,
-		authorityRevocationEpoch: requireNonnegativeInteger(value.authorityRevocationEpoch, "Wallet Session authority revocation epoch"),
-		mintId: mintIdResult.value,
-		authorizationId: authorizationIdResult.value,
-		walletSessionId,
-		quotaId,
-		capabilitySubjects: parseWalletSessionCapabilitySubjects(value.capabilitySubjects),
-		createdAtMs: requirePositiveTimestamp(value.createdAtMs, "Wallet Session createdAtMs"),
-		expiresAtMs: requirePositiveTimestamp(value.expiresAtMs, "Wallet Session expiresAtMs")
-	});
-}
-function isWalletSessionAuthorizationRecordV2(value) {
-	if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
-	return Object.keys(value).sort().join("|") === "authorityDigestB64u|authorityId|authorityRevocationEpoch|authorizationId|capabilitySubjects|createdAtMs|expiresAtMs|kind|mintId|principalId|quotaId|tenantId|walletAuthMethodId|walletId|walletSessionId";
-}
-async function buildAuthorizedOperation(input) {
-	if (input.tenantId !== input.operation.tenantId) throw new Error("authorized operation tenant must match its operation envelope");
-	const operationFingerprintDigest = await computeCapabilityOperationFingerprintDigest(input.operation);
-	return {
-		...input,
-		kind: "authorized_operation",
-		operationFingerprintDigest,
-		lifecycle: "claimed"
-	};
-}
-const AUTHORIZED_OPERATION_RESULT_DIGEST_DOMAIN_V1 = "seams:authorization:authorized-operation-result:v1";
-function parseAuthorizedOperationReplayResponse(value) {
-	if (!isAuthorizedOperationReplayResponseRecordV1(value)) throw new Error("authorized operation replay response must be an object");
-	const keys = Object.keys(value).sort();
-	if (keys.length !== 3 || keys.join("|") !== "bodyText|contentType|status") throw new Error("authorized operation replay response must contain only status, contentType, and bodyText");
-	const status = value.status;
-	if (typeof status !== "number" || !Number.isSafeInteger(status) || status < 200 || status > 599) throw new Error("authorized operation replay response status must be an HTTP status");
-	const contentType = value.contentType;
-	if (typeof contentType !== "string" || contentType.length === 0 || contentType.trim() !== contentType || contentType.length > 255 || /[\u0000-\u001f\u007f]/.test(contentType)) throw new Error("authorized operation replay response contentType is invalid");
-	const bodyText = value.bodyText;
-	if (typeof bodyText !== "string") throw new Error("authorized operation replay response bodyText must be text");
-	if (new TextEncoder().encode(bodyText).byteLength > 65536) throw new Error("authorized operation replay response bodyText is too large");
-	if (responseStatusHasNoBody(status) && bodyText.length !== 0) throw new Error("authorized operation replay response status cannot carry a body");
-	return {
-		status,
-		contentType,
-		bodyText
-	};
-}
-function authorizedOperationReplayBodyInit(response) {
-	const parsed = parseAuthorizedOperationReplayResponse(response);
-	return responseStatusHasNoBody(parsed.status) ? null : parsed.bodyText;
-}
-function responseStatusHasNoBody(status) {
-	return status === 204 || status === 205 || status === 304;
-}
-function isAuthorizedOperationReplayResponseRecordV1(value) {
-	if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
-	return Object.keys(value).sort().join("|") === "bodyText|contentType|status";
-}
-async function computeAuthorizedOperationResultDigest(response) {
-	return parseDigestB64u(base64UrlEncode(await sha256BytesUtf8(`${AUTHORIZED_OPERATION_RESULT_DIGEST_DOMAIN_V1}|${alphabetizeStringify(parseAuthorizedOperationReplayResponse(response))}`)));
-}
-function parseHostedWalletSeamsSessionExchangeCode(value) {
-	return parseAuthorizationDomainId(value, "hostedWalletSessionExchangeCode");
-}
-function parseVerifiedOwnerProofId(value) {
-	return parseAuthorizationDomainId(value, "verifiedOwnerProofId");
-}
-function parseHostedWalletSeamsSessionExchangeNonce(value) {
-	return parseAuthorizationDomainId(value, "hostedWalletSessionExchangeNonce");
-}
-function parseHostedWalletSessionCredentialId(value) {
-	return parseAuthorizationDomainId(value, "hostedWalletSessionCredentialId");
-}
-function parsePrimaryWalletSessionOperationCredentialToken(value) {
-	if (typeof value !== "string" || !/^wst_[A-Za-z0-9_-]{43}$/.test(value)) throw new Error("primary Wallet Session credential is invalid");
-	return parseAuthorizationDomainId(value, "primaryWalletSessionOperationCredentialToken");
-}
-function parseHostedWalletSessionOperationCredentialToken(value) {
-	if (typeof value !== "string" || !/^wsh_[A-Za-z0-9_-]{43}$/.test(value)) throw new Error("HostedWalletSessionOperationCredentialV1.token is invalid");
-	return parseAuthorizationDomainId(value, "hostedWalletSessionOperationCredentialToken");
-}
-function parseSessionOrigin(value) {
-	if (typeof value !== "string" || value.trim() !== value) throw new Error("session origin must be a canonical HTTP origin");
-	let url;
-	try {
-		url = new URL(value);
-	} catch {
-		throw new Error("session origin must be a canonical HTTP origin");
-	}
-	if (url.protocol !== "https:" && url.protocol !== "http:" || url.origin !== value || url.pathname !== "/" || url.search || url.hash) throw new Error("session origin must be a canonical HTTP origin");
-	return value;
-}
-function buildActiveWalletSessionQuota(fields) {
-	requirePositiveCount(fields.remainingUses, "Wallet Session quota remaining uses");
-	requirePositiveTime(fields.expiresAtMs, "Wallet Session quota expiry");
-	return {
-		kind: "active_wallet_session_quota",
-		tenantId: fields.tenantId,
-		principalId: fields.principalId,
-		walletSessionId: fields.walletSessionId,
-		quotaId: fields.quotaId,
-		remainingUses: fields.remainingUses,
-		expiresAtMs: fields.expiresAtMs
-	};
-}
-function parseAuthorizationDomainId(value, fieldName) {
-	if (typeof value !== "string" || value.trim() !== value || value.length === 0 || value.length > 512 || /[\s\u0000-\u001f\u007f]/.test(value)) throw new Error(`${fieldName} must be a compact opaque identifier`);
-	return value;
-}
-function parseTenantIdRequired(value) {
-	const parsed = parseTenantId(value);
-	if (!parsed.ok) throw new Error(`linked-device authorization tenantId: ${parsed.error.message}`);
-	return parsed.value;
-}
-function parsePrincipalIdRequired(value) {
-	const parsed = parsePrincipalId(value);
-	if (!parsed.ok) throw new Error(`linked-device authorization principalId: ${parsed.error.message}`);
-	return parsed.value;
-}
-function parseWalletIdRequired(value) {
-	const parsed = parseWalletId(value);
-	if (!parsed.ok) throw new Error(`linked-device authorization walletId: ${parsed.error.message}`);
-	return parsed.value;
-}
-function parseWalletSessionIdRequired(value) {
-	const parsed = parseWalletSessionId(value);
-	if (!parsed.ok) throw new Error(`linked-device authorization walletSessionId: ${parsed.error.message}`);
-	return parsed.value;
-}
-function parseMpcWalletSigningQuotaIdRequired(value) {
-	const parsed = parseMpcWalletSigningQuotaId(value);
-	if (!parsed.ok) throw new Error(`linked-device authorization quotaId: ${parsed.error.message}`);
-	return parsed.value;
-}
-function requirePositiveCount(value, label) {
-	if (!Number.isSafeInteger(value) || value <= 0) throw new Error(`${label} must be a positive safe integer`);
-}
-function requireNonnegativeInteger(value, label) {
-	if (typeof value !== "number" || !Number.isSafeInteger(value) || value < 0) throw new Error(`${label} must be a nonnegative safe integer`);
-	return value;
-}
-function requirePositiveTimestamp(value, label) {
-	if (typeof value !== "number" || !Number.isSafeInteger(value) || value <= 0) throw new Error(`${label} must be a positive safe integer`);
-	return value;
-}
-function requirePositiveTime(value, label) {
-	if (!Number.isSafeInteger(value) || value <= 0) throw new Error(`${label} must be a positive timestamp`);
-}
-function requireOrderedTimes(createdAtMs, expiresAtMs, label) {
-	requirePositiveTime(createdAtMs, `${label} creation`);
-	requirePositiveTime(expiresAtMs, `${label} expiry`);
-	if (expiresAtMs <= createdAtMs) throw new Error(`${label} expiry must follow creation`);
-}
-//#endregion
 //#region src/router/domains/signingOperations/walletExecutionAdmission.ts
 function validateWalletSessionAuthorizationV2Context(input) {
 	if (!isPositiveSafeInteger(input.nowMs)) return "invalid_time";
@@ -11785,32 +12662,6 @@ function parseRegistrationPreparedSessionSeal(raw, service) {
 	};
 }
 //#endregion
-//#region src/router/framework/routeResponses.ts
-function routeJson(status, body, options) {
-	return {
-		status,
-		body,
-		...options?.headers ? { headers: options.headers } : {},
-		...options?.usage ? { usage: options.usage } : {}
-	};
-}
-function routeError(status, code, message) {
-	return routeJson(status, {
-		ok: false,
-		code,
-		message
-	});
-}
-function toFetchRouteResponse(response) {
-	return new Response(JSON.stringify(response.body), {
-		status: response.status,
-		headers: {
-			"Content-Type": "application/json; charset=utf-8",
-			...response.headers || {}
-		}
-	});
-}
-//#endregion
 //#region ../shared-ts/src/utils/registrationIds.ts
 function walletIdFromString(value) {
 	const parsed = parseWalletId(value);
@@ -13246,12 +14097,19 @@ function parseWalletRegistrationSetupRequest(body) {
 		code: "invalid_body",
 		message: "authMethod is required"
 	};
+	const completion = body.completion ?? "wallet_session";
+	if (completion !== "wallet_session" && completion !== "owner_operations") return {
+		ok: false,
+		code: "invalid_body",
+		message: "Invalid registration completion"
+	};
 	const wallet = parseWalletRegistrationSetupWallet(body.wallet);
 	if (!wallet.ok) return wallet;
 	return {
 		ok: true,
 		value: {
 			registrationOperationId,
+			completion,
 			...wallet.value ? { wallet: wallet.value } : {},
 			signerSelection: signerSelection.value.selection,
 			authMethod
@@ -13321,7 +14179,7 @@ function parseInventoryKeyTargets(raw) {
 		value: targets
 	};
 }
-function parseWebAuthnAuthenticationCredential$2(raw) {
+function parseWebAuthnAuthenticationCredential$1(raw) {
 	if (!isPlainObject(raw)) return {
 		ok: false,
 		code: "invalid_body",
@@ -13400,7 +14258,7 @@ async function parseWalletEcdsaInventoryBody(body, walletId) {
 		message: "auth is required"
 	};
 	if (auth.kind === "webauthn_assertion") {
-		const credential = parseWebAuthnAuthenticationCredential$2(auth.credential);
+		const credential = parseWebAuthnAuthenticationCredential$1(auth.credential);
 		if (!credential.ok) return credential;
 		const expectedChallengeDigestB64u = typeof auth.expectedChallengeDigestB64u === "string" ? auth.expectedChallengeDigestB64u.trim() : "";
 		const serverNonceB64u = typeof auth.serverNonceB64u === "string" ? auth.serverNonceB64u.trim() : "";
@@ -13634,7 +14492,7 @@ async function parseWalletAddSignerStartBody(body, walletId) {
 			code: "invalid_body",
 			message: authRpId.error.message
 		};
-		const credential = parseWebAuthnAuthenticationCredential$2(auth.credential);
+		const credential = parseWebAuthnAuthenticationCredential$1(auth.credential);
 		if (!credential.ok) return credential;
 		const expectedChallengeDigestB64u = typeof auth.expectedChallengeDigestB64u === "string" ? auth.expectedChallengeDigestB64u.trim() : "";
 		if (expectedChallengeDigestB64u !== expectedDigest) return {
@@ -13745,7 +14603,7 @@ async function parseWalletAddAuthMethodStartBody(body, walletId) {
 			code: "invalid_body",
 			message: authRpId.error.message
 		};
-		const credential = parseWebAuthnAuthenticationCredential$2(auth.credential);
+		const credential = parseWebAuthnAuthenticationCredential$1(auth.credential);
 		if (!credential.ok) return credential;
 		const expectedChallengeDigestB64u = typeof auth.expectedChallengeDigestB64u === "string" ? auth.expectedChallengeDigestB64u.trim() : "";
 		if (expectedChallengeDigestB64u !== expectedDigest) return {
@@ -14349,7 +15207,7 @@ function parseWalletRevokeAuthMethodSourceProof(raw) {
 			code: "invalid_body",
 			message: rpId.error.message
 		};
-		const credential = parseWebAuthnAuthenticationCredential$2(raw.credential);
+		const credential = parseWebAuthnAuthenticationCredential$1(raw.credential);
 		if (!credential.ok) return credential;
 		const expectedChallengeDigestB64u = typeof raw.expectedChallengeDigestB64u === "string" ? raw.expectedChallengeDigestB64u.trim() : "";
 		if (!expectedChallengeDigestB64u) return {
@@ -14831,6 +15689,7 @@ async function handleRouterApiWalletRegistrationNearProvisioning(input) {
 	if (sessionSeal.value) {
 		if (!isPasskeyWalletRegistrationNearProvisioningSuccessV2(result)) return routeError(400, "invalid_body", "Registration session sealing requires a passkey authority");
 		const sealStartedAt = Date.now();
+		if (result.registrationEstablishedSession.kind === "owner_operations") return routeError(400, "invalid_body", "Owner registration has no session seal");
 		const sealed = await sessionSeal.value.finish(result.registrationEstablishedSession.session);
 		serverTiming.push(["near_finalize_session_seal", Math.max(0, Date.now() - sealStartedAt)]);
 		if (!sealed.ok) return routeJson(503, {
@@ -15230,7 +16089,7 @@ function resolveWalletRegistrationRoute(ctx) {
 async function handleWalletRegistration(ctx) {
 	const route = resolveWalletRegistrationRoute(ctx);
 	if (!route) return null;
-	if (ctx.request.headers.get("X-Seams-Wallet-Protocol") !== "4") return jsonFailure(409, "wallet_protocol_mismatch", "Your wallet application needs an update. Reload this page and try again. If the problem continues, ask the application developer to upgrade the Wallet SDK.");
+	if (ctx.request.headers.get("X-Seams-Wallet-Protocol") !== "5") return jsonFailure(409, "wallet_protocol_mismatch", "Your wallet application needs an update. Reload this page and try again. If the problem continues, ask the application developer to upgrade the Wallet SDK.");
 	const common = {
 		body: await readJson(ctx.request),
 		headers: Object.fromEntries(ctx.request.headers.entries()),
@@ -15597,215 +16456,19 @@ async function handleVoiceIdVerifyRequest(request, deps) {
 		}, { status: 503 });
 	}
 }
+Object.freeze(Array.from("0123456789ABCDEFGHJKMNPQRSTVWXYZ").reduce((acc, char, index) => {
+	acc[char] = index;
+	return acc;
+}, {}));
 //#endregion
-//#region ../shared-ts/src/utils/errors.ts
-/**
-* Best-effort error message extractor without relying on `any`.
-* Always returns a string (may be empty when nothing usable can be derived).
-*/
-function errorMessage$3(err) {
-	try {
-		if (typeof err === "string") return err;
-		if (err && typeof err.message === "string") return err.message;
-		return String(err ?? "");
-	} catch {
-		return "";
-	}
-}
-function b64uField(prefix) {
-	return `${prefix}B64u`;
-}
-b64uField("seed"), b64uField("canonicalSeed"), b64uField("xClientBase"), b64uField("clientOutputMask"), b64uField("clientRecoverableSecret"), b64uField("prfFirst"), b64uField("prfSecond"), b64uField("signingShare32"), b64uField("clientNonceHandle");
-//#endregion
-//#region src/router/auth/webAuthnCredentialCodecs.ts
-function containsWebAuthnExtensionOutput(value) {
-	if (value == null) return false;
-	if (!isPlainObject(value)) return true;
-	for (const nested of Object.values(value)) if (containsWebAuthnExtensionOutput(nested)) return true;
-	return false;
-}
-function unredactedWebAuthnExtensionField(input) {
-	if (!isPlainObject(input)) return null;
-	if (containsWebAuthnExtensionOutput(input.clientExtensionResults)) return "clientExtensionResults";
-	const response = input.response;
-	if (!isPlainObject(response)) return null;
-	if (containsWebAuthnExtensionOutput(response.clientExtensionResults)) return "response.clientExtensionResults";
-	return null;
-}
-function decodeWebAuthnBase64UrlOrBase64(input, fieldName) {
-	try {
-		return base64UrlDecode(input);
-	} catch {
-		try {
-			return base64Decode(input);
-		} catch (error) {
-			throw new Error(`Invalid ${fieldName}: expected base64url/base64 string (${errorMessage$3(error) || "decode failed"})`);
-		}
-	}
-}
-function parseWebAuthnClientDataJsonBase64url(clientDataJSONB64u) {
-	const bytes = decodeWebAuthnBase64UrlOrBase64(clientDataJSONB64u, "webauthn_authentication.response.clientDataJSON");
-	const json = new TextDecoder().decode(bytes);
-	let parsed;
-	try {
-		parsed = JSON.parse(json);
-	} catch {
-		throw new Error("Invalid clientDataJSON: expected object");
-	}
-	if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) throw new Error("Invalid clientDataJSON: expected object");
-	const challenge = normalizeOptionalTrimmedString(Reflect.get(parsed, "challenge"));
-	const origin = normalizeOptionalTrimmedString(Reflect.get(parsed, "origin"));
-	const type = normalizeOptionalTrimmedString(Reflect.get(parsed, "type"));
-	if (!challenge) throw new Error("Invalid clientDataJSON.challenge");
-	if (!origin) throw new Error("Invalid clientDataJSON.origin");
-	if (!type) throw new Error("Invalid clientDataJSON.type");
-	return {
-		challenge,
-		origin,
-		type
-	};
-}
-function webAuthnOriginHostnameOrEmpty(origin) {
-	try {
-		return new URL(origin).hostname.toLowerCase();
-	} catch {
-		return "";
-	}
-}
-function webAuthnCredentialIdB64uFromCredential(input) {
-	if (input === null || typeof input !== "object" || Array.isArray(input)) return failure$6("invalid_body", "Missing webauthn_authentication.id/rawId");
-	const rawId = normalizeOptionalTrimmedString(Reflect.get(input, "rawId"));
-	const id = normalizeOptionalTrimmedString(Reflect.get(input, "id"));
-	const selected = rawId || id;
-	if (!selected) return failure$6("invalid_body", "Missing webauthn_authentication.id/rawId");
+//#region ../shared-ts/src/wallet-recovery/recoveryCodeLocator.ts
+function parseRecoveryCodeLocatorV1(value, label = "recoveryCodeLocator") {
 	try {
-		return {
-			ok: true,
-			credentialIdB64u: base64UrlEncode(decodeWebAuthnBase64UrlOrBase64(selected, "webauthn_authentication.rawId"))
-		};
+		return parseDigestB64u(value);
 	} catch (error) {
-		return failure$6("invalid_body", errorMessage$3(error) || "Invalid credential rawId");
-	}
-}
-function parseWebAuthnAuthenticationCredential$1(input) {
-	if (input === null || typeof input !== "object" || Array.isArray(input)) return null;
-	const responseValue = Reflect.get(input, "response");
-	if (responseValue === null || typeof responseValue !== "object" || Array.isArray(responseValue)) return null;
-	const id = normalizeOptionalTrimmedString(Reflect.get(input, "id"));
-	const rawId = normalizeOptionalTrimmedString(Reflect.get(input, "rawId"));
-	const type = normalizeOptionalTrimmedString(Reflect.get(input, "type"));
-	const clientDataJSON = normalizeOptionalTrimmedString(Reflect.get(responseValue, "clientDataJSON"));
-	const authenticatorData = normalizeOptionalTrimmedString(Reflect.get(responseValue, "authenticatorData"));
-	const signature = normalizeOptionalTrimmedString(Reflect.get(responseValue, "signature"));
-	const rawUserHandle = Reflect.get(responseValue, "userHandle");
-	const userHandle = rawUserHandle === null ? null : normalizeOptionalTrimmedString(rawUserHandle) || null;
-	const rawAuthenticatorAttachment = Reflect.get(input, "authenticatorAttachment");
-	const authenticatorAttachment = rawAuthenticatorAttachment === null ? null : normalizeOptionalTrimmedString(rawAuthenticatorAttachment) || null;
-	if (!id || !rawId || type !== "public-key") return null;
-	if (!clientDataJSON || !authenticatorData || !signature) return null;
-	return {
-		id,
-		rawId,
-		type,
-		authenticatorAttachment,
-		response: {
-			clientDataJSON,
-			authenticatorData,
-			signature,
-			userHandle
-		},
-		clientExtensionResults: Reflect.get(input, "clientExtensionResults") ?? null
-	};
-}
-//#endregion
-//#region src/router/transport/fetch/routes/walletCustodyRequestBoundary.ts
-function requireExactObjectFields(value, fields, label) {
-	const keys = Object.keys(value).sort();
-	const expected = [...fields].sort();
-	if (keys.length !== expected.length || keys.some((key, index) => key !== expected[index])) throw new Error(`${label} contains unsupported fields`);
-}
-function parseCustodyOwnerProof(value) {
-	if (!isPlainObject(value)) throw new Error("factorProof is required");
-	const kind = normalizeOptionalTrimmedString(value.kind);
-	if (kind === "passkey") {
-		requireExactObjectFields(value, [
-			"kind",
-			"walletId",
-			"rpId",
-			"credentialIdB64u",
-			"challenge_digest",
-			"webauthn_authentication"
-		], "factorProof");
-		const extensionField = unredactedWebAuthnExtensionField(value.webauthn_authentication);
-		if (extensionField) throw new Error(`factorProof.webauthn_authentication.${extensionField} must be redacted`);
-		const webauthnAuthentication = parseWebAuthnAuthenticationCredential$1(value.webauthn_authentication);
-		if (!webauthnAuthentication) throw new Error("factorProof.webauthn_authentication is invalid");
-		return {
-			kind,
-			walletId: requireTrimmedString(value.walletId, "factorProof.walletId"),
-			rpId: requireTrimmedString(value.rpId, "factorProof.rpId"),
-			credentialIdB64u: requireTrimmedString(value.credentialIdB64u, "factorProof.credentialIdB64u"),
-			challenge_digest: requireTrimmedString(value.challenge_digest, "factorProof.challenge_digest"),
-			webauthn_authentication: webauthnAuthentication
-		};
-	}
-	if (kind === "email_otp") {
-		requireExactObjectFields(value, [
-			"kind",
-			"provider_subject_id",
-			"challenge_id",
-			"otp_code",
-			"challenge_digest"
-		], "factorProof");
-		return {
-			kind,
-			provider_subject_id: requireTrimmedString(value.provider_subject_id, "factorProof.provider_subject_id"),
-			challenge_id: requireTrimmedString(value.challenge_id, "factorProof.challenge_id"),
-			otp_code: requireTrimmedString(value.otp_code, "factorProof.otp_code"),
-			challenge_digest: requireTrimmedString(value.challenge_digest, "factorProof.challenge_digest")
-		};
-	}
-	throw new Error("factorProof.kind must be passkey or email_otp");
-}
-function parseRecoveryBackupAcknowledgementRequest(body) {
-	if (!isPlainObject(body)) throw new Error("acknowledgement body is required");
-	requireExactObjectFields(body, [
-		"expectedIssuedAtMs",
-		"factorProof",
-		"requestId",
-		"walletId"
-	], "recovery backup acknowledgement");
-	return {
-		walletId: requireTrimmedString(body.walletId, "walletId"),
-		requestId: requireTrimmedString(body.requestId, "requestId"),
-		expectedIssuedAtMs: parseUnixMs$1(body.expectedIssuedAtMs, "expectedIssuedAtMs"),
-		factorProof: body.factorProof
-	};
-}
-function parseRecoveryStatusRequest(body) {
-	if (!isPlainObject(body)) throw new Error("status body is required");
-	requireExactObjectFields(body, ["factorProof", "requestId"], "recovery status");
-	return {
-		requestId: requireTrimmedString(body.requestId, "requestId"),
-		factorProof: body.factorProof
-	};
-}
-//#endregion
-//#region src/core/authService/webauthnOidcHelpers.ts
-function originHostnameOrEmpty(origin) {
-	try {
-		return new URL(origin).hostname.toLowerCase();
-	} catch {
-		return "";
+		throw new Error(`${label} ${error instanceof Error ? error.message : "must be a canonical digest"}`);
 	}
 }
-function isHostWithinRpId(host, rpId) {
-	const h = (host || "").toLowerCase();
-	const r = String(rpId).toLowerCase();
-	if (!h || !r) return false;
-	if ((process.env.NO_CADDY === "1" || process.env.VITE_NO_CADDY === "1") && (h === "localhost" || h === "127.0.0.1") && r.endsWith(".localhost")) return true;
-	return h === r || h.endsWith(`.${r}`);
-}
 //#endregion
 //#region ../shared-ts/src/wallet-recovery/recoveryCodeReservation.ts
 function parseRecoveryCodeReservationId(value) {
@@ -15813,182 +16476,6 @@ function parseRecoveryCodeReservationId(value) {
 	return value;
 }
 //#endregion
-//#region ../shared-ts/src/authorization/walletCustodyOperation.ts
-/** Public challenge digest for a single wallet-administration factor proof. */
-async function computeWalletCustodyAdminChallengeDigest(input) {
-	return sha256Utf8DigestB64u(`seams:wallet-custody:challenge:v1|${alphabetizeStringify({
-		walletId: input.walletId,
-		operation: input.operation,
-		payload: input.payload,
-		requestOrigin: input.requestOrigin
-	})}`);
-}
-//#endregion
-//#region ../shared-ts/src/wallet-recovery/walletRecoveryTarget.ts
-function parseWalletRecoveryTargetV1(raw) {
-	if (raw === null || typeof raw !== "object" || Array.isArray(raw)) throw new Error("wallet recovery target must be an object");
-	const record = raw;
-	const fields = Object.keys(record);
-	switch (record.kind) {
-		case "passkey": {
-			if (fields.length !== 2 || !fields.includes("rpId")) throw new Error("Passkey recovery target fields are invalid");
-			const rpId = parseWebAuthnRpId(record.rpId);
-			if (!rpId.ok) throw new Error("Passkey recovery target RP ID is invalid");
-			return {
-				kind: "passkey",
-				rpId: rpId.value
-			};
-		}
-		case "google_email_otp":
-			if (fields.length !== 2 || !fields.includes("googleProvider") || record.googleProvider !== "google") throw new Error("Google Email OTP recovery target fields are invalid");
-			return {
-				kind: "google_email_otp",
-				googleProvider: "google"
-			};
-		default: throw new Error("wallet recovery target kind is unsupported");
-	}
-}
-//#endregion
-//#region src/router/domains/emailOtp/emailOtpSessionRouteHelpers.ts
-function emailOtpStatusCode(code) {
-	if (code === "internal") return 500;
-	if (code === "not_configured") return 503;
-	if (code === "not_found") return 404;
-	if (code === "rate_limited") return 429;
-	if (code === "stronger_auth_required") return 403;
-	if (code === "reenrollment_required" || code === "registration_attempt_missing" || code === "registration_attempt_expired") return 409;
-	if (code === "challenge_id_mismatch" || code === "challenge_purpose_mismatch" || code === "challenge_subject_mismatch" || code === "challenge_email_mismatch" || code === "challenge_wallet_mismatch" || code === "challenge_session_mismatch" || code === "challenge_org_mismatch" || code === "challenge_channel_mismatch" || code === "registration_reroll_disallowed" || code === "challenge_expired_or_invalid" || code === "invalid_otp") return 401;
-	return 400;
-}
-function emailOtpFailureAuditPayload(input) {
-	return {
-		source: input.source,
-		code: input.code,
-		message: input.message,
-		...input.challengeId ? { challengeId: input.challengeId } : {},
-		...input.otpChannel ? { otpChannel: input.otpChannel } : {},
-		...input.operation ? { operation: input.operation } : {},
-		...typeof input.lockedUntilMs === "number" ? { lockedUntilMs: input.lockedUntilMs } : {}
-	};
-}
-function shouldEmitEmailOtpLockedWebhook(code) {
-	return code === "otp_locked_out" || code === "otp_attempts_exhausted";
-}
-function emailOtpFailureWebhookEventDescriptors(input) {
-	const payload = emailOtpFailureAuditPayload(input);
-	const event = {
-		eventType: "wallet.email_otp.failed",
-		...input.challengeId ? { eventId: input.challengeId } : {},
-		payload
-	};
-	if (!shouldEmitEmailOtpLockedWebhook(input.code)) return [event];
-	return [event, {
-		eventType: "wallet.email_otp.locked",
-		...input.challengeId ? { eventId: input.challengeId } : {},
-		payload
-	}];
-}
-function emailOtpLoggedInWebhookEventDescriptor(input) {
-	return {
-		eventType: "wallet.email_otp.logged_in",
-		eventId: input.challengeId,
-		payload: {
-			otpChannel: input.otpChannel,
-			unlockBackend: input.unlockBackend,
-			challengeId: input.challengeId
-		}
-	};
-}
-async function hashEmailOtpOperationBinding(input) {
-	return base64UrlEncode(await sha256BytesUtf8(alphabetizeStringify({
-		walletId: input.walletId,
-		providerUserId: input.providerUserId,
-		orgId: input.orgId,
-		operation: input.operation,
-		requestOrigin: input.requestOrigin || "",
-		audience: input.audience || "",
-		...input.authorityRef !== void 0 ? { authorityRef: input.authorityRef } : {},
-		...input.operationFingerprintDigest ? { operationFingerprintDigest: input.operationFingerprintDigest } : {}
-	})));
-}
-//#endregion
-//#region src/authorization/factorEvidence.ts
-function buildVerifiedWalletOperationPasskeyFactorResult(fields) {
-	requireVerificationWindow(fields.verifiedAtMs, fields.expiresAtMs);
-	return {
-		kind: "verified_wallet_operation_passkey_factor",
-		...fields
-	};
-}
-function buildVerifiedWalletOperationEmailOtpFactorResult(fields) {
-	requireVerificationWindow(fields.verifiedAtMs, fields.expiresAtMs);
-	return {
-		kind: "verified_wallet_operation_email_otp_factor",
-		...fields
-	};
-}
-function buildVerifiedWalletSessionPasskeyFactorResult(fields) {
-	requireVerificationWindow(fields.verifiedAtMs, fields.expiresAtMs);
-	return {
-		kind: "verified_wallet_session_passkey_factor",
-		tenantId: fields.tenantId,
-		principalId: fields.principalId,
-		walletId: fields.walletId,
-		authorityRef: fields.authorityRef,
-		requestOrigin: fields.requestOrigin,
-		audience: fields.audience,
-		factorId: fields.factorId,
-		credentialIdB64u: fields.credentialIdB64u,
-		assertionDigest: fields.assertionDigest,
-		verifiedAtMs: fields.verifiedAtMs,
-		expiresAtMs: fields.expiresAtMs
-	};
-}
-function buildVerifiedWalletSessionEmailOtpFactorResult(fields) {
-	requireVerificationWindow(fields.verifiedAtMs, fields.expiresAtMs);
-	return {
-		kind: "verified_wallet_session_email_otp_factor",
-		tenantId: fields.tenantId,
-		principalId: fields.principalId,
-		walletId: fields.walletId,
-		authorityRef: fields.authorityRef,
-		requestOrigin: fields.requestOrigin,
-		audience: fields.audience,
-		factorId: fields.factorId,
-		challengeId: fields.challengeId,
-		verificationReceiptDigest: fields.verificationReceiptDigest,
-		verifiedAtMs: fields.verifiedAtMs,
-		expiresAtMs: fields.expiresAtMs
-	};
-}
-function requireVerificationWindow(verifiedAtMs, expiresAtMs) {
-	if (!Number.isSafeInteger(verifiedAtMs) || !Number.isSafeInteger(expiresAtMs) || verifiedAtMs <= 0 || expiresAtMs <= verifiedAtMs) throw new Error("verified factor expiry must follow verification");
-}
-//#endregion
-//#region ../shared-ts/src/utils/emailOtpDomain.ts
-const EMAIL_OTP_CHANNEL = "email_otp";
-/** Domain label that opens the AAD binding a released Email OTP factor to its challenge. */
-const EMAIL_OTP_FACTOR_RELEASE_AAD_DOMAIN_V1 = "seams/email-otp/factor-release/v1";
-const WALLET_UNLOCK_BACKENDS = ["passkey", EMAIL_OTP_CHANNEL];
-const WALLET_EMAIL_OTP_LOGIN_OPERATIONS = [
-	"wallet_unlock",
-	"transaction_sign",
-	"export_key"
-];
-const WALLET_EMAIL_OTP_EXPORT_OPERATION = "export_key";
-const WALLET_EMAIL_OTP_UNLOCK_OPERATION = "wallet_unlock";
-const WALLET_EMAIL_OTP_TRANSACTION_SIGN_OPERATION = "transaction_sign";
-function isWalletUnlockBackend(value) {
-	return WALLET_UNLOCK_BACKENDS.includes(value);
-}
-function isWalletEmailOtpLoginOperation(value) {
-	return WALLET_EMAIL_OTP_LOGIN_OPERATIONS.includes(value);
-}
-Object.freeze(Array.from("0123456789ABCDEFGHJKMNPQRSTVWXYZ").reduce((acc, char, index) => {
-	acc[char] = index;
-	return acc;
-}, {}));
-//#endregion
 //#region ../shared-ts/src/wallet-recovery/recoveryKeyId.ts
 /** The prefix plus unpadded base64url over one SHA-256 digest. */
 const DERIVED_WALLET_RECOVERY_KEY_ID_PATTERN = /^wallet-rkid-v1-[A-Za-z0-9_-]{43}$/;
@@ -15997,6 +16484,40 @@ function parseDerivedWalletRecoveryKeyId(value, label = "recoveryKeyId") {
 	return value;
 }
 //#endregion
+//#region ../shared-ts/src/wallet-recovery/walletRecoveryEcdsaPossession.ts
+const POSSESSION_PROOF_SCHEME_V1 = "secp256k1_bip340_sha256_v1";
+function requireExactKeys$3(record, label, keys) {
+	const allowed = new Set(keys);
+	for (const key of Object.keys(record)) if (!allowed.has(key)) throw new Error(`${label}.${key} is not a supported field`);
+	for (const key of keys) if (!Object.hasOwn(record, key)) throw new Error(`${label}.${key} is required`);
+}
+function requireSignature64(value, label) {
+	if (typeof value !== "string" || !/^[A-Za-z0-9_-]+$/.test(value)) throw new Error(`${label} must be canonical base64url`);
+	let bytes;
+	try {
+		bytes = base64UrlDecode(value);
+	} catch {
+		throw new Error(`${label} must be valid base64url`);
+	}
+	if (bytes.length !== 64 || base64UrlEncode(bytes) !== value) throw new Error(`${label} must be canonical base64url for 64 bytes`);
+	return value;
+}
+function parseWalletRecoveryEcdsaPossessionProofV1(value) {
+	const record = requireRecord$1(value, "walletRecoveryEcdsaPossessionProof");
+	requireExactKeys$3(record, "walletRecoveryEcdsaPossessionProof", [
+		"kind",
+		"scheme",
+		"signature64B64u"
+	]);
+	if (record.kind !== "wallet_recovery_ecdsa_possession_proof_v1") throw new Error("walletRecoveryEcdsaPossessionProof.kind is invalid");
+	if (record.scheme !== POSSESSION_PROOF_SCHEME_V1) throw new Error("walletRecoveryEcdsaPossessionProof.scheme is invalid");
+	return {
+		kind: "wallet_recovery_ecdsa_possession_proof_v1",
+		scheme: POSSESSION_PROOF_SCHEME_V1,
+		signature64B64u: requireSignature64(record.signature64B64u, "walletRecoveryEcdsaPossessionProof.signature64B64u")
+	};
+}
+//#endregion
 //#region ../shared-ts/src/wallet-recovery/walletRecoveryEnvelopeSet.ts
 function buildWalletCustodySeedRecoveryEntry(args) {
 	return {
@@ -16071,47 +16592,45 @@ function parseWalletRecoveryEnvelopeEntry(raw, label) {
 	});
 }
 //#endregion
-//#region ../shared-ts/src/wallet-recovery/recoveryCodeLocator.ts
-function parseRecoveryCodeLocatorV1(value, label = "recoveryCodeLocator") {
-	try {
-		return parseDigestB64u(value);
-	} catch (error) {
-		throw new Error(`${label} ${error instanceof Error ? error.message : "must be a canonical digest"}`);
+//#region ../shared-ts/src/wallet-recovery/walletRecoveryTarget.ts
+function parseWalletRecoveryTargetV1(raw) {
+	if (raw === null || typeof raw !== "object" || Array.isArray(raw)) throw new Error("wallet recovery target must be an object");
+	const record = raw;
+	const fields = Object.keys(record);
+	switch (record.kind) {
+		case "passkey": {
+			if (fields.length !== 2 || !fields.includes("rpId")) throw new Error("Passkey recovery target fields are invalid");
+			const rpId = parseWebAuthnRpId(record.rpId);
+			if (!rpId.ok) throw new Error("Passkey recovery target RP ID is invalid");
+			return {
+				kind: "passkey",
+				rpId: rpId.value
+			};
+		}
+		case "google_email_otp":
+			if (fields.length !== 2 || !fields.includes("googleProvider") || record.googleProvider !== "google") throw new Error("Google Email OTP recovery target fields are invalid");
+			return {
+				kind: "google_email_otp",
+				googleProvider: "google"
+			};
+		default: throw new Error("wallet recovery target kind is unsupported");
 	}
 }
 //#endregion
-//#region ../shared-ts/src/wallet-recovery/walletRecoveryEcdsaPossession.ts
-const POSSESSION_PROOF_SCHEME_V1 = "secp256k1_bip340_sha256_v1";
-function requireExactKeys$3(record, label, keys) {
-	const allowed = new Set(keys);
-	for (const key of Object.keys(record)) if (!allowed.has(key)) throw new Error(`${label}.${key} is not a supported field`);
-	for (const key of keys) if (!Object.hasOwn(record, key)) throw new Error(`${label}.${key} is required`);
-}
-function requireSignature64(value, label) {
-	if (typeof value !== "string" || !/^[A-Za-z0-9_-]+$/.test(value)) throw new Error(`${label} must be canonical base64url`);
-	let bytes;
+//#region src/core/authService/webauthnOidcHelpers.ts
+function originHostnameOrEmpty(origin) {
 	try {
-		bytes = base64UrlDecode(value);
+		return new URL(origin).hostname.toLowerCase();
 	} catch {
-		throw new Error(`${label} must be valid base64url`);
+		return "";
 	}
-	if (bytes.length !== 64 || base64UrlEncode(bytes) !== value) throw new Error(`${label} must be canonical base64url for 64 bytes`);
-	return value;
 }
-function parseWalletRecoveryEcdsaPossessionProofV1(value) {
-	const record = requireRecord$1(value, "walletRecoveryEcdsaPossessionProof");
-	requireExactKeys$3(record, "walletRecoveryEcdsaPossessionProof", [
-		"kind",
-		"scheme",
-		"signature64B64u"
-	]);
-	if (record.kind !== "wallet_recovery_ecdsa_possession_proof_v1") throw new Error("walletRecoveryEcdsaPossessionProof.kind is invalid");
-	if (record.scheme !== POSSESSION_PROOF_SCHEME_V1) throw new Error("walletRecoveryEcdsaPossessionProof.scheme is invalid");
-	return {
-		kind: "wallet_recovery_ecdsa_possession_proof_v1",
-		scheme: POSSESSION_PROOF_SCHEME_V1,
-		signature64B64u: requireSignature64(record.signature64B64u, "walletRecoveryEcdsaPossessionProof.signature64B64u")
-	};
+function isHostWithinRpId(host, rpId) {
+	const h = (host || "").toLowerCase();
+	const r = String(rpId).toLowerCase();
+	if (!h || !r) return false;
+	if ((process.env.NO_CADDY === "1" || process.env.VITE_NO_CADDY === "1") && (h === "localhost" || h === "127.0.0.1") && r.endsWith(".localhost")) return true;
+	return h === r || h.endsWith(`.${r}`);
 }
 //#endregion
 //#region src/router/transport/fetch/routes/passkeyCustody.ts
@@ -16139,239 +16658,6 @@ const RECOVERY_READ_ROUTE_ID = "wallet_recovery_codes_read";
 const RECOVERY_STATUS_ROUTE_ID = "wallet_recovery_status";
 const EMAIL_OTP_CHALLENGE_ROUTE_ID = "wallet_custody_email_otp_challenge";
 const ENVELOPE_OWNERSHIP_UPGRADE_ROUTE_ID = "wallet_custody_envelope_ownership_upgrade";
-const CUSTODY_OPERATION_CAPABILITY_ID = "wallet-custody-admin";
-const CUSTODY_PROOF_TTL_MS = 6e4;
-function hasFullOwnerAuthority$1(authority) {
-	return sameDelegatedWalletAuthorityV1(buildDelegatedWalletAuthorityV1({ permissions: authority.permissions }), buildDelegatedWalletAuthorityV1({ permissions: buildFullOwnerPermissionsV1() }));
-}
-function parseRequiredAuthorizationValue(parsed) {
-	if (!parsed.ok) throw new Error(parsed.error.message);
-	return parsed.value;
-}
-async function custodyDigest(domain, value) {
-	return sha256Utf8DigestB64u(`${domain}|${alphabetizeStringify(value)}`);
-}
-async function buildWalletCustodyOperation(input) {
-	const tenantId = parseRequiredAuthorizationValue(parseTenantId(input.tenantId));
-	const principalId = parseRequiredAuthorizationValue(parsePrincipalId(input.principalId));
-	const capabilityId = parseRequiredAuthorizationValue(parseCapabilityId(CUSTODY_OPERATION_CAPABILITY_ID));
-	const operationRef = buildVaultOperationRef("vault.reveal");
-	const laneDigest = await custodyDigest("seams:wallet-custody:lane:v1", {
-		capabilityId,
-		operation: input.operation,
-		operationRef
-	});
-	const challengeDigest = await computeWalletCustodyAdminChallengeDigest({
-		walletId: input.walletId,
-		operation: input.operation,
-		payload: input.payload,
-		requestOrigin: input.requestOrigin
-	});
-	const intentDigest = challengeDigest;
-	const displayDigest = await custodyDigest("seams:wallet-custody:display:v1", {
-		walletId: input.walletId,
-		operation: input.operation
-	});
-	return {
-		operation: buildCapabilityOperationEnvelope({
-			tenantId,
-			principalId,
-			capabilityId,
-			operationId: parseRequiredAuthorizationValue(parseCapabilityOperationId(`wallet-custody:${input.operation}:${intentDigest}`)),
-			operation: operationRef,
-			digests: {
-				laneDigest,
-				intentDigest,
-				displayDigest
-			}
-		}),
-		challengeDigest
-	};
-}
-async function authorizeWalletCustodyOperation(input) {
-	const requestOrigin = normalizeOptionalTrimmedString(input.ctx.request.headers.get("origin"));
-	if (!requestOrigin) return toCustodyAuthorizationFailure(400, "invalid_origin", "request Origin is required");
-	let origin;
-	let proof;
-	let walletId;
-	try {
-		origin = parseSessionOrigin(requestOrigin);
-		walletId = parseRequiredAuthorizationValue(parseWalletId(input.walletId));
-		proof = parseCustodyOwnerProof(input.factorProof);
-	} catch (error) {
-		return toCustodyAuthorizationFailure(400, "invalid_owner_proof", error instanceof Error ? error.message : "owner proof is invalid");
-	}
-	if (proof.kind === "passkey" && proof.walletId !== input.walletId) return toCustodyAuthorizationFailure(403, "scope_mismatch", "owner proof wallet differs");
-	let principalId;
-	let factor;
-	let operation;
-	let challengeDigest;
-	try {
-		principalId = proof.kind === "passkey" ? input.walletId : proof.provider_subject_id;
-		const built = await buildWalletCustodyOperation({
-			tenantId: input.ctx.service.authorizedOperations.tenantId,
-			principalId,
-			walletId: input.walletId,
-			operation: input.operation,
-			payload: input.payload,
-			requestOrigin
-		});
-		operation = built.operation;
-		challengeDigest = built.challengeDigest;
-	} catch (error) {
-		return toCustodyAuthorizationFailure(400, "invalid_owner_proof", error instanceof Error ? error.message : "owner proof binding is invalid");
-	}
-	const operationFingerprintDigest = await computeCapabilityOperationFingerprintDigest(operation);
-	const nowMs = Date.now();
-	if (proof.challenge_digest !== String(challengeDigest)) return toCustodyAuthorizationFailure(403, "scope_mismatch", "factor proof challenge does not match the requested operation");
-	if (proof.kind === "passkey") {
-		let authority;
-		try {
-			authority = buildPasskeyWalletAuthAuthority({
-				walletId,
-				rpId: proof.rpId,
-				credentialIdB64u: proof.credentialIdB64u
-			});
-		} catch (error) {
-			return toCustodyAuthorizationFailure(400, "invalid_owner_proof", error instanceof Error ? error.message : "passkey authority is invalid");
-		}
-		const active = await input.ctx.service.walletAuthMethods.resolveActivePasskeyAuthorityForVerifiedCredential({
-			walletId,
-			rpId: authority.verifier.rpId,
-			credentialIdB64u: authority.factor.credentialIdB64u
-		});
-		if (!active.ok) return toCustodyAuthorizationFailure(403, active.code, active.message);
-		if (!hasFullOwnerAuthority$1(active.walletAuthority)) return toCustodyAuthorizationFailure(403, "forbidden", "Full owner authority is required");
-		const credential = parseWebAuthnAuthenticationCredential$1(proof.webauthn_authentication);
-		if (!credential) return toCustodyAuthorizationFailure(400, "invalid_owner_proof", "passkey assertion is invalid");
-		if (String(credential.rawId || credential.id).trim() !== authority.factor.credentialIdB64u) return toCustodyAuthorizationFailure(401, "unauthorized", "passkey credential changed");
-		const verified = await input.ctx.service.webAuthn.verifyWebAuthnAuthenticationLite({
-			userId: input.walletId,
-			rpId: authority.verifier.rpId,
-			expectedChallenge: challengeDigest,
-			expected_origin: requestOrigin,
-			webauthn_authentication: credential
-		});
-		if (!verified.success || !verified.verified) return toCustodyAuthorizationFailure(401, verified.code || "not_verified", verified.message || "WebAuthn authentication verification failed");
-		factor = buildVerifiedWalletOperationPasskeyFactorResult({
-			tenantId: operation.tenantId,
-			principalId: operation.principalId,
-			walletId,
-			authorityRef: await walletAuthAuthorityRef({ authority: active.authority }),
-			requestOrigin: origin,
-			audience: origin,
-			factorId: parseRequiredAuthorizationValue(parseAuthFactorId(`passkey:${authority.factor.credentialIdB64u}`)),
-			credentialIdB64u: parseRequiredAuthorizationValue(parseWebAuthnCredentialIdB64u(authority.factor.credentialIdB64u)),
-			assertionDigest: await custodyDigest("seams:wallet-custody:assertion:v1", { credential }),
-			operation,
-			verifiedAtMs: nowMs,
-			expiresAtMs: nowMs + CUSTODY_PROOF_TTL_MS
-		});
-	} else {
-		const providerSubject = parseRequiredAuthorizationValue(parseProviderSubject(proof.provider_subject_id));
-		const orgId = parseRequiredAuthorizationValue(parseOrgId(input.ctx.service.authorizedOperations.tenantId));
-		const active = await input.ctx.service.walletAuthMethods.resolveActiveEmailOtpAuthorityForVerifiedSubject({
-			walletId: input.walletId,
-			providerUserId: proof.provider_subject_id
-		});
-		if (!active.ok) return toCustodyAuthorizationFailure(403, active.code, active.message);
-		const activeAuthorityRef = await walletAuthAuthorityRef({ authority: active.authority });
-		const ownerProofBindingDigest = await hashEmailOtpOperationBinding({
-			walletId: input.walletId,
-			providerUserId: proof.provider_subject_id,
-			orgId,
-			operation: `wallet_custody:${input.operation}`,
-			requestOrigin,
-			audience: requestOrigin,
-			authorityRef: activeAuthorityRef,
-			operationFingerprintDigest: challengeDigest
-		});
-		const verified = await input.ctx.service.emailOtp.verifyEmailOtpChallenge({
-			userId: proof.provider_subject_id,
-			walletId: input.walletId,
-			orgId,
-			challengeId: proof.challenge_id,
-			otpCode: proof.otp_code,
-			otpChannel: EMAIL_OTP_CHANNEL,
-			ownerProofBindingDigest,
-			operation: WALLET_EMAIL_OTP_UNLOCK_OPERATION
-		});
-		if (!verified.ok) return toCustodyAuthorizationFailure(verified.code === "invalid_body" ? 400 : 401, verified.code, verified.message);
-		const consumed = await input.ctx.service.emailOtp.consumeEmailOtpGrant({
-			subject: {
-				kind: "provider_identity",
-				orgId,
-				providerSubject,
-				walletId
-			},
-			loginGrant: verified.loginGrant,
-			otpChannel: EMAIL_OTP_CHANNEL
-		});
-		if (!consumed.ok) return toCustodyAuthorizationFailure(emailOtpStatusCode(consumed.code), consumed.code, consumed.message);
-		factor = buildVerifiedWalletOperationEmailOtpFactorResult({
-			tenantId: operation.tenantId,
-			principalId: operation.principalId,
-			walletId,
-			authorityRef: activeAuthorityRef,
-			requestOrigin: origin,
-			audience: origin,
-			factorId: parseRequiredAuthorizationValue(parseAuthFactorId(`email_otp:${active.authority.factor.provider}:${proof.provider_subject_id}`)),
-			operation,
-			challengeId: parseRequiredAuthorizationValue(parseEmailOtpChallengeId(consumed.challengeId)),
-			verificationReceiptDigest: await custodyDigest("seams:wallet-custody:otp-receipt:v1", {
-				challengeId: consumed.challengeId,
-				operationFingerprintDigest
-			}),
-			verifiedAtMs: nowMs,
-			expiresAtMs: Math.min(nowMs + CUSTODY_PROOF_TTL_MS, verified.grantExpiresAtMs)
-		});
-	}
-	const ownerProof = await input.ctx.service.authorizedOperations.buildVerifiedOwnerProof({
-		purpose: "operation",
-		proofId: parseVerifiedOwnerProofId(`wallet-custody:${operation.operationId}`),
-		factor
-	});
-	if (ownerProof.purpose !== "operation" || ownerProof.operation.operationFingerprintDigest !== operationFingerprintDigest) return toCustodyAuthorizationFailure(403, "owner_proof_rejected", "owner proof binding is invalid");
-	const evidenceSet = await input.ctx.service.authorizedOperations.recordVerifiedWalletOperationFactorEvidenceSet({
-		operation,
-		evidenceId: parseRequiredAuthorizationValue(parseAuthorizationEvidenceId(`wallet-custody:evidence:${operation.operationId}`)),
-		evidenceSetId: parseRequiredAuthorizationValue(parseAuthorizationEvidenceSetId(`wallet-custody:evidence-set:${operation.operationId}`)),
-		factor
-	});
-	const admission = await input.ctx.service.authorizedOperations.admitAuthorizedOperation({ operation: {
-		tenantId: operation.tenantId,
-		authorizedOperationId: parseRequiredAuthorizationValue(parseAuthorizedOperationId(`wallet-custody:authorized:${operation.operationId}`)),
-		auditEventId: parseRequiredAuthorizationValue(parseAuthorizationAuditEventId(`wallet-custody:audit:${operation.operationId}`)),
-		operation,
-		authorization: {
-			kind: "verified_step_up",
-			evidenceSetDigest: evidenceSet.evidenceSetDigest
-		},
-		quota: { kind: "quota_neutral" },
-		claimedAtMs: nowMs
-	} });
-	switch (admission.kind) {
-		case "claimed": return {
-			ok: true,
-			operation: admission.operation
-		};
-		case "replayed":
-		case "operation_in_progress": return {
-			ok: false,
-			response: authorizedOperationReplay(admission.operation)
-		};
-		case "authorization_grant_rejected":
-		case "verified_step_up_rejected":
-		case "wallet_session_quota_exhausted":
-		case "material_mismatch": return toCustodyAuthorizationFailure(403, "owner_proof_rejected", "owner proof was rejected");
-	}
-}
-function toCustodyAuthorizationFailure(status, code, message) {
-	return {
-		ok: false,
-		response: routeErrorResponse(status, code, message)
-	};
-}
 function routeErrorResponse(status, code, message) {
 	return toFetchRouteResponse({
 		status,
@@ -16387,23 +16673,6 @@ function matchRoute(ctx, routeId) {
 	if (!route) throw new Error(`Missing route definition for ${routeId}`);
 	return matchesRouteDefinitionRequest(route, ctx.method, ctx.pathname) ? route : null;
 }
-async function completeWalletCustodyOperation(ctx, operation, status, body, result = "succeeded") {
-	const bodyText = JSON.stringify(body);
-	await ctx.service.authorizedOperations.completeAuthorizedOperation({
-		operation,
-		result,
-		response: {
-			status,
-			contentType: "application/json",
-			bodyText
-		},
-		completedAtMs: Date.now()
-	});
-	return toFetchRouteResponse({
-		status,
-		body
-	});
-}
 async function handlePasskeyCustody(ctx) {
 	if (!matchRoute(ctx, ROUTE_ID)) return null;
 	const body = await readJsonObject(ctx.request);
@@ -16431,8 +16700,8 @@ function parseWalletCustodyEmailOtpChallengeRequest(value, actualOrigin) {
 	];
 	const withoutOptional = keys.filter((key) => key !== "requestOrigin");
 	if (withoutOptional.length !== required.length || withoutOptional.some((key, index) => key !== required.slice().sort()[index]) || keys.includes("requestOrigin") && keys.length !== expected.length) throw new Error("Email OTP custody challenge body contains unsupported fields");
-	const walletId = parseRequiredAuthorizationValue(parseWalletId(value.walletId));
-	const providerSubjectId = parseRequiredAuthorizationValue(parseProviderSubject(value.providerSubjectId));
+	const walletId = requireParsed$4(parseWalletId(value.walletId), "authorization");
+	const providerSubjectId = requireParsed$4(parseProviderSubject(value.providerSubjectId), "authorization");
 	const operation = value.operation;
 	if (operation !== "credentials_list" && operation !== "credential_label" && operation !== "recovery_rotate" && operation !== "recovery_read" && operation !== "recovery_status" && operation !== "recovery_backup_acknowledge") throw new Error("Email OTP custody challenge operation is invalid");
 	if (!isPlainObject(value.payload)) throw new Error("Email OTP custody challenge payload is invalid");
@@ -16461,8 +16730,8 @@ async function handleWalletCustodyEmailOtpChallenge(ctx) {
 		providerUserId: request.providerSubjectId
 	});
 	if (!active.ok) return routeErrorResponse(403, active.code, active.message);
-	const authoritativeOrgId = parseRequiredAuthorizationValue(parseOrgId(ctx.service.authorizedOperations.tenantId));
-	const challengeDigest = await computeWalletCustodyAdminChallengeDigest(request);
+	const authoritativeOrgId = requireParsed$4(parseOrgId(ctx.service.authorizedOperations.tenantId), "authorization");
+	const challengeDigest = await computeWalletOwnerAdminChallengeDigest(request);
 	const ownerProofBindingDigest = await hashEmailOtpOperationBinding({
 		walletId: request.walletId,
 		providerUserId: request.providerSubjectId,
@@ -16510,7 +16779,7 @@ async function handleWalletCustodyCredentialsList(ctx) {
 	const walletId = walletIdFromPath(route.path, ctx.pathname);
 	if (!walletId) return routeErrorResponse(400, "invalid_request", "credential list needs a wallet");
 	const body = await readJsonObject(ctx.request);
-	const authorized = await authorizeWalletCustodyOperation({
+	const authorized = await authorizeWalletOwnerOperation({
 		ctx,
 		walletId,
 		operation: "credentials_list",
@@ -16521,7 +16790,7 @@ async function handleWalletCustodyCredentialsList(ctx) {
 	const parsedWalletId = parseWalletId(walletId);
 	if (!parsedWalletId.ok) return routeErrorResponse(400, "invalid_request", "wallet id is invalid");
 	const result = await ctx.service.passkeyCustody.listWalletCredentials({ walletId: parsedWalletId.value });
-	return await completeWalletCustodyOperation(ctx, authorized.operation, 200, {
+	return await completeWalletOwnerOperation(ctx, authorized.operation, 200, {
 		ok: true,
 		credentials: result
 	});
@@ -16589,7 +16858,7 @@ async function handleWalletCustodyCredentialLabel(ctx) {
 	const envelopeId = normalizeOptionalTrimmedString(body?.envelopeId);
 	const label = body?.label;
 	if (!walletId || !envelopeId || label !== void 0 && typeof label !== "string") return routeErrorResponse(400, "invalid_request", "credential rename needs a wallet, envelope, and optional label");
-	const authorized = await authorizeWalletCustodyOperation({
+	const authorized = await authorizeWalletOwnerOperation({
 		ctx,
 		walletId,
 		operation: "credential_label",
@@ -16609,26 +16878,26 @@ async function handleWalletCustodyCredentialLabel(ctx) {
 		...label === void 0 ? {} : { label }
 	});
 	switch (result.kind) {
-		case "updated": return await completeWalletCustodyOperation(ctx, authorized.operation, 200, {
+		case "updated": return await completeWalletOwnerOperation(ctx, authorized.operation, 200, {
 			ok: true,
 			credential: result.projection
 		});
-		case "missing": return await completeWalletCustodyOperation(ctx, authorized.operation, 404, {
+		case "missing": return await completeWalletOwnerOperation(ctx, authorized.operation, 404, {
 			ok: false,
 			code: "credential_not_found",
 			message: "credential not found"
 		}, "failed_before_side_effect");
-		case "conflict": return await completeWalletCustodyOperation(ctx, authorized.operation, 409, {
+		case "conflict": return await completeWalletOwnerOperation(ctx, authorized.operation, 409, {
 			ok: false,
 			code: "credential_activity_conflict",
 			message: "credential changed; retry"
 		}, "failed_before_side_effect");
-		case "invalid_envelope_id": return await completeWalletCustodyOperation(ctx, authorized.operation, 400, {
+		case "invalid_envelope_id": return await completeWalletOwnerOperation(ctx, authorized.operation, 400, {
 			ok: false,
 			code: "invalid_envelope_id",
 			message: "credential envelope id is invalid"
 		}, "failed_before_side_effect");
-		case "invalid_label": return await completeWalletCustodyOperation(ctx, authorized.operation, 400, {
+		case "invalid_label": return await completeWalletOwnerOperation(ctx, authorized.operation, 400, {
 			ok: false,
 			code: "invalid_label",
 			message: result.reason
@@ -16854,7 +17123,7 @@ function parseWalletRecoveryOperationRequest(body, fields, label) {
 	if (!body) throw new Error(`${label} body is required`);
 	requireExactObjectFields(body, fields, label);
 	return {
-		recoveryOperationId: parseRequiredAuthorizationValue(parseWalletRecoveryOperationId(body.recoveryOperationId)),
+		recoveryOperationId: requireParsed$4(parseWalletRecoveryOperationId(body.recoveryOperationId), "authorization"),
 		reservationId: parseRecoveryCodeReservationId(body.reservationId)
 	};
 }
@@ -16876,7 +17145,7 @@ function parseWalletRecoveryEmailOtpVerifyRequest(body) {
 			"challengeId",
 			"otpCode"
 		], "wallet recovery Email OTP verification"),
-		challengeId: parseRequiredAuthorizationValue(parseEmailOtpChallengeId(body?.challengeId)),
+		challengeId: requireParsed$4(parseEmailOtpChallengeId(body?.challengeId), "authorization"),
 		otpCode: requireTrimmedString(body?.otpCode, "otpCode")
 	};
 }
@@ -16997,7 +17266,7 @@ function parseWireRequest(body, originHeader) {
 	if (!body || typeof body !== "object") return null;
 	const challengeId = normalizeOptionalTrimmedString(body.challengeId);
 	const locator = parseEnvelopeRetrievalLocator(body.locator);
-	const webauthnAuthentication = parseWebAuthnAuthenticationCredential$1(body.webauthnAuthentication);
+	const webauthnAuthentication = parseWebAuthnAuthenticationCredential$2(body.webauthnAuthentication);
 	if (!challengeId || !locator || !webauthnAuthentication) return null;
 	const expectedOrigin = normalizeOptionalTrimmedString(originHeader);
 	if (!expectedOrigin) return null;
@@ -17179,13 +17448,6 @@ function parseEcdsaMaterialPossessionProofs(value) {
 		};
 	});
 }
-function authorizedOperationReplay(operation) {
-	if (operation.lifecycle !== "completed") return routeErrorResponse(409, "recovery_in_progress", "wallet recovery is still in progress");
-	return new Response(operation.response.bodyText, {
-		status: operation.response.status,
-		headers: { "content-type": operation.response.contentType }
-	});
-}
 async function handleWalletRecoveryBackupAcknowledge(ctx) {
 	if (!matchRoute(ctx, RECOVERY_ACK_ROUTE_ID)) return null;
 	let request;
@@ -17194,7 +17456,7 @@ async function handleWalletRecoveryBackupAcknowledge(ctx) {
 	} catch {
 		return routeErrorResponse(400, "invalid_request", "acknowledgement body is invalid");
 	}
-	const authorized = await authorizeWalletCustodyOperation({
+	const authorized = await authorizeWalletOwnerOperation({
 		ctx,
 		walletId: request.walletId,
 		operation: "recovery_backup_acknowledge",
@@ -17210,17 +17472,17 @@ async function handleWalletRecoveryBackupAcknowledge(ctx) {
 		walletId: request.walletId,
 		expectedIssuedAtMs: request.expectedIssuedAtMs
 	});
-	if (result.kind === "conflict") return await completeWalletCustodyOperation(ctx, authorized.operation, 409, {
+	if (result.kind === "conflict") return await completeWalletOwnerOperation(ctx, authorized.operation, 409, {
 		ok: false,
 		code: "recovery_set_conflict",
 		message: "the recovery set changed"
 	}, "failed_before_side_effect");
-	if (result.kind === "no_recovery_set") return await completeWalletCustodyOperation(ctx, authorized.operation, 404, {
+	if (result.kind === "no_recovery_set") return await completeWalletOwnerOperation(ctx, authorized.operation, 404, {
 		ok: false,
 		code: "no_recovery_set",
 		message: "this wallet has no issued recovery codes to acknowledge"
 	}, "failed_before_side_effect");
-	return await completeWalletCustodyOperation(ctx, authorized.operation, 200, {
+	return await completeWalletOwnerOperation(ctx, authorized.operation, 200, {
 		ok: true,
 		issuedAtMs: result.issuedAtMs
 	});
@@ -17258,7 +17520,7 @@ async function handleWalletRecoveryRotate(ctx) {
 	} catch (error) {
 		return routeErrorResponse(400, "invalid_request", error instanceof Error ? error.message : "replacement recovery set is invalid");
 	}
-	const authorized = await authorizeWalletCustodyOperation({
+	const authorized = await authorizeWalletOwnerOperation({
 		ctx,
 		walletId,
 		operation: "recovery_rotate",
@@ -17279,22 +17541,22 @@ async function handleWalletRecoveryRotate(ctx) {
 		expectedStoreVersion
 	});
 	switch (result.kind) {
-		case "rotated": return await completeWalletCustodyOperation(ctx, authorized.operation, 200, {
+		case "rotated": return await completeWalletOwnerOperation(ctx, authorized.operation, 200, {
 			ok: true,
 			issuedAtMs: result.issuedAtMs,
 			storeVersion: result.storeVersion
 		});
-		case "no_recovery_set": return await completeWalletCustodyOperation(ctx, authorized.operation, 404, {
+		case "no_recovery_set": return await completeWalletOwnerOperation(ctx, authorized.operation, 404, {
 			ok: false,
 			code: "no_recovery_set",
 			message: "this wallet has no codes to rotate"
 		}, "failed_before_side_effect");
-		case "conflict": return await completeWalletCustodyOperation(ctx, authorized.operation, 409, {
+		case "conflict": return await completeWalletOwnerOperation(ctx, authorized.operation, 409, {
 			ok: false,
 			code: "recovery_set_conflict",
 			message: "the recovery set changed during this rotation; try again"
 		}, "failed_before_side_effect");
-		case "rejected": return await completeWalletCustodyOperation(ctx, authorized.operation, 400, {
+		case "rejected": return await completeWalletOwnerOperation(ctx, authorized.operation, 400, {
 			ok: false,
 			code: "rotation_rejected",
 			message: result.reason
@@ -17306,7 +17568,7 @@ async function handleWalletRecoveryRead(ctx) {
 	const body = await readJsonObject(ctx.request);
 	const walletId = normalizeOptionalTrimmedString(body?.walletId);
 	if (!walletId) return routeErrorResponse(400, "invalid_request", "a read needs a wallet");
-	const authorized = await authorizeWalletCustodyOperation({
+	const authorized = await authorizeWalletOwnerOperation({
 		ctx,
 		walletId,
 		operation: "recovery_read",
@@ -17315,12 +17577,12 @@ async function handleWalletRecoveryRead(ctx) {
 	});
 	if (!authorized.ok) return authorized.response;
 	const result = await ctx.service.passkeyCustody.readRecoverySet({ walletId });
-	if (result.kind === "no_recovery_set") return await completeWalletCustodyOperation(ctx, authorized.operation, 404, {
+	if (result.kind === "no_recovery_set") return await completeWalletOwnerOperation(ctx, authorized.operation, 404, {
 		ok: false,
 		code: "no_recovery_set",
 		message: "this wallet has no issued recovery codes"
 	}, "failed_before_side_effect");
-	return await completeWalletCustodyOperation(ctx, authorized.operation, 200, {
+	return await completeWalletOwnerOperation(ctx, authorized.operation, 200, {
 		ok: true,
 		recoverySet: result.record,
 		storeVersion: result.storeVersion
@@ -17338,7 +17600,7 @@ async function handleWalletRecoveryStatus(ctx) {
 	} catch {
 		return routeErrorResponse(400, "invalid_request", "status body is invalid");
 	}
-	const authorized = await authorizeWalletCustodyOperation({
+	const authorized = await authorizeWalletOwnerOperation({
 		ctx,
 		walletId,
 		operation: "recovery_status",
@@ -17350,12 +17612,12 @@ async function handleWalletRecoveryStatus(ctx) {
 	});
 	if (!authorized.ok) return authorized.response;
 	const result = await ctx.service.passkeyCustody.readRecoveryStatus({ walletId });
-	if (result.kind === "no_recovery_set") return await completeWalletCustodyOperation(ctx, authorized.operation, 404, {
+	if (result.kind === "no_recovery_set") return await completeWalletOwnerOperation(ctx, authorized.operation, 404, {
 		ok: false,
 		code: "no_recovery_set",
 		message: "this wallet has no recovery codes"
 	}, "failed_before_side_effect");
-	return await completeWalletCustodyOperation(ctx, authorized.operation, 200, {
+	return await completeWalletOwnerOperation(ctx, authorized.operation, 200, {
 		ok: true,
 		activeCodeCount: result.activeCodeCount,
 		totalCodeCount: result.totalCodeCount,
@@ -23789,7 +24051,7 @@ function parseSyncAccountVerifyRequest(input) {
 	if (unexpectedKey) return invalidSyncAccountBody(`Unsupported sync-account verify field: ${unexpectedKey}`);
 	const challengeId = normalizeOptionalTrimmedString(input.body.challengeId);
 	if (!challengeId) return invalidSyncAccountBody("challengeId is required");
-	const webauthnAuthentication = parseWebAuthnAuthenticationCredential$1(input.body.webauthn_authentication);
+	const webauthnAuthentication = parseWebAuthnAuthenticationCredential$2(input.body.webauthn_authentication);
 	if (!webauthnAuthentication) return invalidSyncAccountBody("webauthn_authentication is required");
 	const expectedOrigin = normalizeOptionalTrimmedString(input.origin);
 	if (!expectedOrigin) return invalidSyncAccountBody("Origin header is required");
@@ -24549,6 +24811,40 @@ function isWalletSessionUnavailableStepUpError(result) {
 	return isPlainObject(result.body) && result.body.code === "wallet_session_unavailable";
 }
 async function authenticateRouterAbWalletOperationStepUp(input) {
+	if (!extractBearerCredential(input.headers) && input.authorizedOperations) {
+		const origin = parseStepUpRequestOrigin(input.headers);
+		if (!origin.ok) return origin;
+		const operationId = requireAuthorizationValue$2(parseAuthorizedOperationId(`normal-signing-operation:${input.scope.request_id}`));
+		const parsedWalletId = parseWalletId(input.scope.account_id);
+		if (!parsedWalletId.ok) return walletSessionScopeInvalidFailure();
+		const walletId = parsedWalletId.value;
+		const recorded = await input.authorizedOperations.resolveRecordedPasskeyOwnerOperation({
+			authorizedOperationId: operationId,
+			walletId,
+			requestOrigin: origin.requestOrigin,
+			nowMs: Date.now()
+		});
+		if (!recorded || input.requestExpiresAtMs > recorded.expiresAtMs) return {
+			ok: false,
+			error: routerAbStepUpError(403, "unauthorized", "Recorded owner approval is unavailable")
+		};
+		const activeMaterial = await input.resolveEd25519MaterialActivation({
+			walletId,
+			materialActivation: input.scope.material_activation
+		});
+		if (!activeMaterial.ok) return walletSessionScopeInvalidFailure();
+		return authenticateRouterAbWalletOperationStepUpIdentity({
+			kind: "verified_owner_proof",
+			headers: input.headers,
+			walletId,
+			materialOwner: input.scope.material_activation.material_owner,
+			operationId: recorded.operation.operation.operationId,
+			authority: recorded.authority,
+			runtimePolicyScope: activeMaterial.runtimePolicyScope,
+			expiresAtMs: recorded.expiresAtMs,
+			authorizedOperations: input.authorizedOperations
+		});
+	}
 	return authenticateRouterAbWalletOperationStepUpIdentity({
 		kind: "wallet_session_operation_credential_v1",
 		headers: input.headers,
@@ -26694,7 +26990,7 @@ function parsePasskeyLoginVerifyRequest(input) {
 	if (!keys.ok) return keys;
 	const challengeId = requireTrimmedField(body.request, "challengeId");
 	if (!challengeId.ok) return challengeId;
-	const webauthnAuthentication = parseWebAuthnAuthenticationCredential$1(body.request.webauthn_authentication);
+	const webauthnAuthentication = parseWebAuthnAuthenticationCredential$2(body.request.webauthn_authentication);
 	if (!webauthnAuthentication) return invalidAuthBody("webauthn_authentication is required");
 	const expectedOrigin = normalizeOptionalTrimmedString(input.origin);
 	if (!expectedOrigin) return invalidAuthBody("Origin header is required");
@@ -26739,7 +27035,7 @@ function parseGoogleLoginVerifyRequest(raw) {
 function parsePasskeyStepUpRequest(input) {
 	const challengeId = requireTrimmedField(input.body, "step_up_challenge_id");
 	if (!challengeId.ok) return challengeId;
-	const webauthnAuthentication = parseWebAuthnAuthenticationCredential$1(input.body.webauthn_authentication);
+	const webauthnAuthentication = parseWebAuthnAuthenticationCredential$2(input.body.webauthn_authentication);
 	if (!webauthnAuthentication) return invalidAuthBody("webauthn_authentication is required for step-up");
 	const expectedOrigin = normalizeOptionalTrimmedString(input.origin);
 	if (!expectedOrigin) return invalidAuthBody("Origin header is required");
@@ -32656,7 +32952,7 @@ var CloudflareD1WebAuthnAuthService = class {
 			const rpId = parseWebAuthnRpId(input.rpId);
 			const expectedChallenge = normalizeOptionalTrimmedString(input.expectedChallenge);
 			const expectedOrigin = normalizeOptionalTrimmedString(input.expected_origin);
-			const credential = parseWebAuthnAuthenticationCredential$1(input.webauthn_authentication);
+			const credential = parseWebAuthnAuthenticationCredential$2(input.webauthn_authentication);
 			if (!userId.ok) return {
 				success: false,
 				verified: false,
@@ -32796,7 +33092,7 @@ var CloudflareD1WebAuthnAuthService = class {
 			if (!expectedOrigin) return failedVerification("invalid_body", "expected_origin is required for WebAuthn authentication verification");
 			const rpId = parseWebAuthnRpId(challenge.rpId);
 			if (!rpId.ok) return failedVerification("internal", `Stored login challenge rpId is invalid: ${rpId.error.message}`);
-			const credential = parseWebAuthnAuthenticationCredential$1(input.webauthn_authentication);
+			const credential = parseWebAuthnAuthenticationCredential$2(input.webauthn_authentication);
 			if (!credential) return failedVerification("invalid_body", "Missing webauthn_authentication");
 			const credentialId = webAuthnCredentialIdB64uFromCredential(credential);
 			if (!credentialId.ok) return failedVerification(credentialId.code, credentialId.message);
@@ -32837,7 +33133,7 @@ var CloudflareD1WebAuthnAuthService = class {
 		try {
 			const challengeId = normalizeOptionalTrimmedString(input.challengeId ?? input.challenge_id);
 			if (!challengeId) return failure$6("invalid_body", "Missing challengeId");
-			const credential = parseWebAuthnAuthenticationCredential$1(input.webauthn_authentication);
+			const credential = parseWebAuthnAuthenticationCredential$2(input.webauthn_authentication);
 			if (!credential) return failedVerification("invalid_body", "Missing webauthn_authentication");
 			const credentialId = webAuthnCredentialIdB64uFromCredential(credential);
 			if (!credentialId.ok) return failedVerification(credentialId.code, credentialId.message);
@@ -39007,7 +39303,7 @@ function parsePasskeyExportAdmissionAuthorization(authorization) {
 		ok: false,
 		message: `passkey export authorization has unknown field: ${unexpectedField}`
 	};
-	const webauthnAuthentication = parseWebAuthnAuthenticationCredential$1(authorization.webauthnAuthentication);
+	const webauthnAuthentication = parseWebAuthnAuthenticationCredential$2(authorization.webauthnAuthentication);
 	if (!webauthnAuthentication) return {
 		ok: false,
 		message: "webauthnAuthentication is invalid"